Privacy policy.
Last updated: 20 October 2026
Top1. Who we are
SquadCars ("we", "us", "our") is a carpooling coordination service for sports teams and activity groups. We help families organise lifts for children's events.
Contact: privacy@squadcars.app
2. What data we collect
| Data | Why | Shared with |
|---|---|---|
| Name | Account identity, so other parents know who you are | Other parents in your carpools |
| Sign-in (we email you a one-time code) and club invitations. We do not email you about rides or events: those arrive as push notifications. | The other parents in your own family. Not shown to other families. | |
| Phone number (optional) | So you and the parents you share a car with can reach each other on event day | The driver of any car your child is booked into. When you drive: the parents of the children in your car, and those children's logins. |
| Home address and coordinates (optional) | Door-to-door pickups, directions and distance calculations | The driver of any car your child is booked into. When you drive: the parents of the children in your car, and those children's logins. |
| Children's names | Identify which child needs a lift | Other parents in your carpools |
| Children's notes (allergies, medical) | Safety information for drivers | Drivers picking up your child |
| Child login (optional) | Lets a child see their own lifts on their own device. If they sign in with a code, we store no email address or Apple/Google account for them. If a parent sends a sign-in link instead, we store the email address or Apple/Google account they use. | The parents in your family |
| Vehicle description (make, colour, number plate if you add one) | So families can spot the right car | Members of the carpool you are driving for |
| Driver messages and parked-car location | Updates a driver chooses to send ("on my way", "running late", where the car is parked). A parked location is shown for 90 minutes. | The families, and child logins, with a seat in that car. Other members of the carpool can also see them on that event. |
| Subscription status | Knowing whether your family's plan is active | The App Store or Google Play (which take payment) and RevenueCat |
| Event history (bookings, changes) | Audit trail for transparency | Members of that carpool |
| Push notification token | Deliver push notifications to your device | Firebase Cloud Messaging (Google) |
3. Legal basis (GDPR)
- Consent: You provide your data voluntarily when creating your account and setting up your profile.
- Legitimate interest: We process data to coordinate lifts safely, which is the core purpose you signed up for.
- Contract: Processing is necessary to provide the carpooling service you requested.
4. Children's data
We store children's names and optional safety notes (allergies, medical conditions) as entered by their parent or guardian. All children's data is managed by the parents in the family.
A parent can choose to set up a child login, so a child can see their own lifts on their own device. A child usually signs in by scanning a QR code or typing a short code from their parent's phone; that creates a login with no real email address and no Apple/Google account behind it. If the parent sends a sign-in link instead, we store the email address or Apple/Google account the child signs in with. Either way we keep a device token for notifications, and a child login sends no crash reports. A child login is read-only: it shows only that child's own lifts, including the driver's name, phone number and pickup details, and it cannot book or change anything. A parent can disconnect it at any time (edit the child in the Family screen and tap Disconnect), or remove it by removing the child from the family.
Apart from a child login set up by their parent, we do not collect data directly from children. If you believe a child's data has been added without parental consent, contact us and we will remove it.
5. Who can see your data
- Your carpool members: can see your name and your children's names.
- Drivers: when your child is booked into a car, the driver can see your phone number, address, and your child's safety notes.
- When you drive: the parents of the children in your car, and those children's logins, can see your phone number, your address (for pickups at yours) and your vehicle description.
- Your family: the other parents in your family can see your email address. Other families cannot.
- No one outside your carpools: your data is not visible to users who are not in the same carpool as you.
- We never sell your data.
6. Third-party services
| Service | Purpose | Data sent |
|---|---|---|
| Authentication provider | Sign-in (Google, Apple, email codes) | Email, name |
| Mapbox | Address autocomplete, geocoding, and static / interactive maps | Address text you type, geographic coordinates of saved addresses |
| Push notification service | Deliver push notifications to your device | Device token, notification content |
| Email delivery service | Send sign-in codes and club invitations | Email address, message content |
| Cloud database | Data storage | All user data (encrypted at rest) |
| Cloud hosting | Application hosting | Request logs (no personal data stored) |
| App Store, Google Play and RevenueCat | Taking and managing subscription payments | Your account ID and purchase records. Card details go to Apple or Google, never to us. |
| Stripe | Club subscriptions (club portal only) | The club's name, the billing contact's email, payment details |
| Sentry (EU data region): on by default in the app | Crash and error reporting from the app and our servers | Error stack traces, device and OS, app version, and your account ID. Not your name or email. Turn it off in the app under Settings → Preferences → Send crash reports. A child's login never sends crash reports. |
| Sentry and Firebase Analytics (Google), admin and club portal only: opt-in only | Crash reporting and usage analytics for the web portal | Error stack traces, browser and OS, a replay of the page around an error (form inputs masked), a pseudonymous ID, event names and bucketed parameters |
7. Data retention
- Events and lifts: automatically deleted 90 days after the event date.
- Account data: kept until you delete your account.
- Push notification tokens: refreshed on each app visit, old tokens overwritten.
8. Your rights
Under GDPR, you have the right to:
- Access: request a copy of your data.
- Rectification: correct inaccurate data (you can do this directly in Settings → My profile).
- Erasure: request deletion of your account and all associated data.
- Portability: receive your data in a structured format.
- Objection: object to processing based on legitimate interest.
To exercise these rights, email privacy@squadcars.app.
10. Security
- All data transmitted over HTTPS (TLS 1.3).
- Database encrypted at rest (Neon PostgreSQL).
- Authentication via JWT with 15-minute expiry and refresh tokens.
- Admin access verified against the database on every request.
- No passwords stored: we use email sign-in codes and Sign in with Google or Apple.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email or in-app notification. The "last updated" date at the top reflects the most recent revision.