Privacy Policy

Who We Are

BoolRider is a technology platform that facilitates cost-shared ridesharing arrangements among verified college students. We are a limited liability company organized under the laws of the State of Illinois. For privacy-related inquiries, you may contact us at privacy@boolrider.com or through Settings > Contact Support > Privacy Inquiry in the app.

Eligibility

BoolRider is intended for users who are at least 18 years of age and hold a valid .edu email address from a participating college or university. We do not knowingly collect personal information from anyone under the age of 18. If we learn that we have collected data from a person under 18, we will promptly delete that information.

Information We Collect

Information you provide directly

When you create an account and use BoolRider, you may provide us with:

• Account information: First name, .edu email address, password (stored only in hashed form), university name, and expected graduation year.
• Profile information: Profile photo, gender (self-reported, used for optional trip preference filtering), Instagram handle (optional), Apple Music or Spotify handle (optional).
• Identity verification: For drivers, government-issued identification must be submitted through our payment processor, Stripe. As part of this verification process, you will be required to complete a live facial verification, which confirms you are the person depicted on the identification document you submit. BoolRider does not receive, access, or store your government-issued ID document or facial verification data. Both are processed entirely by Stripe in accordance with Stripe's privacy policy and terms of service. For more information about how Stripe collects and handles biometric data, please review Stripe's privacy policy at stripe.com/privacy.
• Driver information: If you register as a driver, you may provide your driver's license number, vehicle make and model, vehicle color, license plate number, and proof of automobile insurance for the vehicle you use. License plate numbers are collected to support safety and incident-reporting features and are masked in the app interface. Insurance documentation is reviewed only to confirm that a current policy exists for the vehicle; BoolRider does not verify the policy's coverage terms, including whether you are a covered driver or whether the policy permits carrying passengers in a cost-shared arrangement. Driver documents (such as a photo of your license or proof of insurance) are stored in a private, access-controlled storage bucket and are accessible only to you and authorized BoolRider operations personnel via time-limited signed URLs.
• Trip information: Pickup and drop-off locations, departure windows, date and time flexibility, number of bags, round-trip preferences, cost contribution, and any notes you include with a trip listing or booking request. Destination locations displayed on the map are coarsened to an approximate area and never reflect an exact address.
• Communications: Messages you send through in-app chat (both pre-booking conversations and post-booking messaging). BoolRider does not facilitate communication via SMS, phone calls, or any channel outside the app. No phone numbers are shared between users.
• Ratings and reviews: Star ratings and optional written feedback you leave for other users after a completed trip.
• Reports and blocks: If you report or block another user, we store the details of that action for safety and moderation purposes.
• Trip preferences: Optional preferences such as "No smoking" or "Music ok" that are displayed on your profile.
• Saved destinations: If you save a frequent destination, we store an approximate area (not an exact address).
• Payment information: Payment method details are collected and processed entirely by Stripe. BoolRider stores only non-sensitive display data — the card brand (e.g., "Visa"), last four digits, and wallet type (e.g., Apple Pay, Google Pay). We never receive, transmit, or store full card numbers, CVCs, or expiration dates.

Information generated through use

As you use BoolRider, we automatically generate and store:

• Trip history: Records of trips you have posted or booked, including routes, timestamps, and cost contributions.
• Financial records: An append-only ledger of all payment-related events (authorizations, captures, refunds, adjustments) associated with your bookings.
• Reliability and reputation data: Your average rating, number of completed trips, response rate, and reliability score, calculated over a rolling window of your activity.
• Notifications: Records of in-app notifications sent to you (booking requests, acceptances, cancellations, messages).
• Authentication events: Hashed email verification and password reset tokens with expiration timestamps. Raw tokens are never stored.

Information from third parties

Stripe: Confirmation of identity verification status and payment processing results. BoolRider receives verification outcomes (passed, pending, or rejected) but not the underlying identity documents or biometric data.

Information we do not collect

• We do not collect biometric data (facial scans, fingerprints, voiceprints, or similar). However, drivers are required to complete live facial verification through Stripe as part of identity verification. This facial data is collected and processed by Stripe, not by BoolRider. BoolRider does not receive, access, or retain facial verification data or images. For information on how Stripe handles facial biometric data, please refer to Stripe's privacy policy.
• We do not collect real-time or continuous location data. We collect only the pickup and drop-off locations you provide for a specific trip.
• We do not use cookies, web beacons, pixel tags, or similar tracking technologies.
• We do not collect information from social media accounts beyond the Instagram, and/or Music Streaming Service (i.e. Apple Music, Spotify) handle(s) you voluntarily provide.
• We do not currently use any analytics, advertising, or behavioral tracking tools in the app.

How We Use Your Information

We use the information we collect for the following purposes:

• To provide the Service: Matching riders with drivers who have posted compatible trips, facilitating communication, processing cost-sharing payments, and managing bookings.
• To verify your identity: Confirming your .edu email address to ensure you are an enrolled student, and facilitating government ID verification through Stripe for drivers.
• To ensure safety and trust: Calculating reliability and reputation scores, enabling user-to-user blocking and reporting, reviewing flagged content, and enforcing our Terms of Service.
• To process payments: Authorizing, capturing, and refunding cost-sharing contributions through Stripe, and facilitating driver payouts through Stripe Connect.
• To communicate with you: Sending transactional emails (account verification, password resets, trip-related notifications) and in-app notifications.
• To maintain and improve the Service: Debugging issues, monitoring system performance, and developing new features.
• To comply with legal obligations: Responding to lawful requests from law enforcement or government agencies, and retaining financial records as required by applicable law.

