Privacy Policy

01Introduction & Scope

This Privacy Policy describes how OutRoute Private Limited ("OutRoute", "we", "us" or "our") collects, uses, stores and protects your personal information when you access or use our mobile application, website and related services (collectively, the "Services").

We ask you to accept this policy when you create an account, and we record which version you accepted. If you use OutRoute without an account, this policy covers what you share while doing so: the trip details you send for an AI plan and the device data described below. You can withdraw that consent at any time by deleting your account (see Section 07). If you do not agree with any part of this policy, please do not use the Services.

02Information We Collect

We collect the following to provide, personalise and improve our Services:

• Account data — your name, email address, phone number and date of birth. Your password is held by our authentication provider (Google Firebase Authentication); we never receive or store it. Your date of birth is used to confirm you are eighteen (18) or older and to apply the age rules a trip host sets.
• Profile data — anything you choose to add to your profile: gender, home location, bio and profile photo.
• Trip planning data — destinations, dates, itinerary preferences, the interests you select, search inputs, budget and expense logs, tasks, and your group trip collaborations.
• User content — photos and memories, captions, comments, group chat messages and any feedback you send us. Before a photo leaves your device we remove its embedded metadata, including GPS coordinates and camera details, so uploading a picture does not disclose where it was taken.
• Booking data — who is travelling on a booking, the amounts due, and the payment status you report. Money moves directly between you and the host over UPI; we do not process the payment and never receive your card, UPI PIN or bank credentials.
• Emergency contact — the name and phone number of the person you nominate when you book a trip. Please make sure that person is happy for you to share their details with us and with your trip host.
• Location data — only if you grant location permission, your device’s GPS coordinates, used only when you open Basics Nearby, to show the nearest toilets, pharmacies, hospitals and police stations. You can revoke this permission at any time in your device settings.
• Device & usage information — IP address, device and app identifiers, push notification token, operating system, app version, and in-app activity (screens viewed, trips opened, features used) recorded against a session identifier. Crash and diagnostic reports are collected through Google Firebase Crashlytics.
• Safety & moderation data — reports you submit, reports others submit about you, accounts you block, and content our automated filters flag. Our staff can review reported content in order to act on it.

03How We Use Your Information

We process your personal data with your consent, and for the limited purposes below. Where Indian law permits processing without consent for a specified legitimate use — such as responding to a medical emergency or complying with a legal obligation — we rely on that instead.

• Generate and customise travel itineraries using our AI Services;
• Facilitate collaborative planning and group chat between trip members;
• Operate Get Along trips: discovery, join requests, bookings and the age and gender rules a host sets;
• Track travel expenses, splits and balances for your trips;
• Show the nearest toilets, pharmacies, hospitals and police stations when you open Basics Nearby;
• Keep the platform safe: investigate reports, apply blocks, filter abusive content and enforce our Terms;
• Improve application stability, design and performance, using aggregated in-app activity;
• Provide support and respond to your enquiries;
• Send security alerts, account notifications and material updates about the Services.

04Data Sharing & Disclosure

We share your personal data only in the following circumstances:

• Other users on your trip — when you join or are invited to a Trip, the other members see your profile information, your posts and edits in that trip, your chat messages and your share of any expense.
• Trip hosts and travel agencies — when you book a trip hosted by another user or by a travel agency, we give that host the names and profiles of everyone in your booking, each traveller’s age, and your emergency contact, so they can run the trip and meet their own legal obligations. Agencies also see aggregated activity for their own trips. An agency decides for itself how it handles what it receives, so its own privacy policy applies to that use.
• AI itinerary generation — when you generate an itinerary we send your destination, travel dates, number of days and the interests and preferences you select or type (please don’t include personal details there) to DeepSeek, an AI provider based in Hangzhou, China, which drafts the plan. We do not send your name, email address, phone number or account identifier, and DeepSeek receives nothing that identifies you unless you type it into your preferences. The app explains this and asks for your permission before each plan, and nothing is sent unless you agree.
• Infrastructure and service providers — Cloudflare (R2 object storage) holds your photos and uploaded files; Google provides Firebase Authentication (sign-in), Firebase Cloud Messaging (push notifications), Firebase Crashlytics (crash reports), and the Maps, Places and Weather APIs used to show places and forecasts; a virtual server provider hosts our application and database. We also query Wikipedia for public information about destinations, which involves no personal data. We share data only with providers that protect it to the same or an equal standard as this policy, and each may use it only to provide its service to us.
• Legal compliance and safety — we may disclose information where the law requires it, in response to a valid legal request, or where we reasonably believe disclosure is necessary to prevent serious harm to a person.
• Business transfer — if OutRoute is involved in a merger, acquisition or sale of assets, your data may transfer to the acquirer under this policy or a policy at least as protective. We will tell you before that happens.

