Privacy Policy

1. About this Policy

Pasabaya.app ("Pasabaya", "we", "us", or "our") is a free, volunteer-run, open-source community carpool matching project for people in the Philippines. This policy explains what personal data we process, why we process it, who can see it, how long we keep it, and how you can exercise your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable National Privacy Commission (NPC) issuances.

The project is operated by Artem Blazhievskii (ablzh on GitHub), the personal information controller responsible for the processing described in this policy. Pasabaya is not a company. Our privacy contact is [email protected].

Accounts are for people aged 18 or older. Registration requires an age and policy acknowledgment; we do not collect your birth date or government identity card to verify age. For privacy inquiries or requests, contact [email protected].

2. Information We Collect

Depending on the features you use, we process the following information:

• Account Information: First name, last name, email address, pending email changes, account timestamps, and the policy version and time recorded at registration. Passwords are stored as salted bcrypt hashes, not plain-text passwords. We generate signed, expiring links for password resets and email confirmation rather than keeping plain-text passwords or a separate confirmation-token field.
• Profile Information: An optional avatar image (up to 5 MB, in JPEG, PNG, or WEBP format), an optional HTTPS Facebook profile link, and self-declared gender (unspecified, female, male, or non-binary). Gender controls access to Ladies Only offers and the Female Profile badge shown to logged-in members. A supplied social link or self-declared gender does not verify your identity.
• Rides, Bookings & Recurring Schedules: Origin and destination, departure dates and approximate or exact times, seat counts, public or community-hub visibility, Ladies Only settings, trip notes, passenger pickup notes, booking status, acceptance and cancellation records, and related account identifiers. Regular rides also store weekdays, Philippine departure time, an optional end date, and schedule status, and generate individual departure offers.
• Route Alerts: Saved origin and destination, optional departure date and community hub, Ladies Only preference, subscription status, and any matched ride. These details are used to find a suitable offer and send the alert you requested.
• Trip Communications & Notifications: Chat message content, sender and trip identifiers, message timestamps, and the last message you have read in a trip. We also store notification events, recipient and related account or trip identifiers, delivery status and timestamps, and whether and when you read a notification.
• Safety & Incident Records: Post-trip feedback, reported outcome categories (such as completed or a driver or passenger no-show), optional comments, incident reports, moderation decisions and their reasons, decision history, and account restrictions.
• Community Hub Verification: Institutional email address, community membership, verification and expiry dates, and revocation status. Verification links are signed and expire; membership verification confirms access to an institutional email address, not identity or driving qualifications.
• Technical & Session Data: Login session records include your IP address, browser user agent, and timestamps. Essential cookies support authentication and request security. Hosting and application logs and performance monitoring may also contain request information, IP addresses, browser information, timestamps, and diagnostic metadata used to operate and secure the service. Selected public pages use GoatCounter (goatcounter.com) analytics as explained in Section 6.
• Earlier Update Subscriptions: If you previously joined a Pasabaya launch or update list, we may hold the name, email address, and unsubscribe status you supplied. The unsubscribe link in those emails stops further list emails.

3. Legal Basis & Purpose of Processing

We use the lawful basis appropriate to each purpose under RA 10173:

• Providing the Service You Request: Account administration, publishing rides and recurring schedules, processing seat requests and driver decisions, trip coordination, requested route alerts, and related service notifications and emails are necessary to provide the platform under our Terms.
• Consent: Where we rely on consent, it applies to the specific optional processing you choose, such as sharing an avatar or Facebook profile link, verifying an institutional email and displaying the resulting community badge, or subscribing to optional updates. Institutional affiliation may reveal education or other sensitive information; processing it must meet the applicable requirements for sensitive personal information. You can remove optional profile information, leave a hub, and contact us to withdraw consent. Acknowledging this notice or accepting the Terms does not waive your privacy rights or give unlimited consent to unrelated processing.
• Legitimate Interests: Maintaining platform security, diagnosing performance problems, understanding aggregate use of public pages, investigating misconduct, administering no-show rules, and preserving trip and incident integrity, subject to applicable safeguards and your rights.
• Legal Obligations & Claims: Complying with applicable law and valid legal requests, and establishing, exercising, or defending legal claims where permitted by law.

Pasabaya does not sell, rent, broker, or trade your personal data to advertisers, data brokers, or marketing networks.

