Privacy Policy

Chaloo is a motorcycle community and safety app for riders in India, available on iOS (Android is on the way), together with the website at chaloo.fynshyt.in.

Chaloo is operated by Pratham Mehta, an individual based in India. For this policy, “Chaloo”, “we”, “us” and “our” mean the operator, who is the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”). “You” means the person using Chaloo.

Questions, requests and complaints go to our Grievance Officer: pratham26.dev@gmail.com. Details are in the last section.

We only collect what a feature needs. Here is everything, grouped by where it comes from.

Your account

• Your mobile number, used to send you a one-time login code by SMS or WhatsApp. Codes expire within minutes.
• If you choose Sign in with Apple (or Sign in with Google where offered), the account identifier and any name or email address that Apple or Google shares with us. With Apple you can choose to hide your email.
• An email address, if you sign in with one or give us one.
• Your username and the date you joined.

Your profile and garage

• Name, username, profile photo, bio, links, riding interests and the type of bike you ride.
• Bikes and gear you add to your garage: brand, model, year, variant, colour, nickname, odometer reading, year bought, modifications, notes, ratings and photos, with the visibility you choose for each item.
• Places you mark as visited.

Location

Location is central to Chaloo, so here is exactly how it is used.

• While you use the app: to show you on the map, find topics, rides and places near you, plan routes, show weather at your location, and record rides you start.
• “Always” (background) location, if you allow it, is used for two things:
  • keeping an active ride recording, sharing your position with your ride group and running crash detection while your phone is locked or in your pocket; and
  • automatic ride detection: when you are not on a ride, Chaloo uses iOS's low-power “significant location change” service (roughly cell-tower level) to notice that you have started riding, then asks whether to keep the ride. Until you keep it, the ride stays on your phone only. If you don't answer, the ride is kept and saved to your account like any other ride. You can switch automatic detection off in Settings > Routes & map.
• Live sharing with your ride group: during a group ride, your live position, speed and heading are shared in real time with the other riders in that ride.
• Ride share links:a group ride that isn't a solo ride has a share link. Anyone with that link can open the ride on our website while it is active and see the riders' names, photos and approximate positions. On the web, positions are rounded to about 100 metres before they leave our server. Finished rides and solo rides are not shown.

Motion and crash detection

• During rides Chaloo reads your phone's motion sensors (accelerometer, gyroscope and motion activity) to detect a possible crash and to tell whether you are moving or stopped. This is processed on your phone.
• If a crash is suspected you get a countdown to cancel. If you don't, an SOS goes out (see below) and we receive the alert, its time and your location.
• Road quality: Chaloo can measure how rough the road was on your ride. Sharing these readings to improve the shared road map is off unless you say yes. Shared readings carry no user ID and no ride ID, only the date (not the time), and nothing near where your ride started or ended. You can change this in Privacy & Safety.

Emergency contacts and SOS

• The names and phone numbers of the emergency contacts you add, and whether alerts should go by SMS or WhatsApp. You are giving us someone else's details, so please tell them you have added them.
• Your optional emergency profile: blood group, allergies, medical conditions, medications, notes and up to three documents (such as an insurance card or prescription). This is stored encrypted and is never put on a public link.
• Records of SOS alerts you raise, test drills you run, and whether the messages were delivered.

Ride records

• Rides you create or join: title, meeting point, stops, destination, start and end times, who took part, and the route recorded on your phone with distance, speed and elevation.
• Routes you plan and GPX or KML files you import.

Content you post

• Chat messages, photos, voice clips and location pins you send in rides, groups and direct messages.
• Topics and replies, community and club posts, and place reviews, ratings, photos and suggestions.
• Respect you give and receive, and the points and levels that come from it.
• Messages you send to Chaloo's AI assistant, including text you dictate. Dictation is turned into text by Apple's speech recognition, on your phone where the device supports it.
• Bug reports you send from the app, with any screenshots you attach.

Device and technical data

• Device and app identifiers, device model, operating system and app version.
• A push notification token, if you allow notifications.
• In-app usage events (screens opened, actions taken, errors and performance timings) and diagnostic reports of app freezes. These go to our own servers only. Chaloo has no advertising or third-party analytics SDKs and does not track you across other companies' apps or websites.
• IP addresses and request logs that our servers record when your app or browser talks to them.

