Privacy Policy

Version 1.1 · effective 2026-11-02

Changes in 1.1: product renamed to Routesmate; addresses moved to routesmate.com.

Summary

• Who: LORS Nexus (“Lorsnexus”) runs Routesmate and is the Data Fiduciary for your personal data under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• Location: we collect your precise location only during an active trip or Live Watch session you start or join, and share it only with the people you can see listed in the app. Individual location points are deleted 30 days after the trip ends.
• No ads, no selling. We do not sell your data, show ads, or use an advertising ID.
• Messages are not end-to-end encrypted. Our systems can read them to deliver them and handle reports.
• Where: your data is stored in India (Oracle Cloud, Mumbai). Some service providers, such as Google, may process it elsewhere.
• Your rights: access, correct, erase, withdraw consent, nominate someone, and complain. Use Settings → Your data, or write to [email protected].
• 18+ only. We do not knowingly process children’s data.

1. Who we are

1.1 Routesmate is operated by LORS Nexus, New Delhi, India (full postal address sent on request to [email protected]) (“Lorsnexus”, “we”). We decide why and how your personal data is processed, so we are the Data Fiduciary.

1.2 This policy covers the Routesmate Android and iOS apps, the website routesmate.com (including public Live Watch pages and invite pages), email support and the admin tools our staff use. It applies to app users, to people who open a public Live Watch link, and to emergency contacts whose details a user gives us.

1.3 Grievance Officer: the Grievance Officer, LORS Nexus, [email protected], New Delhi, India (full postal address sent on request to [email protected]). See section 12.

2. What we collect, why, and on what basis

We rely on your consent (DPDP Act s. 6) for what we collect from you, given through the sign-up checkbox and through the explanation shown before each phone permission. Some processing is a “legitimate use” under s. 7 — for example, keeping records the law requires, or responding to a medical emergency involving a threat to life. You can withdraw consent at any time (section 10); withdrawing means the features that need that data stop working, and it does not affect processing already done. Each purpose in section 3 names its basis: consent unless it says otherwise. Safety alerts in a medical emergency or threat to life rely on s. 7(f)–(g) legitimate use; keeping payment and tax records relies on the legal obligations under the CGST Act, 2017 and the Income-tax Act, 1961.

2.1 Account and profile

• Google sign-in: when you sign in, Google gives us your Google account ID, name and email address. We keep the account ID and use the name as your display name (you can change it). We check that your email is verified by Google but do not store it on your profile. Sign-in by SMS code is not offered at launch.
• Profile: display name, photo (if you add one), language, region, units and time-format settings, and whether others can find you (section 2.6).
• Phone number (optional): stored encrypted.
• Vehicles: type, make, model, colour and registration number. Your registration number is visible only to people in a trip with you, never on your public profile.
• Age confirmation: that you confirmed you are 18 or older, and when.
• Legal acceptance: which version of each document you accepted, declined or were shown, when, from which platform and app version, and a keyed hash of your IP address (not the address itself).
• Devices and sign-in sessions: a random device ID, phone model, operating system, app version, and when the device was last seen. Only one phone can be signed in at a time.

Purpose: create and secure your account, show you to people you travel with, keep proof of what you agreed to.

2.2 Trips

• Trip name, description, destination, start point and planned stops (with their coordinates), members and their roles, invites, and a history of changes made to the trip.
• The timezone your phone was in when you planned a stop is stored with that stop, so planned times are always shown correctly.
• Invite codes are stored encrypted.

Purpose: run the trip for you and its members.

2.3 Location and device status during a trip

• Precise location, including in the background, is collected only while a trip or Live Watch session you started or joined is active. There is no always-on sharing. Each sharing session is tied to one trip or session and has a visible end.
• Who sees it: the members of that trip; people you add as watchers; and anyone holding a public watch link you created. You can always see the full list of who can view you, and you are told when a viewer is added. An indicator you cannot dismiss is shown whenever your location is being shared. Stopping sharing takes effect on our servers immediately and disables any public link. Sharing can never be set up so that you cannot tell.
• Joining and leaving: when you join a trip, others see your location from that moment on, and you see theirs from that moment on — never the trip’s earlier location history. If you leave or are removed, your access to the trip’s live and past location ends immediately.

• Device status: your battery level, network type, speed, phone model and operating system are shown to your co-members and watchers so they can tell whether you are reachable.

