Privacy Policy
UniRide connects university students who need a ride with verified student riders. This policy explains what we collect, why we collect it, who can see it, how long we keep it, and how to have it deleted. UniRide is operated by BitStream (“we”, “us”). If anything here is unclear, write to official.bitstream@gmail.com.
1. What we collect
When you create an account
- Your name and email address.
- Your password — stored only as a one-way hash, so nobody at UniRide can read it.
- Your gender, student ID number and university.
- Your phone number — optional for passengers, required for riders.
If you apply to be a rider
- Your vehicle’s type, make, model, year, colour and number plate.
- Photos of your driving licence, your vehicle, its number plate and your student ID card.
- A selfie taken during the in-app face check.
About the face check. It runs entirely on your phone, using Google’s on-device ML Kit, to confirm that a real person is in front of the camera — it asks you to blink, smile and turn your head. Only the final photo is uploaded. We do not create or keep a facial template or any other biometric identifier; a member of our team compares the photo with your documents by eye.
When you use rides
- The rides you post, request or join: the pickup and destination you choose (the address, its position on the map and a short area name), the time, the fare, the ride’s progress and any reason given for cancelling it.
- Requests to join rides, and whether they were accepted.
- Ratings and written reviews you give and receive.
- Reports you make, and reports made about you.
- That a ride was paid in cash, and how much. Fares are paid directly between riders and passengers; we never handle the money and never see card or bank details.
- Places you save, such as “Home”, with their position on the map.
Location
We use your phone’s location only if you allow it, and only while the app is open. We use it in two ways:
- to suggest a pickup point when you are choosing one; and
- at the four moments a ride moves forward — when the rider starts it, when the passenger confirms it has started, and when each of you confirms it has ended — we record where your phone reported you were. These records help resolve disputes and investigate safety reports.
We do not track your location continuously or in the background. If you refuse location access the app still works; those points are simply not recorded.
Your device and our systems
- A notification token for your device and its type (Android or iOS), so we can send push notifications.
- Server logs, which record your IP address, the time and the request made.
- Crash and error reports: your device model, operating system and app version, and what the app or server was doing when it failed. They are set up to leave out passwords, codes, sign-in tokens, what you search for and your location.
2. How we use it
- To run UniRide: creating and securing your account, verifying your email, showing you rides, matching riders and passengers, working out fares and telling you what is happening with your rides.
- To verify riders: our team reviews every rider application before it is approved.
- To keep people safe: women-only and men-only rides are enforced using the gender on your account; we investigate reports, suspend or block accounts where needed, and use trip records and location records to establish what happened.
- To find and fix problems, using logs and crash reports.
We do not sell your information, and we do not use it for advertising.
3. Who can see what
| Who | What they can see |
|---|---|
| Other UniRide users | Your name, profile photo, rating and number of completed rides. For a ride you post: the areas its pickup and destination are in, their approximate position on the map (to within about a kilometre), the time, the fare and whether it is women- or men-only — not the exact addresses. |
| The person you are matched with | The above, plus the exact pickup and destination and the full ride record — including where each of you started and ended the ride. |
| UniRide staff | Rider applications, documents and selfies (reviewers), and the account and ride details needed to handle support requests and safety reports. Access is limited to the people who do that work. |
Women-only rides are shown only to women, and men-only rides only to men. Your email address, phone number, student ID number, documents and selfie are never shown to other users.
4. Services we use
These companies process information for us, only to provide the service described:
| Service | Used for | What it receives |
|---|---|---|
| Cloud hosting (currently Amazon Web Services, Singapore) | Running our servers and database | Everything described above |
| Cloudflare R2 | Storing uploaded photos and documents, and encrypted backups | Your uploads; encrypted database backups |
| Google Firebase Cloud Messaging | Delivering push notifications | Your device’s notification token and the notification text, which can include ride locations and fares |
| Resend | Sending email | Your email address and the message, such as a verification code |
| Sentry | Crash and error reports | Technical details of the error, as described in section 1 |
| OpenStreetMap-based services (Photon, Nominatim, OSRM and the OpenStreetMap tile servers) | Place search, addresses, route distance and map images | Search text and map positions, sent from our servers without your identity. Map images are loaded by your phone directly, so the tile server sees your IP address and the area you are viewing. |
Some of these services store or process information outside Bangladesh. We may also disclose information when the law requires it, or when it is necessary to protect someone’s safety.
5. How long we keep it
- While your account is open, we keep what you have given us.
- When you delete your account, you are signed out everywhere straight away, rides that have not started are cancelled (the other person is told), and notifications stop. 30 days later we erase your name, email address, phone number, student ID number, gender, profile photo, saved places, notifications, your rider application and every photo and document you uploaded.
- After that, trip records (including pickup, destination and location records), payment records, ratings and reviews, and reports are kept without your name or contact details, because they are part of other people’s history and may be needed to investigate a safety incident or a dispute.
- If an account is blocked for safety reasons, its email address, student ID number and phone number are kept on a block list for as long as the block lasts, so the same person cannot sign up again.
- Server logs are kept for a few weeks, and crash reports for up to 90 days.
- Encrypted database backups are kept for up to 90 days. Information you have deleted can remain in a backup until it expires; backups are only used to restore the service after a failure.
6. Your choices
- Delete your account in the app under Profile → Delete account, or see how to request deletion if you cannot use the app.
- Get a copy of your information, or ask us to correct it, by writing to official.bitstream@gmail.com.
- Turn off camera, location or notification access at any time in your phone’s settings. Some features will stop working, but the rest of the app will not.
We reply to requests within 30 days.
7. Security
Everything between the app and our servers is encrypted in transit. Passwords are stored as one-way hashes. Documents and photos are kept in private storage and can only be opened through short-lived links issued to their owner and to our reviewers. No system is perfectly secure; if you find a problem, please tell us at official.bitstream@gmail.com.
8. Who can use UniRide
UniRide is for university students aged 18 or over. If we learn that someone under 18 has an account, we will delete it.
9. Changes to this policy
When this policy changes we update the date at the top. If a change affects how your information is used, we will tell you in the app or by email before it takes effect.
10. Contact
BitStream · official.bitstream@gmail.com