Data safety

Google Play and Apple both make us declare what Qafilaa collects, in their own categories and their own words. This page is the same set of answers written out properly, so you can check what we told them against what we tell you.

Last updated: 20/08/2026

The four that matter

We do not sell your data. Not to anyone, for anything.
We do not track you. No advertising identifier, no ad network, no cross-app or cross-site tracking in the app. Apple's "Data Used to Track You" is empty.
Your location is shared with your crew, not the world. Only the riders in your active ride, only while it is active. There is no public map.
All of it can be deleted, from inside the app, without emailing anyone.

What Qafilaa collects

Grouped in Google Play's Data safety categories. "Shared" means it leaves Qafilaa and its service providers; showing your position to the riders in your own trip is the service working, and is listed as such.

Location — precise. Your position, altitude, speed and heading, continuously while a ride is active, including in the background. Shown to the riders in that ride. Required for the live map, gaps, rally points and crash alerts. Raw traces auto-delete after 90 days, or 7 if you shorten the window in Settings.
Personal info. Name, email address, phone number, profile photo, and a user ID. Optionally date of birth and address. Required to have an account; the optional fields are optional.
Health and fitness. The medical card you choose to fill in — blood group, allergies, medications, notes. Entirely optional. Shown to other riders only during an active alert.
Contacts. The emergency contacts you nominate, by name, phone, email and relationship. If you allow contacts access we read your phonebook only so you can pick one. We do not upload your address book.
Photos and videos. Images you add — profile, bikes, day notes, and document scans. Only the ones you pick or capture.
Files and docs. Licence, registration, insurance, PUC and permits, if you store them. Stored encrypted.
App activity. The content you create — trips, itineraries, rally points, stays, notes, checklists, reminders, expenses and settlements — and your ride history.
App info and performance. App version, platform, and crash reports through Firebase Crashlytics. Crash reports carry no identifier for you and no request contents.
Device or other IDs. A push token, so a crash or SOS alert can reach your device.

What Qafilaa does not collect

No advertising ID, and no advertising or analytics SDK in the app.
No microphone, no call log, no SMS, no browsing history.
No financial or payment information. Trip expenses are amounts between riders, not card details.
No biometrics. No race, religion, caste, politics or sexual orientation.
No accelerometer samples. Those are processed on the device and discarded; only an alert leaves.

Where it goes

Riders in your active ride

Your live position, and — during an active alert only — your medical card.

Service providers

Hosting, push delivery, crash reporting and maps. Named on the Subprocessors page.

Authorities

Only where required by law, or to protect someone’s safety.

Advertisers, data brokers

Never. There is no such relationship.

Security answers

Encrypted in transit: yes, everything.
Encrypted at rest: yes, including the stored document and image files.
You can request deletion: yes — from inside the app, or from Delete your account and Delete my data without installing anything.
Independent security review: not yet. We will say so here when that changes rather than imply it now.

Apple's App Privacy answers

Data used to track you

None.

Data linked to you

Location, contact info, contacts, health and fitness, photos, user content, identifiers, diagnostics.

Data not linked to you

Crash diagnostics.

"Linked to you" is Apple's term for data tied to your account. It is not a synonym for shared, sold, or used to profile you — none of which happens here.

If this page and the store disagree

Tell us and we will fix whichever is wrong: admin@qafilaa.in. The binding document is the Privacy Policy; this page exists to make it checkable at a glance. See also Permissions and Subprocessors.