Privacy Policy

1. Data We Collect

1.1 Information You Provide

• Account information: full name, phone number, email address, password (encrypted).
• Booking information: passenger name, national ID (optional), gender, trip date, selected seat.
• Wallet: transaction history (top-up, booking, transfer). We never store credit card numbers — payments are processed directly through Stripe.
• Customer support: content of support messages and trip ratings.

1.2 Information Collected Automatically

• Device identifier (FCM Token): for push notifications.
• Approximate location: only with your permission, to show nearby stations. We do not track your location in the background.
• Usage data: screens you visit, number of bookings, app usage times (Firebase Analytics).
• Crash reports: technical data when the app crashes (Firebase Crashlytics) — does not include personal content.

1.3 Data We Do NOT Collect

We do not collect: credit card numbers, precise GPS location in the background, contacts, photos or files from your device, microphone access, camera (except when scanning a ticket QR).

2. How We Use Your Data

• Process your bookings and issue tickets.
• Communicate with you about your trips (confirmation, reminders, cancellations).
• Process payments and the wallet.
• Protect your account from unauthorized use (e.g., via OTP).
• Improve platform performance and fix bugs.
• Provide technical support upon request.
• Comply with applicable legal requirements.

3. Who We Share Data With

We do not sell or rent your data to any third party for marketing purposes. We share it only with the following parties and only to the minimum extent necessary:

• Bus operators: passenger name and seat number only, to enable boarding.
• Stripe: payment processor — receives payment details directly from your app without passing through our servers.
• Firebase (Google): notifications, analytics, crash reports.
• Google Analytics: aggregate website traffic statistics (pages, referral source, devices). We do not send it your name or phone number.
• Microsoft Clarity: website usage analytics (pages, clicks, masked session recordings) used to improve the booking experience. Not used for advertising; input values and text are masked by default.
• Government authorities: only when required by a binding court order or formal legal request.

4. Data Security

• All data is transmitted over encrypted HTTPS/TLS connections.
• Passwords are stored hashed (bcrypt) and cannot be retrieved in plain text.
• Authentication tokens (JWT) have limited validity.
• Database access is restricted to authorized personnel only.

5. Your Rights

You have the right at any time to:

• Access your data: request a copy of all data we hold about you.
• Correction: edit any incorrect information from within the platform.
• Deletion: permanently delete your account and all your data. This can be done from account settings or by emailing [email protected]. Requests are processed within 30 days.
• Data export: obtain your data in JSON format.
• Withdraw consent: disable notifications or revoke location permission from device settings.

6. Data Retention

• Account data: kept as long as your account is active.
• Booking history: retained for 7 years for tax and accounting purposes.
• Upon account deletion: personal data is deleted immediately; accounting records are anonymized and retained.

7. Children's Privacy

The platform is intended for users aged 18 and over. We do not knowingly collect data from minors. If we discover an account belonging to a minor, we delete it immediately.

8. Notifications and Marketing

We may send you notifications regarding your trips (mandatory for service operation). Promotional notifications are optional — you can disable them from platform or device settings at any time.

9. Cookies

We use essential cookies to operate the website (session, language, currency), plus analytics cookies from Google Analytics and Microsoft Clarity to measure how the site is used and improve it. We do not use tracking cookies for advertising purposes.

10. International Transfers

Some data may be stored on servers outside Syria (e.g., Firebase and Microsoft servers in the EU/USA) for notifications and analytics. We ensure adequate protection safeguards are in place with our service providers.

11. Policy Changes

We may update this policy from time to time. When we make material changes, we will notify you via in-platform notification or email at least 30 days before they take effect.