Privacy

Three kinds of people are in here

Most services only have users. This one has three groups, and only one of them signed up.

Operators hold an account. They enter the jobs.

Drivers are offered work by an operator. A driver can accept a job, drive it and get paid without ever making an account — that is deliberate. If a driver does sign in, their past work is linked to them by the phone number they were invited on.

Passengers never have an account. An operator enters their details so the driver knows who to collect. An operator may also send a passenger a link to a read-only page showing their own trip — the time, the addresses, the driver's first name and the car. TripPact never messages a passenger itself; the operator sends that link from their own phone. The page carries nothing about what anyone was charged or paid, and stops working the day after the trip.

If you are a driver or a passenger, an operator gave us your details. See “If you did not sign up for this” below.

What is stored

From an operator: mobile number (used to sign in), business name and phone, and an optional email address for recovery.

A driver's vehicle: colour, make and model and number plate, if the operator who hires them records it. Kept against that operator's own record of the driver and visible to nobody else — not to other operators, and not to other drivers.

About a driver: mobile number, whatever name the operator uses for them, the jobs they were offered, whether they accepted, the times they marked as they drove, the mileage and expenses they submitted, the rate agreed, and whether the operator has recorded paying them.

About a passenger: first name, phone number, number of passengers, pickup and dropoff addresses, and flight details if the operator entered them. A driver assigned to the job sees the passenger's first name only, never their surname.

If you send feedback: what you wrote, which screen you were on, and a way to reach you only if you typed one. Nothing is taken from your account — leave the contact box empty and there is nothing in it that identifies you. Feedback sent from an invite page carries no link to the job, the operator or your phone number.

Technical: if the app crashes, it reports the error message, which screen it happened on and the browser used. Invite links are never included — the address of an invite page is itself a credential, so it is replaced before anything is recorded. IP addresses are held briefly to rate-limit abusive traffic and are not linked to accounts.

What is not stored

No payment details, card numbers or bank information. No money moves through TripPact at all — it records that an operator says they paid a driver, nothing more.

No advertising identifiers, no analytics, no tracking pixels, no third-party scripts of any kind. Nothing here follows anyone around the internet.

No continuous location. A driver's position is not tracked between jobs, or during one.

Who else sees it

Four suppliers, each doing one job:

Supabase stores the database and runs the server code. Data is held in the United States (AWS, Oregon).

Twilio sends the verification code when someone signs in. It receives the phone number for that purpose.

Expo hosts the web application itself.

Resend delivers the emails sent to people who asked for them from the home page. It receives that address and nothing else, and is not used for anything an operator or a driver does inside TripPact.

Nobody else. TripPact does not sell personal information, does not share it for advertising, and has no advertising partners to share it with.

An operator can see everything on their own jobs, and nothing on anyone else's. That separation is enforced by the database rather than by the app, on every request.

A driver sees the jobs they were offered. They never see what an operator quoted their client, or anything belonging to another driver.

How long it is kept

Job records are kept while the account exists, because the record is the point — the whole purpose of the product is to be able to settle an argument about a trip months later.

Crash reports are deleted automatically after 30 days. Rate-limiting data expires within the hour.

Ask us to delete an account and its jobs go with it, permanently and without a copy.

If you did not sign up for this

You may be a driver someone offered work to, or a passenger whose details an operator entered. Either way you never agreed to anything with us, and you can ask us to remove your details.

Email tyler@trippact.app from the address or phone number in question, or tell the operator who has your details and ask them to remove the job.

We will remove what we can. Some records may remain where an operator needs them to settle a payment already made — but we will tell you what is being kept and why.

Getting your data out

An operator can copy their figures out of the app at any time from the reporting screen. Ask for a fuller export and we will send everything held about you.

Security

Access is enforced in the database on every request, not in the app, so a bug in the interface cannot expose another operator's jobs.

Invite links are single-purpose and expire. Only a one-way hash of each link is stored, so even with the database nobody could reconstruct a working link.

No system is perfectly secure and it would be dishonest to claim otherwise.

Children

TripPact is a tool for businesses and is not directed at children.

Changes

If this changes in a way that matters, account holders will be told before it takes effect. The date at the top always reflects the current version.

Contact

Wortham Innovations — tyler@trippact.app