05Data Security & Encryption

We take the following measures to protect your information:

• In transit — all traffic between your device and our Services is encrypted with Transport Layer Security (TLS) version 1.2 or higher.
• Photos and files — encrypted at rest with AES-256 by our storage provider, and never publicly readable: every photo is served through a short-lived, signed link issued only to a user entitled to see it.
• Credentials and secrets — your password is held only by our authentication provider. Session tokens are stored hashed and are single-use, with reuse detection. Provider API keys are encrypted with AES-256-GCM.
• Access — our databases are not reachable from the internet, administrative access is restricted to named staff accounts, and access to reported content is limited to acting on the report.

We keep improving these controls as the platform grows. No method of internet transmission or electronic storage is completely secure, so while we use commercially reasonable means to protect your personal information we cannot guarantee absolute security. If a breach affects your personal data we will notify you and the Data Protection Board of India as required by law.

06Data Retention

We keep your personal data while your account is active. When you delete your account, your profile, login identities, sessions, posts and their photos, follows, push tokens, notifications, saved itineraries and join requests are erased immediately, and the underlying photo files are deleted from our storage provider.

Some records necessarily outlive an account, because they are not only about you:

• Group chat messages you already sent stay visible to the other trip members, so their conversation remains readable. Your name is replaced with “Deleted User”.
• Expenses, expense splits and bookings are shared financial records. Removing them would rewrite other members’ balances and remove the record behind any refund, so they are retained.
• Trip activity statistics are retained in aggregate form, per trip and per day.
• Server logs containing IP addresses and request details are kept for a short operational window and then automatically discarded.
• Records we must keep to comply with legal, tax, accounting or dispute obligations are retained for as long as that obligation lasts, and then deleted.

07Your Rights & Choices

You have the following rights over your personal data. To exercise any of them, write to our Grievance Officer at the address in Section 12; we respond within thirty (30) days.

• Access & portability — request a copy of the personal data we hold about you, in a portable format.
• Correction — correct or complete inaccurate data. Most profile fields you can edit yourself in the app, in Profile › Edit profile.
• Deletion — delete your account and data from Profile › Settings, or by asking us. Deletion is immediate and cannot be undone. Two things to know: we cannot delete an account while it holds a live booking or hosts a trip other people have booked, because that would strand their money — cancel or complete those first; and the records listed in Section 06 are retained.
• Withdraw consent — withdraw your consent to this policy by deleting your account. For AI planning, choose Cancel on the prompt shown before each plan and nothing is sent; a saved “Don’t show this again” choice is reset when you log out. You can also revoke location or notification permission at any time in your device settings, without losing access to the rest of the app.
• Nominate someone — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by writing to our Grievance Officer.
• Complain — raise a grievance with us (Section 11) and, if you are not satisfied, with the Data Protection Board of India.

We do not send marketing emails or newsletters. The notifications we send are about your own account and trips; you can turn push notifications off in your device settings.

08Children’s Privacy

Our Services are for people aged eighteen (18) and over, and this is enforced rather than assumed: we ask for your date of birth, we require it before an account can be used, and we refuse to create an account for anyone who states a date of birth under eighteen.

We do not knowingly collect personal data from anyone under eighteen, and we do not offer a parental consent mechanism, so under-eighteens may not use the Services. If we learn that we hold data about someone under eighteen we delete it and close the account. If you believe a child has given us their data, please contact our Grievance Officer and we will act promptly.

09International Data Transfers

Our application and database servers are located in India. Some of the providers listed in Section 04 operate globally, so your personal data may be transferred outside India:

• China — trip parameters (destination, dates, day count, and the interests and preferences you select or type) are sent to DeepSeek to generate an itinerary. No identifying information is included.
• Global — Cloudflare and Google operate distributed infrastructure and may process or store data outside India in the course of providing storage, authentication, push notification, crash reporting and mapping services.

Where data is transferred outside India, we rely on your consent and on our agreements with these providers. By using the Services you acknowledge these transfers.

10Changes to This Policy

We may update this policy as the Services change or the law requires. When we do, we revise the “Last updated” date at the top of this page and publish the new version here.

If a change materially affects how we handle your personal data, we will give you notice in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. Continuing to use the Services after a change takes effect means you accept the revised policy. If you do not accept it, you may delete your account.

11Grievance Redressal

If you have a concern about how we handle your personal data, or you want to exercise a right under Section 07, contact our Grievance Officer using the details in Section 12. Please tell us what happened and what you would like us to do.

We acknowledge every grievance and respond within thirty (30) days. If you are not satisfied with our response, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

12Contact Information

For questions, concerns, privacy requests or grievances about this Policy, contact our Grievance Officer:

Grievance Officer

The Grievance Officer, OutRoute Private Limited

Email

hello@outroute.co.in

Company address

OutRoute Private Limited, No. 157, 2nd Stage, Vijaynagar Badavane, Hassan – 573201, Karnataka, India