Payments

Chaloo does not sell paid plans today. If we add them, purchases will go through the App Store or Google Play. We will receive confirmation of what you bought, never your card details, and we will update this policy first.

On our website

• Early adopter sign-up: name, email, city and the offer you picked.
• Newsletter: your email address.
• Contact form: first and last name, email and your message.
• Bug report form: your email or app username, the category, severity, title, description and any links to screenshots or videos.

These are delivered to our inbox by email, and you get a confirmation email. Your IP address is used briefly to stop form spam. The website sets no cookies and uses no analytics. Pages with a map load map tiles from Mapbox, which receives your IP address.

We use your personal data to:

• create and secure your account, and log you in;
• run rides: live group maps, route recording, navigation, ride history and summaries;
• detect possible crashes and send SOS alerts to your emergency contacts and nearby riders;
• run the community: profiles, chat, topics, clubs, places, reviews and Respect;
• send notifications you have asked for, such as ride invites, messages and alerts;
• keep Chaloo safe: moderate content, investigate reports and prevent abuse and fraud;
• fix bugs and improve the app, using usage events and diagnostics;
• answer you when you write to us; and
• meet our legal obligations.

Consent. Most processing is based on your consent, which you give when you create an account, grant a permission or switch on a feature. You can withdraw it at any time (see Your rights). Withdrawing consent doesn't undo what was lawfully done before, and some features stop working without the data they need.

Legitimate uses (section 7 of the DPDP Act).We rely on these where the law allows: when you voluntarily give us data for a specific purpose and haven't objected (for example, a bug report), to respond to a medical emergency or a threat to someone's life or health (SOS alerts and crash alerts), and to comply with law or a court order.

We do not sell your data, show ads, or use your data to build advertising profiles.

Other riders

• Your profile (name, username, photo, bio, links, interests and bike type) is visible to other Chaloo users. Garage items follow the visibility you set.
• Your ride group sees your live position, speed and heading during the ride, and the ride's chat.
• Anyone with a ride's share link sees the active ride on the web, with positions rounded to about 100 m.
• Topics, posts, reviews and place photos are public within Chaloo. Topics are shown to riders near where they were posted. Club and community posts follow that club's visibility settings.
• Over the offline mesh (see below), ride messages can pass through other nearby Chaloo users' phones on their way to your group.

Your emergency contacts and nearby riders, during an SOS

When you raise an SOS, or one is sent after a suspected crash, your emergency contacts get an SMS or WhatsApp message with your name, a map link to your location and any medical details in your emergency profile. Riders in your group and riders nearby get an alert with your location. Test drills are labelled as drills.

Service providers

We use these companies to run Chaloo. They process data on our instructions and only for the purpose listed. Some of them also act under their own privacy policies for data they collect directly.

• Microsoft Azure: servers that run Chaloo's backend and database.
• Amazon Web Services: storage for database backups.
• Mapbox: maps, map search and turn-by-turn navigation. Mapbox receives your location, your search queries and technical data from the map.
• Google: place search and place details (your search text and approximate location, sent through our server), Sign in with Google where offered, push notifications on Android (Firebase Cloud Messaging) and Gmail, which delivers our website's form emails.
• Apple: Sign in with Apple, push notifications on iPhone, weather (WeatherKit), speech recognition for dictation, and the App Store.
• Open-Meteo: weather and air quality for a map location. It receives coordinates only.
• MSG91: SMS delivery of login codes and SOS alerts.
• Novu: delivery of notifications, and of login codes and alerts by email and WhatsApp.
• OpenAI: powers Chaloo's AI assistant and automated checks on content. It receives the messages you send to the assistant and the context needed to answer, such as the bikes in your garage.
• A website hosting provider, which serves chaloo.fynshyt.in and keeps standard request logs.

Directions and route planning run on our own routing server. Map data comes from OpenStreetMap contributors and other open data sources; they receive nothing from you.

Legal requests and safety

We disclose data to the police, courts or government authorities only when Indian law requires it, or when it is necessary to protect someone's life or safety. Where the law allows, we'll tell you.

If Chaloo changes hands

If Chaloo is transferred to a company (for example, when it is incorporated) or to a new owner, your data moves with it under this policy, and we will tell you before that happens.