• Mock location: if the app detects a fake-location tool, it stops sharing the fake position and notes the event in the trip’s history, visible to members.

• Driving events: harsh braking, rapid acceleration and similar events, and any safety score built from them, are visible to you, your co-members and your watchers. They are never shown on your public profile.

• Maps: maps are drawn from OpenFreeMap (Hyperknot Software Kft., Hungary). When you view a map, or download a trip area for offline use, your phone asks OpenFreeMap for the map tiles of that area. That reveals your device’s IP address and the area you are viewing — which can include where you are — to that provider. No account details or names are sent. Downloaded trip areas are deleted from your phone when the trip ends.
• Routing and place search run on our own servers in India; the places you search for and route between are not sent to a third party.

• How long: individual location points are deleted 30 days after the trip ends. After that we keep only a coarsened route summary for your trip history — a simplified route shape with no per-point times and precision reduced to about 1 km. Live Watch and public-link sessions keep no location history once the session ends.

Purpose: show the group where everyone is, regroup, estimate arrival, and power safety features.

2.4 Safety features

• Crash and fall detection uses your phone’s motion sensors. The sensor readings are processed on your phone. A sensor recording is uploaded only if you agree, for example to help us investigate a false alarm.
• Emergency contacts: the name, phone number and relationship of each contact you add, stored encrypted. If a contact also uses Routesmate, their account can be linked. You must only add people who have agreed to this.
• SOS and emergency SMS: when an alert is raised, the app sends an SMS from your own phone and SIM to your emergency contacts who do not use the app, containing your name and your location. The SMS includes a short link to this policy. Standard SMS charges apply.
• Safety incidents: the incident type, time, your location and device status are shared with your trip, your watchers and your emergency contacts. Full incident details (your name, location and device status) are also emailed to our safety team so a person can follow up. Incident records are kept 90 days in full, then reduced to a summary.
• Blocking never hides a safety alert (section 2.7).

Purpose and basis: protecting your life and safety. You consent to safety alerts when you add emergency contacts and turn on crash or fall detection; sending an alert during an emergency, including the incident email to our on-call staff, is also a legitimate use under s. 7(f)–(g) of the DPDP Act. An emergency contact who is not a Routesmate user receives an SMS that names you, explains why they are being contacted, links to this policy and tells them how to opt out of further messages.

2.5 Messages, calls and media

• Messages, photos and voice notes you send in a trip. They are encrypted in transit, and message text is encrypted in our database, but they are not end-to-end encrypted: our servers can decrypt them to deliver them, send notifications and handle reports. Chat history and its media are kept for the lifetime of your account and deleted when it is deleted. Media older than one year may be stored at reduced resolution. You can delete your own messages.
• Images are screened for nudity on your phone before sending. A flagged image is sent blurred. The image is not sent to us for this check.
• Calls and push-to-talk: calls are not recorded. Audio and video pass through our servers only while the call is live. A push-to-talk clip is saved as a voice note by the speaker’s phone, like any other voice note.

2.6 Finding friends from contacts

• If you choose to use it, the app turns the phone numbers in your contacts into salted one-way hashes on your phone and sends only the hashes to us. We compare them with our users and return the matches. We do not store or log the hashes or your contact list.
• Only accounts with a verified phone number can be found this way, and never between people who have blocked each other. “Let contacts find me” is off by default; you turn it on in Settings and can turn it off again at any time.
• Phone verification is not available at launch, so nobody can be found this way until it is.

2.7 Blocking, reports and moderation

• When you block someone, we record the block. When you report someone, we keep the report reason, your note (up to 2,000 characters) and what it refers to. A block prevents future shared trips; in a trip you already share you are hidden from each other, and activity naming the other person stops appearing for both of you. Safety alerts are never hidden by a block.
• Our moderators may view reported content and related context to decide a report. Moderation decisions, strikes and appeals are recorded on your account.

2.8 Notifications and the in-app activity list

• Push notifications pass through Google Firebase Cloud Messaging. Chat notifications carry no message text — your phone fetches the message from us after it arrives. Other notifications (for example “Asha proposed a stop”) carry their short title and text. We store a push token for your phone; it is deleted when you sign out, when Google reports it invalid, or after 60 days without being refreshed.
• Promotional notifications are opt-in, off by default, at most one a day, never at night or during an active trip, and can be switched off in Settings.
• On supported Android versions, your ongoing trip or Live Watch notification may appear as a Live Update on your lock screen and always-on display, showing the trip name and time remaining. It never shows a location. You can demote or turn it off in system settings without changing tracking, safety alerts or what is shared. Safety alerts are never promoted and never suppressed.