4. Information Sharing & Public Visibility

Your chosen audience and participation determine what other people can see:

• Public Visitors (Unauthenticated Guests): Anyone visiting Pasabaya can view public driver ride offers, including origin, destination, departure and recurring schedules, seat counts, trip notes, and the driver's first name, last name, and profile avatar. Public offers can reveal your usual travel pattern; avoid putting a home address, contact credentials, or other sensitive details in public notes.
• Registered & Logged-In Members: Members can view profiles, membership dates, verified community badges, Female Profile badges, optional Facebook profile URLs, and applicable reliability notices or booking restrictions. Community-hub offers require current verified membership; Ladies Only offers require a female profile. Draft offers and schedules are visible only to their owner.
• Seat Requests: The driver can see the requesting passenger's profile information, request status, and pickup notes to decide and coordinate the booking. Requesting a seat does not by itself grant access to chat.
• Confirmed Trip Participants: In-app coordination chat is available to the driver and accepted passengers of that trip, including eligible previously accepted participants retained for coordination after trip cancellation. Public visitors, pending requesters, and declined users cannot access it. Bans, account deletion, or loss of required audience eligibility revoke access. Administrative and legal access is described in Section 5.
• Providers & Legal Recipients: The technical providers in Section 8 process data to deliver their services. Information may also be disclosed when required by law or a valid legal process, or where otherwise lawfully necessary to investigate abuse, protect people, or establish or defend legal claims.

5. Trip Chat Privacy & Retention

Trip coordination chat is built to help confirmed travel companions arrange practical travel logistics (such as exact pickup landmarks, luggage space, and arrival estimates).

• Encryption: Chat uses HTTPS and secure WebSocket connections to protect messages in transit. Messages are not end-to-end encrypted (E2EE); they are stored on the server so authorized participants can access the conversation.
• Limited Administrative Access: We do not routinely monitor private chats. Authorized operators may access retained messages when lawfully necessary to:
  1. Investigate user reports of harassment, threats, abusive conduct, scams, or community guideline violations.
  2. Investigate disputed no-show incidents or safety complaints.
  3. Comply with valid court orders or other applicable legal obligations.
• Messaging Closure & Deletion: For an ordinary trip, messaging becomes read-only 24 hours after the booking cutoff. If a trip is canceled while messaging is open, messaging closes 24 hours after cancellation. Cancellation does not reopen closed messaging or unavailable history. Authorized participants may read chat history for another 30 days after messaging closes. All messages in a conversation share this deadline. At the history deadline, the conversation and its messages become inaccessible and are scheduled for permanent deletion from the live database by background jobs. Administrative access does not extend these deadlines. Real-time WebSocket delivery buffers have a separate one-day retention setting, with background cleanup.
• Keep Credentials Private: Do not share bank account credentials, GCash or Maya PINs, credit card details, one-time passwords (OTPs), or government identity cards in chat. Share only what your companions need to coordinate the trip. Other participants may retain their own copies of information you send; deleting it from Pasabaya cannot erase those copies.

6. Cookies & Analytics

Pasabaya does not set advertising cookies for its own matching service. Embedded third-party content may use cookies as described below. Our cookies and analytics work as follows:

• Essential Cookies: A signed, HttpOnly, SameSite login cookie identifies your server-side session. Rails also uses session and request-security mechanisms to support navigation and protect against cross-site request forgery (CSRF). Signing protects the login cookie against tampering; it does not mean every cookie value is encrypted.
• Cookie-Free Analytics: We use GoatCounter on the public home, ride search, hub directory, and legal pages. We send fixed page identifiers and titles, excluding URL queries and referrers. Account, password reset, individual trip, and chat pages do not send analytics pageviews. GoatCounter still receives network information, including IP addresses and browser headers, to calculate statistics and recognize repeat visits. Its documented repeat-visit identifier mapping is held in memory for up to eight hours. Cookie-free analytics does not mean that no personal data is processed. See GoatCounter's privacy explanation.
• Embedded Video: The home page contains a YouTube video player. When the embedded player loads or you use it, Google/YouTube receives network and browser information and may use cookies or other identifiers under its own policies. This processing is separate from GoatCounter. See Google's Privacy Policy.

7. Data Retention & Account Deletion

Chat has the fixed access deadlines above. Other records follow the account, operational, and recovery arrangements below; ending a ride, schedule, or alert does not by itself erase its history.