When there is no mobile signal on a ride, Chaloo can pass ride messages (positions, SOS alerts, short chat messages and voice pings) directly between nearby phones running Chaloo, using Bluetooth and local Wi-Fi. A message can hop through several phones to reach your group, including phones of Chaloo users who are not in your ride. Messages are digitally signed so they can't be forged or altered, and apps only show them to the members of the ride they belong to.

This only works while you are in a ride and Bluetooth and Local Network access are allowed.

Your data is stored on servers run by our providers listed above. Some of them, including Mapbox, OpenAI, Apple and Google, process data outside India, mainly in the United States. We only transfer data to countries the Government of India has not restricted under section 16 of the DPDP Act.

Some data stays on your phone: unconfirmed automatic rides, offline maps, queued messages and ride data waiting for a connection, and diagnostic files.

• Login codes expire within minutes.
• Your account, profile, garage, rides and posts are kept while your account is open, or until you delete them.
• Your emergency profile is kept until you change or remove it, or delete your account.
• Road quality readings you chose to share are anonymous and become part of the shared road map.
• Website form emails are kept in our inbox for as long as we need them to respond to you or run the offer you signed up for.
• Backups are replaced on a rolling basis, so deleted data can remain in a backup for a limited time before it is overwritten.
• We keep data longer only where the law requires it, or to resolve a dispute or abuse report.

Once data is no longer needed for any of these, we delete it or make it anonymous.

Data travels between the app and our servers over encrypted connections. Your emergency profile and its documents are encrypted before they are stored. Login is passwordless and uses short-lived codes, access to our servers is restricted, and offline mesh messages are signed.

No system is perfectly secure. If a personal data breach happens, we will inform you and the Data Protection Board of India as the DPDP Act requires.

Under the DPDP Act you can:

• Access: get a summary of your personal data we hold, what we do with it, and who we have shared it with.
• Correct and update: fix or complete inaccurate data. Most of it you can edit in the app directly.
• Erase: ask us to delete your data.
• Withdraw consent: as easily as you gave it, by turning off a permission or feature, or by writing to us.
• Grievance redressal: complain to our Grievance Officer and get a response.
• Nominate: name someone who can exercise these rights for you if you die or become unable to.

To use any of these, email pratham26.dev@gmail.com from the phone number or email linked to your account, or include your username. We may ask you to confirm it is you before we act.

In the app, go to Settings > Account > Delete account and type DELETE to confirm. This immediately removes your name, bio, profile photo and emergency contact from your profile, signs you out, and stops the account from being used again.

Your rides, posts, chat messages, garage and emergency profile are not erased by that button yet. To have them erased too, email pratham26.dev@gmail.comand we will delete them, or remove your identity from them where they are part of other people's conversations or rides, within 30 days.

You can also delete individual items, such as a visited place or a ride you created, from within the app at any time.

You can change any of these in your phone's Settings. Here is what stops working when you turn one off.

• Location (While Using): no map position, nearby topics or rides, live group sharing or ride recording.
• Location (Always):rides may stop recording and sharing when your phone is locked, and automatic ride detection won't work.
• Precise location: your group sees a less accurate position, and crash detection is less reliable.
• Motion & Fitness: no crash detection, and ride tracking is less accurate when you stop.
• Bluetooth and Local Network: no offline ride messaging.
• Notifications: no ride invites, messages, SOS alerts from your group or auto-ride prompts.
• Microphone and Speech Recognition: no voice clips or dictation.
• Camera: no taking a profile photo or scanning ride QR codes.
• Photos: no sharing images from your library, or saving share cards and replays to it.
• Contacts: if the app asks, it is only so you can pick an emergency contact. You can type the contact in instead. We never upload your address book.

Road quality sharing and automatic ride detection have their own switches in the app's settings.

Chaloo is only for people aged 18 or over. We don't knowingly collect data from anyone younger. If you believe someone under 18 has an account, write to pratham26.dev@gmail.com and we will delete it.

When we change this policy we will update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.

Grievance Officer: Pratham Mehta
Operator: Pratham Mehta, an individual operating the Chaloo app and website, India
Email: pratham26.dev@gmail.com

We will acknowledge your message within 7 days and resolve it within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.