We do not use your personal information for advertising, behavioral profiling, or sale to third parties.

Information Visible to Other Users

When you use BoolRider, certain profile information is visible to other users of the platform:

• All users can see: Your first name, profile photo, gender, graduation year, university, average rating, number of completed trips, reliability score, trip preferences, Instagram handle (if provided), Apple Music or Spotify handle (if provided).
• Matched riders and drivers additionally see: Approximate pickup and drop-off areas for a shared trip, and in-app messages exchanged in the context of a booking inquiry or confirmed trip.
• Drivers can see: Details of your booking request (pickup area, destination zone, departure window, flexibility, number of bags, and any notes).
• Riders can see: Details of a driver's posted trip (origin hub, destination zone, departure window, cost contribution, available seats) and vehicle information (make/model, color). License plate numbers are masked in the app interface.

No user ever sees your email address, phone number, full date of birth, government ID, payment details, or exact home address through the BoolRider platform.

How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only in the following circumstances.

Service providers

We use the following third-party service providers to operate BoolRider. Each processes data only as necessary to perform their function on our behalf.

When you complete driver verification, Stripe collects and processes your government-issued ID and performs live facial verification. BoolRider does not receive or store your facial biometric data. Stripe handles this data in accordance with its own privacy policy and applicable biometric privacy laws, including Illinois's Biometric Information Privacy Act (BIPA).

We encourage you to review the privacy policies of these providers. BoolRider has no control over and assumes no responsibility for the privacy practices of third-party services.

Legal requirements

We may disclose your information if we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our Terms of Service; to protect the safety, rights, or property of BoolRider, our users, or the public; or to detect, prevent, or address fraud, security issues, or technical problems.

Business transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice within the app before your information becomes subject to a different privacy policy.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. Specific retention practices include:

• Account data: Retained until you delete your account.
• Ride history and trip data: Retained for the life of your account.
• Financial records: Anonymized transaction records (bookings, ledger events, refunds, adjustments, chargebacks) are retained indefinitely after account deletion, as required for legal, tax, and financial compliance purposes. These records are linked only to an anonymized user identifier and cannot be used to re-identify you.
• Messages: Retained for the life of your account.
• Driver documents: Deleted upon account deletion.
• Ratings and reviews: Retained for the life of your account. Ratings you have left for others remain associated with your anonymized profile after account deletion.

Account Deletion

You may delete your account at any time from within the app. When you request deletion:

• Your personal information (name, email, phone, photo, gender, university, graduation year, Instagram and/or Music Streaming Service (i.e. Apple Music, Spotify) handle(s), preferences, saved destinations, and payment methods) is permanently erased or replaced with anonymized placeholder values.
• Your driver profile details (vehicle information, license plate) are erased.
• Your verification documents are deleted from storage.
• Your authentication tokens and notifications are deleted.
• Any open booking requests or trip listings are closed or cancelled.
• User blocks associated with your account are removed.
• Anonymized financial records (bookings and ledger events) are retained as described above.

Account deletion cannot be processed if you have active bookings with money attached (e.g., trips that have been accepted, captured, or are awaiting confirmation). You will need to cancel or complete those trips before deletion can proceed.

Once deleted, your account cannot be recovered. However, your .edu email address is released and may be used to create a new account in the future.

Data Security

We implement technical and organizational measures designed to protect your personal information, including:

• Passwords are hashed using bcrypt before storage. We never store plaintext passwords.
• Authentication and password reset tokens are stored as SHA-256 hashes. The raw token exists only in the email sent to you.
• Driver documents are stored in a private storage bucket accessible only via time-limited signed URLs.
• Server-side rate limiting is applied to authentication and API endpoints.
• Security headers are enforced via Helmet middleware.
• Payment card data is handled entirely by Stripe and never touches BoolRider servers (PCI DSS compliant).

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security. If we become aware of a data breach that affects your personal information, we will notify you by email promptly and in accordance with applicable law.

Your Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information.

All users

All BoolRider users, regardless of location, may:

• Access and review the personal information associated with their account through the app.
• Update or correct their profile information at any time.
• Delete their account and associated personal data as described above.
• Contact us at privacy@boolrider.com with questions or concerns about their data.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion of your personal information; to opt out of the sale or sharing of your personal information (BoolRider does not sell or share personal information for cross-context behavioral advertising); and to not be discriminated against for exercising your privacy rights. To exercise these rights, contact us at privacy@boolrider.com.

Residents of other states with privacy laws

If you reside in Virginia, Colorado, Connecticut, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law, you may have additional rights such as the right to access, correct, delete, or obtain a portable copy of your personal information, and the right to opt out of targeted advertising or profiling. BoolRider does not engage in targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise any applicable rights, contact us at privacy@boolrider.com.

Third-Party Links

The Service may contain links to third-party websites or services, including Instagram and/or Music Streaming Service (i.e. Apple Music, Spotify) profiles voluntarily shared by users. We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policy of any external site you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this policy and, where appropriate, by providing additional notice within the app or by email. Your continued use of BoolRider after a change constitutes your acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us at privacy@boolrider.com or through Settings > Contact Support > Privacy Inquiry in the app.