Privacy Policy

Effective Date: April 14, 2026 Last Updated: August 6, 2026

OnRoady LLC, a California limited liability company ("OnRoady," "we," "us," or "our"), operates the OnRoady mobile application and website at onroady.app (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

By using the Service, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Payment Information

Payment card details are entered directly into Stripe's secure form and never pass through or stored on our servers. We store only:

• Stripe customer ID
• Stripe Connect account ID (for drivers receiving payouts)
• Transaction records (amount, date, type)

2. How We Use Your Information

• Provide the Service — match bounty requests to nearby drivers, process video uploads and reviews, release escrow payments.
• Identity verification — confirm your identity before enabling payouts (KYC).
• Tax reporting — issue 1099 forms to drivers earning over $600/year as required by the IRS.
• Communications — send SMS OTP codes, transactional notifications (bounty match, payment received), and optional marketing messages if you consent.
• Safety and security — detect fraud, enforce rate limits, investigate abuse.
• Legal compliance — retain records as required by law.
• Service improvement — analyse aggregate, anonymised usage patterns to improve the app.

We do not sell your personal information to third parties.

3. Location Data

We request access to your precise GPS location to:

• Display nearby bounties on the map
• Match your historical route to open bounty requests

Location is collected only while the app is in use (foreground). We do not track your location in the background without explicit consent. You can revoke location permission at any time in your device settings, though this will limit core app functionality.

4. Camera and Video

We request camera access to record dashcam footage. Videos you upload are:

• Stripped of EXIF/GPS metadata before storage
• Stored on Cloudflare R2 (encrypted in transit and at rest)
• Reviewed only by the bounty requester and OnRoady staff for moderation
• Deleted from active storage when a bounty expires or a dispute is resolved

We apply automated face and licence plate blurring to protect bystanders in uploaded footage.

Biometric Data Notice (BIPA / CUBI / WBITA). The automated blurring process uses computer vision to detect and obscure facial geometry and vehicle-identifier features in video frames. This constitutes processing of biometric identifiers under the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, and the Washington Biometric Identifiers Act. By uploading footage through the Service, you consent to this processing solely for the purpose of privacy protection. We do not retain, sell, or share raw biometric data; the source video is deleted within 30 days of bounty resolution, and facial-geometry / plate-detection vectors are destroyed within 24 hours of pipeline completion. Full details, including the retention and destruction schedule required by 740 ILCS 14/15(a), are set out in our Biometric Information Retention & Destruction Schedule. Illinois, Texas, and Washington residents will see an additional one-tap consent screen before their first upload.

5. How We Store and Protect Your Data

• Encryption at rest — sensitive PII fields (email, phone, W-9 data) are encrypted in the database using AES-256 (Fernet).
• Encryption in transit — all data is transmitted over TLS 1.2+.
• Access controls — Row-Level Security (RLS) policies in Supabase ensure users can only access their own data.
• Audit logging — changes to sensitive profile fields are logged without recording values.
• Token security — authentication tokens are short-lived; refresh tokens are revocable.

Despite these measures, no system is 100% secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorised access to your account.

6. Data Retention

For the full field-by-field retention schedule, including the Checkr operator-scrub follow-up service level, see our Data Retention Policy.

7. Third-Party Services

We share data with the following third parties only to the extent necessary to operate the Service:

Each provider processes personal information only under a written data-processing agreement (or equivalent) that restricts use to the purposes we direct. None of them are permitted to use your data for their own marketing or to train unrelated products.

We do not use advertising networks or sell data to data brokers.

7.1 Automated Decision-Making

Some parts of the identity-verification pipeline described in §2 make automated decisions about your account status:

• License OCR + validation (OpenAI): if the name on your license photo does not match the name you entered, or the license number does not match, your identity status may be placed in under_review for a human OnRoady team member to inspect.
• License expiry check (OpenAI): a license the pipeline reads as expired will be automatically rejected.
• Face comparison (AWS Rekognition): a selfie the pipeline concludes does not match the face on your license will be automatically rejected.
• Glasses detection (AWS Rekognition): if the pipeline detects glasses or sunglasses in your selfie, you will be asked to retake it.

In every case where the automated outcome is rejection, you have the right to:

• Ask us for a plain-English explanation of the reason.
• Request a human review by emailing privacy@onroady.app. A human OnRoady team member will re-evaluate the submission and respond within 30 days.
• Contest the outcome and submit corrected documents.

We keep the source images (license photo and selfie) and the machine-readable outputs of these checks only for the retention periods listed in §6 and in the Biometric Information Retention & Destruction Schedule.

