Privacy policy

Effective 2026-10-25 · ArriveTogether Canada

This policy covers the ArriveTogether website, Android app and airport travel-group service. Contact the ArriveTogether privacy administrator using our public contact form, even without an account. You can request access, correction, deletion or a review of our privacy practices.

What we collect and why

• Account: email, first name, password authentication records, email confirmation and a random account ID, to secure your account and identify your groups. Passwords are handled by Supabase Auth; we do not display them.
• Optional profile: country, city, bio, languages, preferred airport and a small profile photo. These are supplied by you. Photo selection uses the system file picker; the selected image is resized before upload, without requiring full photo-library access.
• Travel planning: airport, destination city/postal area or map coordinates, local departure time, flight number if supplied, passengers, luggage, meeting point, group membership, approvals and chat messages. These support matching and pickup coordination.
• Historical payments and identity: subscription/customer references, access status and optional identity-check status. New subscriptions and identity checks are unavailable during the initial launch. Stripe processed payment details and any previous identity documents and selfies directly. We do not receive raw ID images or card numbers. Identity documents and selfies can be sensitive and may involve biometric analysis by Stripe; read Stripe’s privacy notice before choosing verification. Do not upload ID documents to your profile or chat.
• Safety and service: policy acceptance version/time and adult confirmation, sharing preferences, blocks, reports, relevant reported content, moderator decisions, support requests and limited daily usage counters. These are used for operating and safeguarding the service.
• Technical: network providers process IP addresses, request/device information and security logs. Rate limiting uses hashed IP/email-derived keys. We do not use advertising IDs or sell personal information.

Location and device permissions

Destinations are entered or selected by you; a selected map pin can be precise. We do not collect continuous GPS location or track your route. City/postal estimates are approximate. Map and geocoding providers receive requests about the area you select and may process your IP address. Older direct-download Android beta builds may offer optional nearby Bluetooth rooms; only start these knowingly. Android 11 or earlier may require location permission for Bluetooth discovery; we do not use it to track GPS. This release excludes the experimental Bluetooth room feature. We do not request contacts, SMS, microphone, camera or unrestricted storage access.

Who can see your information

Signed-in travellers can see available groups, first names, airport, approximate destination, departure, capacity and fare estimate. Accepted group members can see the meeting point, membership details, supplied flight numbers and group messages. Optional profile details (country, city, bio, languages and photo) are shared only when you enable sharing in Privacy and safety. The default is off. Your email is not shown to group members. You may withdraw profile sharing, edit details or remove a photo. Blocking limits future connections and message/profile visibility; it cannot recall information already seen.

Authorized administrators can review support requests, reported content and relevant records to address abuse or service problems. We may disclose information when required by law or reasonably necessary to respond to an immediate safety threat. Other travellers may save or screenshot shared content; avoid posting sensitive details.

Service providers and international processing

Supabase provides authentication and database services; Stripe provides payment and optional identity services; Resend delivers verification/service emails; hosting/security providers serve the site and defend against abuse. OpenStreetMap data, OpenFreeMap tiles and Photon geocoding support maps and searches. Their processing may occur outside Canada, where other laws and lawful access requests apply. Providers are used to deliver these services, not for selling your profile. See Supabase, Stripe and Resend privacy notices.

Optional website analytics

If you allow analytics through Analytics choices, Google Analytics measures page visits, confirmed website signups, group searches, successful join requests and observed approved memberships. Google processes browser/device information, analytics cookies and your IP address; processing may occur outside Canada. We do not send your email, name, account or group ID, destination, chat, flight details or payment information to Google Analytics. URL queries and fragments are excluded from analytics page addresses. Advertising personalization and Google signals are disabled. No Google Analytics tag is loaded before you allow it, and no external analytics is loaded on account confirmation or password recovery pages. You can refuse or withdraw through Analytics choices without losing access to the planner. Withdrawal stops new collection and removes website analytics cookies; it does not erase reports already processed by Google. Browser consent and local conversion deduplication records may remain on your device. See Google’s privacy policy.

Advertising on public pages

Public articles and resources load Google AdSense to support the website with advertising. Google may process browser information and your IP address to deliver ads, prevent fraud and measure delivery. Advertising storage, user data and personalization default to denied. Analytics choices apply separately to Google Analytics. Ads are excluded from private app screens, sign-in, account confirmation and administration. See How Google uses information for advertising and any regional consent message Google presents.

Security and local storage

Traffic uses HTTPS. Server access checks restrict private group data and moderator tools. Website sessions use secure HttpOnly cookies; Android session credentials use Android Keystore-backed encryption. Route drafts and interface settings may be stored on your device; clear browser/app data to remove them. Direct-download beta offline caches are cleared when you sign out. Data is not end-to-end encrypted, and no system can guarantee absolute security.

Retention and deletion

Active account information remains until you delete it or it is no longer needed. Travel groups, messages, support requests and restricted incident evidence are reviewed for removal when no longer needed. Automated age-based cleanup is not currently enabled; contact support to request removal of older records. Retention periods will be published when the operator approves and activates the retention schedule. Provider logs/backups follow their configured retention periods and are not instantly erased by deleting active records.

Use Privacy and safety → Delete account, or our web deletion page. We verify ownership, cancel recorded Stripe subscriptions, request Identity redaction, delete active profile/membership/message/hosted-group data and remove the authentication account. If a provider step fails, the request remains visible for retry; we do not treat a frozen account as deletion. Stripe Identity redaction may take up to four days after a successful request. Limited incident evidence and financial/tax/chargeback records may be retained for legitimate legal or security reasons. Removing your account does not remove another traveller’s independent saved copies. Historic provider records may require additional support review. App removal alone does not delete an account or cancel a subscription.

Your choices and complaints

You can edit your profile, remove a photo, disable optional sharing, block/report a traveller, and request access or correction through the contact form. Optional Identity verification is not required to create a profile. We may verify ownership before supplying data; never send a password or ID through support. For unresolved privacy concerns, you may contact the Office of the Information and Privacy Commissioner for BC or the Office of the Privacy Commissioner of Canada, as applicable.

Age and policy changes

The service is intended for adults aged 18 or older. We do not knowingly permit minors to create travel-sharing profiles. Report suspected underage use through support. Material changes to posting terms require renewed acceptance; new optional disclosures require a separate choice.