Privacy Policy

Effective from 6 July 2026. The same documents are available inside the app.

Udhë Sh.p.k. Version 2.0. Effective 6 July 2026. This version replaces version 1.0.

This Privacy Policy explains what personal data Udhë Sh.p.k., the operator of the Udhë app, collects about you, why, who we share it with, how long we keep it, and what rights you have. Contact for all privacy matters: merrudhe@gmail.com.

1. Who We Are

Udhë Sh.p.k. operates the Udhë mobile application, a ridesharing (cost-sharing) platform for drivers and passengers. In this Policy, “Udhë”, “we”, and “us” mean Udhë Sh.p.k. Udhë decides how and why your personal data is processed as described in this Policy.

2. Data We Collect

2.1. Account and profile data

Full name, email address, phone number, date of birth, and gender.
Profile photo (a selfie you take or a picture you upload; your sign-in provider’s photo may be used initially).
Home country and city, the role you intend to use (driver, passenger, or both), your usual destination cities, and your app language.
Account metadata: account creation date, last login date, verification status, terms version accepted and when, and your notification and privacy preferences.
Sign-in identity from Google, Facebook, or Apple (we receive your name, email, and photo from the provider; we never receive passwords).

2.2. Verification data

Phone and email verification codes (6 digits, valid 10 minutes; deleted once used or expired) and the verification timestamps.
A registry entry linking your verified phone number and email address to your account, used to keep each number and email unique to one account.
If you request identity verification: a photo of your identity document and a verification request record containing your profile details and the review status.

2.3. Ride data

Rides you publish: route (from and to city), date and time, price per seat, number of seats, meeting point (name and map coordinates of the chosen point), and any restriction (for example women-only rides).
Reservations you make, and a reservation history log (who reserved and cancelled, and when), kept for dispute resolution.
Ride alerts you set (route, date, optional time window).
Ratings: after a ride, participants rate each other 1 to 5 stars. Ratings are stored only as an anonymous aggregate (total points and count) on your profile; no text and no reviewer identity are attached.

2.4. Chat messages

Messages you send in a ride’s chat, with your name, photo, and the ride route, visible to the driver and reserved passengers of that ride. An automated filter screens messages; messages containing external (non-map) links or content promoting off-platform arrangements are removed automatically and archived for review.

2.5. Wallet and payment data

Wallet balance and a payment history: top-ups, platform fees, penalties, and credits, each with amount, date, status, and payment provider reference.
For card payments, the payment provider may return a token reference. We never receive or store your full card number.
Invoices for completed top-ups (your name, email, city, invoice number, amount, payment method, and transaction reference), emailed to you and retained by us for accounting.

2.6. Safety and moderation data

Reports you submit or that concern you: reason, description (25 to 500 characters), the ride involved, and the profile details of both users.
Block lists (who you blocked and when) and account status.
Archives kept for penalty and dispute review: rides cancelled close to departure with confirmed passengers (including the ride chat) and messages removed by the chat filter.
Messages you send via the in-app contact form.

2.7. Device and technical data

Push notification tokens for your devices (we keep at most the 3 most recent).
Crash reports and diagnostics (Firebase Crashlytics) linked to your account ID.
Technical server logs. While a verification or another server operation is being processed, log entries can temporarily include your phone number, your email address, or a verification code. These logs are kept on our infrastructure provider’s systems under its retention settings.
Analytics data: see Section 10.

2.8. Location

If you grant location permission, the app reads your position once, in memory only, to sort meeting points by how close they are to you. This reading is not stored on our servers. Location permission is optional.
Live location sharing (optional): on a ride you take part in, you can choose to share your live position with the other participants of that ride, so they can see you approaching the meeting point on a map. Sharing is off by default, works only while you keep the app open, can be stopped at any time, and stops automatically shortly after the ride’s departure time. While you share, your current coordinates are stored on our servers (Google Firebase) and are shown only to the participants of that ride. We keep only your latest position, not a history of your movements: it is deleted when you stop sharing, and any leftover entry is deleted automatically shortly after the ride.
The app does no background location tracking.
The coordinates stored on a ride are those of the selected meeting point, not your personal location.

2.9. Data stored only on your device

Posting preferences (such as your usual seat price and seat count) are stored locally on your phone and remain there until you uninstall the app.
Onboarding progress is stored locally and is deleted when you finish onboarding.

This local data is not sent to our servers.

3. Why We Use Your Data

To create and run your account and let you publish, find, reserve, and manage rides.
To verify your phone, email, and (optionally) identity, and to keep one account per person.
To let ride participants communicate and coordinate.
To charge platform fees, manage wallet balances and debts, process top-ups, and issue invoices.
To keep the community safe: reviewing reports, applying the cancellation and no-show rules, moderating chats, and preventing fraud and fake accounts.
To send you notifications: ride reminders, cancellation notices, and financial notifications (fees, penalties, credits). Financial notifications are always sent and cannot be disabled. Marketing notifications and marketing emails are sent only if you have them enabled.
To measure and improve the app through analytics and crash reporting.
To comply with legal obligations, such as accounting rules for invoices.