Copyright Infringement (DMCA)

If you believe content on the Service infringes your copyright, see our DMCA Copyright Policy for the full takedown and counter-notice procedure. Notices may be sent to our designated agent at dmca@onroady.app.

8. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

9. Your Rights

Depending on where you live, you may have the following rights:

All Users

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete data via your profile settings.
• Deletion — delete your account and associated data via Settings → Delete Account in the app. W-9 tax records required for IRS compliance are retained for 7 years even after deletion.
• Withdraw consent — revoke location, camera, analytics, or marketing consent at any time in the app or your device settings.

California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have the right to:

• Know — what personal information we collect, the categories of sources, the business purposes for collection, and the categories of third parties we share it with.
• Access and Portability — request a copy of the personal information we hold about you, in a portable format.
• Delete — request that we delete personal information we hold about you, subject to legal-retention exceptions (W-9 tax records held for 7 years per IRS rules).
• Correct — request that we correct inaccurate personal information.
• Opt Out of Sale or Sharing — see the dedicated section below.
• Limit Use of Sensitive Personal Information — restrict our use of your driver's license number, precise geolocation, and government identifiers to what is strictly necessary to provide the Service.
• Non-Discrimination — exercising these rights will never result in degraded service, higher prices, or denial of access.

Do Not Sell or Share My Personal Information

We do not sell or share your personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months. Under the CPRA's broader definition of "sharing," disclosing personal information to a third party for that party's own targeted-advertising purposes counts as sharing — we do not do this. We do not use advertising networks, ad SDKs, or data brokers.

The third parties listed in Section 7 receive personal information only as service providers under written agreements that prohibit them from using your data for their own marketing or behavioural advertising.

Even though we do not sell or share, you have the right to direct us not to. To exercise this right or any other CCPA/CPRA right:

• In-app: open Settings → Privacy → Do Not Sell or Share My Personal Information to record your request.
• Email: privacy@onroady.app with the subject line "CCPA Opt-Out Request" and the phone number or email associated with your account.
• Mail: OnRoady LLC, 101 E. San Fernando St Suite 138, San Jose, CA 95112.

We will confirm receipt within 10 business days and respond substantively within 45 calendar days (extendable once by 45 days if reasonably necessary). You may designate an authorised agent to act on your behalf; we may require proof of authorisation.

Other US State Privacy Rights

Residents of the following US states have privacy rights under state law that are substantively similar to the CCPA/CPRA rights described above (access, deletion, correction, portability, and opt-out of certain uses), together with additional rights such as opt-out of targeted advertising, opt-out of profiling that produces legal or similarly significant effects, and appeal of denied requests:

• Virginia — Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.)
• Colorado — Colorado Privacy Act (Colo. Rev. Stat. § 6-1-1301 et seq.)
• Connecticut — Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.)
• Utah — Utah Consumer Privacy Act (Utah Code § 13-61-101 et seq.)
• Iowa — Iowa Consumer Data Protection Act
• Texas — Texas Data Privacy and Security Act
• Oregon — Oregon Consumer Privacy Act
• Montana — Montana Consumer Data Privacy Act
• Delaware — Delaware Personal Data Privacy Act
• New Hampshire — New Hampshire Data Privacy Act
• New Jersey — New Jersey Data Privacy Act
• Tennessee — Tennessee Information Protection Act

To exercise any of these rights, submit a request through Settings → Privacy in the app, or by email to privacy@onroady.app. We do not use your personal data for targeted advertising or for automated profiling that produces legal or similarly significant effects, so opt-outs of those specific activities are inapplicable to our processing; however, we confirm our position in writing on request. If we deny a rights request, you may appeal by replying to our written response within 60 days; we will respond to the appeal within 45 days. Where state law provides a right to submit a complaint to a state attorney general or regulator, contact information for the applicable office is available on that office's website.

EEA / UK Residents (GDPR)

You have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing is: contract performance (providing the Service), legal obligation (tax reporting), and legitimate interest (security and fraud prevention).

10. Push Notifications and Marketing

We may send you push notifications about bounty matches and payment updates. You can disable these in your device settings at any time.

We will only send marketing messages (promotions, new features) if you have explicitly opted in. You can opt out at any time via the app or by emailing us.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For material changes, we will notify you via the app or email at least 14 days before the change takes effect.

12. Contact Us

If you have questions about this policy or want to exercise your rights, contact us at:

Email: privacy@onroady.app Mailing Address: OnRoady LLC, 101 E. San Fernando St Suite 138, San Jose, CA 95112

For account deletion requests, you can also use Settings → Delete Account directly in the app.

OnRoady is committed to handling your data responsibly. We collect only what we need, protect it carefully, and never sell it.