• Account & Operational Records: Account and profile information is kept while you maintain the account. Rides, schedules, bookings, route-alert records, notifications, registration acknowledgments, and safety or moderation history are maintained to operate the account and administer or resolve related records. These records do not currently have an automatic fixed expiry period. Signing out removes that login session; other session records remain until terminated or the account is deleted. Contact us to request access, correction, or erasure of records you cannot manage in Settings; applicable legal grounds and the rights of others may affect what can be erased.
• Account Deletion: You may delete your account directly through Settings → Delete Account. When deletion succeeds:
  • Your name and email are replaced with "Deleted User" and a generated internal address; the previous password hash is replaced, and your pending email change, Facebook link, and self-declared gender are cleared. Pending confirmation links are invalidated. Your avatar is detached immediately; physical image files are purged asynchronously, with retries if cleanup fails.
  • Your login sessions, authored chat messages, received notifications, community memberships, route alerts, and earlier update subscriptions matching your account email addresses are removed from the live database.
  • Active recurring schedules stop generating new offers. Active ride offers and passenger bookings are canceled, and affected participants are notified.
  • Notes on your rides and recurring schedules, your passenger pickup notes, related review comments, and incident decision commentary are scrubbed.
• Retained De-Identified History: Historical routes, departure dates, booking participation, trip outcomes, incident decisions, and related record identifiers remain linked to the "Deleted User" record to preserve trip, incident, and review integrity. Registration acknowledgment records and some operational references may also remain. These records have direct profile identifiers removed, but retained routes, dates, and stable identifiers mean they are not guaranteed to be anonymous. We do not claim that this history can identify a person who registers a new account.
• Conversation-Wide Chat Retention: All messages in a trip coordination chat share the messaging and history deadlines described above. At the history deadline, the conversation becomes inaccessible and is scheduled for permanent deletion from the live database. Queue delays may postpone physical deletion; the deadline does not promise instantaneous erasure. Live database deletion does not instantly erase disaster recovery backup snapshots, which are retained on a separate snapshot schedule and scrubbed upon restoration.
• Disaster Recovery Backups & Restoration Scrubbing: Restic backups are encrypted and stored in Cloudflare R2 object storage. We retain the latest seven backups, seven daily, four weekly, six monthly, and two yearly snapshots; backup copies can therefore retain personal data beyond 30 days and may include older yearly snapshots. Litestream also maintains database replicas for recovery. Before a restored database serves public traffic, expired data is scrubbed and account deletions are reapplied from a separate persistent deletion registry. Restoration is stopped if that registry is unavailable or an account cannot be anonymized.
• Deletion Recovery Records: The separate registry retains the internal account identifier, account creation timestamp, and deletion timestamp so deletions can be reapplied after restoration. A cleanup record also retains the generated internal address and, while avatar removal is pending, the storage references needed to retry it. These recovery records do not have an automatic fixed expiry period and are kept separately from public profiles.

8. Technical Service Providers & Overseas Processing

We use technical providers to operate Pasabaya. Depending on their service, they process account and request information, email contents, operational metadata, or stored data:

• Email Delivery: Mailtrap processes recipient addresses, email content, and delivery information for service emails such as booking updates, route alerts, cancellation notices, password resets, and email confirmations.
• Database Backup Storage: Cloudflare R2 stores Litestream database replicas and encrypted Restic backups, retained according to the disaster recovery arrangements described above.
• Hosting: Cloud infrastructure hosts the application, databases, uploads, and operational logs.
• Performance Monitoring: Skylight processes application performance measurements and diagnostic metadata to help identify slow requests and technical problems.
• Web Analytics: GoatCounter (goatcounter.com) processes pageview and network information as described in Section 6.
• Embedded Video: Google/YouTube provides the home-page video player and processes information as described in Section 6.

Where a provider processes data outside the Philippines, that involves overseas processing. Applicable Philippine privacy obligations continue to apply. Contact us for information about the providers and safeguards relevant to your data.

9. Your Privacy Rights

Subject to the conditions and limits in Philippine law, you may exercise the following rights:

• Information & Access: Ask whether we process your personal data, obtain access to it, and ask about its sources, purposes, recipients, and retention.
• Correction: Correct profile information in Settings or ask us to correct inaccurate or outdated records.
• Erasure or Blocking: Delete your account or request erasure or blocking where the legal conditions apply. Section 7 explains the records that account deletion removes and the history and recovery records that remain.
• Objection & Withdrawal of Consent: Object to processing where the law permits, or withdraw consent for processing that relies on it. Withdrawal applies going forward and does not invalidate earlier lawful processing. It may prevent us from providing a feature that needs that information; a separate lawful basis may require or permit some processing to continue.
• Data Portability: Request a copy of eligible personal data in an electronic or structured, commonly used format, where the statutory conditions apply.
• Complaint & Damages: Complain to the National Privacy Commission and seek compensation where provided by law.

Send requests to [email protected], describing the right you want to exercise and the relevant account or records. We may need proportionate information to verify your identity and protect other people's data. We will explain any applicable limits or lawful reason for retaining information. This policy does not waive or restrict mandatory privacy rights.

10. Information Security Measures

We use HTTPS/TLS transport encryption, salted bcrypt password hashing, signed login cookies, application-level authentication and authorization checks, restricted administrative access, encrypted disaster recovery backups, and automated dependency and vulnerability checks. These measures reduce the risk of accidental loss or unauthorized access; no internet service or storage system can guarantee complete security.