Privacy policy

What SchoolRides is

SchoolRides helps a small group of parents (“a circle”) coordinate school pickups and drop-offs. A parent creates or joins a circle with an invite code, adds their children and car, and volunteers to drive or books a seat on someone else's run. Circles are private: you need an invite code or link from an existing member to join one, and nobody outside your circles can see your information.

Data we store

Account: email, full name, phone number, home address, your chosen color, a reference to your profile picture, and which login provider you used. Children: first name, and any special-needs notes you choose to add. Cars: make, model, color, license plate, and seat count. Circle activity: the circles you belong to, the ride slots and seat bookings you create or are part of, and the activity feed entries that record what happened in your circle. If you link with a partner, we also store that link and any pending partner invites.

Where it is stored

Everything is stored in Supabase, hosted in the US East region, and encrypted at rest. Access is restricted with row-level security rules in the database itself, so only members of your circle (and your linked partner) can see your data. An uploaded profile or child picture is stored in Supabase Storage and deleted along with your account.

Avatars

The built-in picture library is generated with DiceBear's Critters style, licensed CC0 1.0 and requiring no attribution.

Social sign-in

If you sign in with Google, we only receive your name, email address, and a reference to your profile picture from that provider. We never post to your Google account on your behalf, and we never see your provider password.

Bot protection

Password sign-in and sign-up use Cloudflare Turnstile to tell people from bots. It loads a script from challenges.cloudflare.com on the login and sign-up pages only, may set a short-lived cookie for the challenge, and receives only what it needs to run that challenge; Cloudflare's privacy policy applies. Google sign-in does not use it.

Cookies

We use a session cookie so you stay signed in. There are no advertising or analytics scripts; the only third-party script is the bot-protection challenge described above.

Sharing

Your data is shared only with the other members of a circle you join and your linked partner, so the app can work: they can see your name, contact details, children, car, and the rides you drive or book. We do not sell your data, and we do not share it with advertisers or other third parties for marketing.

Retention and deletion

We keep your data for as long as your account exists. You can delete your account at any time; see Delete your data for how. Backup copies of the database expire within 30 days of deletion.

Children

SchoolRides stores information about children that their parent chooses to enter — it is not collected from children directly. Parents control what is entered for their own children and can remove it at any time.

Your rights

You can access, correct, or delete your data directly in the app. To export your data, email us and we will send it to you within 30 days.

Contact

Questions about this policy or your data: [email protected].

See also the Terms and Conditions.