Privacy Policy

1. Information We Collect

When you use Metro Diaries, we collect the following information:

• Account information: Your email address and, if you sign in with Google, the name and profile photo on your Google account. If you sign up with email and password, your password is stored only as a secure hash by our authentication provider.
• Profile information: Date of birth, gender, career title, bio, about me, up to 5 gallery photos, phone number, home city, social handles (Instagram, Twitter), and an emergency contact's name and phone number that you voluntarily provide. Your emergency contact is never shown to other users. Your name, date of birth, and gender are locked after your initial onboarding and cannot be changed without contacting support.
• Verification data: If you choose to verify your identity, we process your Aadhaar number via a manual admin review. Your Aadhaar number is shared with our admin team by email for verification purposes and is not stored in our database after review. Only your verification status is retained.
• Profile photo processing: When you upload a profile photo, we run on-device face detection (using browser APIs) to check that it contains a clear face. This processing happens entirely on your device. No biometric data is sent to our servers. We store only a boolean flag indicating whether a face was detected.
• Trip information: Route details (start and end stations), travel date and time, repeat schedule, and visibility preferences you set when posting a trip.
• Messages: Chat messages exchanged with other users, including message reactions, replies, and read receipts. Direct messages are between accepted connections. Trip chats are available for 2 hours after the scheduled trip time.
• Push notifications: If you allow notifications in your browser or the mobile app, we store a push token or subscription (endpoint and encryption keys) and basic device information to deliver them.
• Presence data: We track when you were last active on the platform to display online status to your connections.
• Contact form submissions: If you contact us through our contact form, we store your name, email, message category, and message content.
• Local storage: We store some data locally on your device (not on our servers), including saved metro routes, notification preferences, and temporary chat data. This data stays on your device.
• Location (mobile app): With your permission, the app uses your device's location to detect which city's metro network to show, to show your current and next station while the “Where am I?” screen is open, and, during a Live Journey you start, to track your progress and alert you before your stop. If you allow it, journey tracking continues in the background (even when the app is closed or not in use) until you arrive or end the journey; it never runs outside a journey you started. Your precise coordinates are processed on your device and are not sent to our servers. If you choose to share a journey, the connections you share it with see only your station-level progress (last and next station). You can revoke location access at any time in your device settings.
• Photos (mobile app): The app accesses your photo library only when you choose a picture to upload as your profile or gallery photo.
• Analytics: On the website we use Ahrefs Analytics, Vercel Web Analytics and Vercel Speed Insights to collect anonymized usage and performance data, such as pages visited and page load times. On the website and in the app we use PostHog to record key product events (for example, posting a trip or sending a connection request), linked to your account ID only, not your name, email or messages. PostHog on the website does not use cookies or local storage. We use this data to understand how the service is used and improve it.

2. How We Use Your Information

• To provide and maintain the Metro Diaries service
• To match you with co-travelers on similar routes
• To verify user identities and display verified badges
• To enable in-app messaging between users
• To improve our service and develop new features
• To communicate important updates about the service
• To detect and prevent fraud, abuse, and safety issues

3. Information Sharing

We do not sell your personal information. We share data only in these cases:

• With other users: Your public profile, trip posts, and messages are visible to users you interact with, based on your privacy settings.
• Service providers: We use the following third-party services to operate Metro Diaries:
  • Supabase: authentication, database, and file storage
  • Google: sign-in via Google OAuth, and Firebase Cloud Messaging for delivering notifications on Android
  • Vercel: hosts our website and API, and provides anonymized web analytics
  • Expo: delivers mobile push notifications (receives your push token and the notification content) and app updates
  • PostHog: product analytics (receives your account ID, device and browser type, and the product events listed above)
  • Cloudflare: Turnstile bot protection on our contact form (processes your IP address and browser signals to tell people from bots)
  • Upstash: rate limiting to prevent abuse (briefly processes your IP address or user ID)
  • Resend: transactional email delivery (receives your name and email address to send notifications)
  • Render: hosts our real-time messaging server that processes chat messages
  • Ahrefs: anonymized website analytics
• Legal requirements: When required by law, regulation, or legal process.

4. Your Privacy Controls

You have control over your data:

• Choose who can see your trip posts (everyone or connections only)
• Toggle phone number visibility on your profile
• Enable or disable push notifications in your browser or device settings
• Allow, limit, or revoke location access in your device settings
• Unsubscribe from optional emails using the link in each email
• Block and report other users for safety or policy violations
• Delete your account and associated data at any time, in the app under Profile → Delete account, or at metrodiaries.in/delete-account

5. Communications

Email: We send transactional emails via Resend for the following purposes:

• Trip join requests from other users on your trips
• New trips posted by your accepted connections
• Connection request and acceptance notifications
• Identity verification status updates
• A birthday greeting
• Responses to your contact form submissions

Trip, connection and birthday emails can be turned off with the unsubscribe link in each one. Account emails, such as your welcome email and verification updates, are a core part of the service and cannot be turned off individually.

Push notifications: You may optionally enable push notifications in your browser or the mobile app to receive alerts about new messages, connection requests, and trip updates. You can disable them at any time from your browser or device settings. While enabled, your push token or subscription is stored on our servers; signing out or deleting your account removes it.

6. Data Security

We use industry-standard security measures to protect your data, including encryption in transit (HTTPS), encryption at rest, and database-level Row Level Security policies that ensure users can only access data they are authorized to see. All data is stored on secure Supabase infrastructure with rate limiting applied to sensitive endpoints. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account in the app or on the website, your personal data and photos are deleted immediately. If you request deletion by email instead, we delete your account within 7 days of verifying the request. We keep data after deletion only where we are legally required to.

8. Children's Privacy

Metro Diaries is not intended for users under the age of 18. We do not knowingly collect information from children under 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes through the app or via email.

10. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@metrodiaries.in or through our contact form.