Your in-app activity list. The app keeps a list of notifications we sent you — a stop was proposed, a member arrived, someone replied to your ticket — so you can find something you missed. Each entry holds only the kind of activity, who caused it, which trip it belonged to, a short title and summary, and the time to the nearest minute. It never contains anyone’s exact location or the text of a message. Entries about trips, stops, safety and Live Watch are deleted after 30 days; entries about payments, your account, social activity, support and message summaries after 90 days. Deleting an entry does not delete the underlying record (payment records, tickets and chat history keep their own periods). If you leave or are removed from a trip, its entries are deleted from your list immediately; when you join a trip, you see its activity only from when you joined. If you and another member can no longer see each other in a trip, entries naming the other person stop appearing for both of you; safety alerts are never hidden this way. Details hidden on your lock screen stay hidden in the app until you unlock your phone, and the list is excluded from screenshots and screen recording.

2.9 Payments and expenses

• Trip Pass and Plus are bought through Google Play (Android) or, where offered, Apple’s App Store (iOS). The store processes your payment details and is the merchant of record; we never see your card or bank details. The store tells us the product, the purchase token and its status, which we use to unlock premium features. Payment, refund and ledger records are kept 8 years from the end of the financial year, the period the CGST Act, 2017 (s. 36) and the Income-tax Act, 1961 require for accounts, with personal data minimised after your account is deleted.
• Expenses: amounts, descriptions, who paid and who owes, recorded in the trip. When you settle up, the app opens your own UPI app; we do not receive, hold or move the money. Your UPI ID is shown only to co-members who have a balance with you.
• Paid trip joins (Razorpay) are not available yet. This policy will be updated before they launch.

2.10 Help & Support

• Your tickets, messages, attachments you add (such as screenshots or app logs), and satisfaction ratings. If you contact us by email or sign in to the website by email code, we use your email address to reply. Closed tickets are deleted 2 years after closing.
• An AI help assistant is not available at launch; help is a search of our articles.

2.11 Analytics and crash reports

• Analytics (Google Analytics for Firebase) is on by default in India and most countries, and off until you agree in the EU, EEA, UK and Switzerland; you can change it any time in Settings → Privacy. It records how the app is used (screens, features, errors), and some events may include your precise location. It never includes your name, phone number, email, message content, contacts or emergency-contact data. Events are kept 60 days. Turning analytics off stops collection, including location in analytics.
• Crash reports (Firebase Crashlytics) are always on, because we cannot fix crashes otherwise. They contain technical information about the crash and your device, not your name, contacts or messages.
• We do not use an advertising ID, do not track you across other apps or websites, and do not show ads.

In India, analytics is on by default and you can turn it off at any time in Settings → Privacy; in the EU, EEA, UK and Switzerland it is off unless you turn it on. Location in analytics events is coarsened and never used to build a profile of where you go. The same disclosure appears in our Google Play Data Safety and App Store privacy labels.

2.12 Security, technical and operational records

• Server logs, traces and metrics: logs and traces are kept 7 days, metrics 15 days. They may contain your IP address, app version, phone model and a pseudonymous account ID — never your phone number, email, precise location, message content or tokens. Used for security, preventing abuse and keeping the Service working. Your IP address is also used briefly to limit abusive request rates.
• Processing-once records: records that a request or event was handled (holding your account ID) are deleted automatically: pending events within 1 hour of delivery, request and handled-event records after 7 days, failed-event records after 30 days. They are used for nothing else.
• Play Integrity: we ask Google to confirm that requests come from a genuine copy of the app.

2.13 Public Live Watch viewers and website visitors

• If you open a public watch link, we process your IP address and browser details to serve the page and prevent abuse. You do not need an account. The page shows the sharer’s location until they stop sharing or the link expires.
• The website sets no advertising or analytics cookies; see the Cookie Policy.

3. Who we share data with

3.1 Other users, as described above and always visible to you in the app.

3.2 Service providers (Data Processors) who process data for us under contract:

We do not use any third party for routing, place search, calls or nudity screening — these run on our own servers or on your phone.

3.3 Authorities: we disclose data when Indian law requires it — for example a court order or a lawful direction under the IT Act — and to protect someone’s life or safety.

3.4 Business transfer: if Routesmate is transferred to another operator, your data moves with it under this policy, and we will tell you.

3.5 We do not sell personal data or share it for advertising.

4. Transfers outside India

Our main database and backups are in India. Google, Cloudflare, Brevo and OpenFreeMap may process the data listed above outside India. The DPDP Act allows transfers except to countries the Government restricts by notification. Google processes data in the United States and other countries where it operates; Cloudflare routes traffic through its global network; Brevo (email) processes data in the European Union; OpenFreeMap (map tiles) is hosted in the European Union. No Government notification under s. 16 restricting transfers to these countries was in force on the effective date of this policy. We will stop a transfer if one is notified.

5. How long we keep data

The full schedule is in the Data Retention Schedule at the end of this policy. Backups are encrypted, stored only in India, and every backup copy expires within 35 days.

6. Deleting your account

You can delete your account in Settings. There is a 7-day grace period in which you can change your mind. If you own trips, you must hand them over or end them first. After the grace period your data is deleted from our live systems; backup copies expire within 35 days and deleted data is never restored. We keep only: payment and tax records (minimised), consent records, and an internal ID for 35 days so a deletion can be re-applied if a backup is ever restored. Messages you sent are erased from every trip, including other members’ copies; a content-free placeholder labelled “Deleted user” stays in their chat so the order of their own messages is kept.

7. Security

• Data is encrypted in transit (TLS) and our databases and backups are encrypted at rest.
• Particularly sensitive data — chat message text, your phone number, your emergency contacts’ names and numbers, and trip invite codes — is additionally encrypted field-by-field (AES-256-GCM).
• Staff access is limited to people who need it, signs in through our company Google accounts, expires after 8 hours, and is recorded: each action records who, what, on whose data and when. Staff access to anyone’s location history must be for a stated purpose, time-limited and approved.
• If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected as the DPDP Act and Rules require. We notify the Board and affected users without delay once we become aware of a breach, send the Board a detailed report within 72 hours, and report cyber security incidents to CERT-In within 6 hours as its 2022 directions require.

No system is perfectly secure, and we cannot guarantee it.

8. Children

Routesmate is for people 18 and older. We do not knowingly process the personal data of anyone under 18, and the app is not in Google Play’s Families programme. If we learn an account belongs to a child, we close it and delete its data. Report a suspected underage user from their profile or write to [email protected].

9. Information about other people

If you add emergency contacts, invite people, or let the app check your contacts, you are giving us information about other people. Only do so where they would expect it; for emergency contacts, only with their agreement. Emergency contacts can ask us to delete their details by writing to [email protected].

10. Your rights

Under the DPDP Act you can:

• Access a summary of your personal data and how we process it, and who we shared it with — download it from Settings → Your data.
• Correct, complete or update your data — most of it directly in the app.
• Erase your data — delete items in the app, or delete your account.
• Withdraw consent — analytics, location, contacts and promotional messages each have a switch in Settings; withdrawing is as easy as giving consent.
• Nominate someone to exercise your rights if you die or become unable to — in Settings → Your data.
• Raise a grievance with our Grievance Officer, and if unresolved, complain to the Data Protection Board of India.

You can also exercise any right by writing to [email protected]. We acknowledge requests within 24 hours and respond within 30 days. We may need to confirm it is you. We do not yet work with a registered Consent Manager; when one is registered under the DPDP Rules, we will also accept requests made through it.

11. Changes to this policy

We tell you about material changes at least 30 days before they apply, in the app and by email, and may ask you to accept them. Past versions remain at https://routesmate.com/legal.

12. Contact and Grievance Officer

The Grievance Officer, LORS Nexus, New Delhi, India (full postal address sent on request to [email protected]). Email: [email protected]. Privacy questions: [email protected]. See the Contact & Grievance page for timelines.

This policy is written for the law of India: the DPDP Act, 2023 and its Rules, and the Information Technology Act, 2000. Routesmate is currently offered in India; if we open it to other countries, we will add the sections those countries’ laws require (for example GDPR or UK GDPR) before you can use it there.

Data Retention Schedule

“Deleted” means removed from live systems; backup copies then expire within 35 days.

All legal documents and past versions