4. Legal Basis, in Plain Terms

Contract: most processing (account, rides, chat, wallet, fees) is necessary to provide the service you signed up for.
Consent: optional identity verification, optional location access and live location sharing, marketing notifications and emails, and camera or photo access. You can withdraw consent at any time.
Legitimate interest: safety, fraud prevention, moderation, dispute records, and service analytics.
Legal obligation: keeping invoices and payment records for accounting.

5. What Other Users See, and Your Controls

When you publish or join a ride, other users see:

Your name and profile photo, your average rating and number of rides, your city, and your verification badge if you have one.
Your phone number, under these rules: the driver of a ride can see the numbers of their reserved passengers; a passenger can see a driver’s number only if the passenger has at least 10 rides and an average rating of 3 or higher.
Your messages in the chats of rides you participate in.
If a ride is gender-restricted, the restriction itself is visible on the post.

Your privacy controls:

Hide phone number: available to all users; removes your number from your ride profile for everyone.
Show first name only: available to verified users; displays only your first name on rides.
Notification preferences (ride reminders, marketing) and the marketing email opt-in can be changed in Settings at any time.

A technical note: the ride record includes a snapshot of your profile taken when you post or reserve, and that snapshot may contain profile fields beyond those the app displays. We limit what the app shows to the items listed above.

We do not sell your personal data. We share it only with the service providers we need to run the app:

Google Firebase (Google LLC): authentication, database, file storage, cloud functions, push notifications, analytics, and crash reporting. Our backend runs in the europe-west1 (EU) region.
Google, Facebook (Meta), and Apple: sign-in services, when you use them to log in.
Meta (WhatsApp Business Cloud API): receives your phone number and the one-time code in order to deliver your verification message.
Amazon Web Services (SES): sends our emails (verification codes and invoices).
Paysera: processes bank-payment top-ups. It receives the payment amount and order reference and may receive your name and email address as part of the payment request.
Procard: processes card top-ups (Visa and Mastercard). It receives the payment amount and order reference and may receive your name, email address, and phone number as part of the payment request.

For both payment providers, card data is entered on the provider’s own pages and handled under the provider’s privacy policy; it never reaches us.

We may also disclose data if the law requires it or to establish, exercise, or defend legal claims.

Your data may be processed outside the Republic of Kosovo, including in the European Union and the United States, by the providers listed above under their own safeguards.

7. How Long We Keep Data

Verification codes: deleted when used, or they expire after 10 minutes.
Phone and email registry entries: replaced when you verify a different number or email; removed when your account is deleted.
Identity documents and verification requests: kept while your account is active, for verification and fraud prevention. We review and delete them on request (Section 8), unless we need them for an ongoing dispute or a legal obligation. We do not currently delete them on an automatic schedule.
Rides, chats, reports, and moderation archives: kept while your account is active and as long as needed to resolve disputes and apply our rules.
Live location sharing: only your latest shared position is stored; it is deleted when you stop sharing, and any leftover entry is deleted automatically shortly after the ride.
Payment records and invoices: kept for as long as accounting and tax law requires, even after account deletion.
Uncompleted top-up attempts: cancelled automatically, normally within 3 to 4.5 hours; the record of the attempt remains in your payment history.
Technical server logs: retained under our infrastructure provider’s log retention settings.
Analytics and crash data: retained under Google Firebase’s retention settings.

When data is no longer needed, we delete it or anonymize it.

8. Your Rights

You have the right to:

Access: ask for a copy of the personal data we hold about you.
Correction: fix inaccurate data. Most profile fields can be edited in the app; verified users’ name and gender are locked and corrected via support.
Deletion: ask us to delete your data (see Section 9).
Restriction: ask us to restrict the processing of your data while a dispute about its accuracy or use is being resolved.
Portability: receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
Withdraw consent: turn off marketing in Settings, revoke camera, photo, notification, or location permissions in your phone’s settings, and withdraw identity-verification consent by requesting deletion of your document.
Objection: object to processing based on our legitimate interests.
Complaint: complain to the competent data protection authority.

To exercise any right, email merrudhe@gmail.com from the email linked to your account. We may ask you to confirm your identity. We answer as quickly as we can and always within the deadlines set by law.

9. Deleting Your Account

There is currently no delete-account button inside the app. To delete your account:

Email merrudhe@gmail.com from the email address linked to your account (or include your account phone number), or use the in-app contact form, and ask for deletion.
We confirm that the request comes from you.
We delete your profile, photos, and identity documents, delete or anonymize your other personal data, and confirm by email.

We keep only:

invoices and payment records we must keep by law;
records needed for open disputes, unpaid debts, verified penalties, or the defense of legal claims;
anonymized data that no longer identifies you.

Deleting your account does not erase debts you owe: outstanding fees and penalties remain payable. Deleting the app from your phone does not delete your account. Logging out only removes the push token from that device.

10. Analytics and Tracking

We use Firebase Analytics to understand how the app is used. Analytics is linked to your account ID and includes properties such as your city, gender, app language, verification status, and a ride-count bracket, plus events like rides created, reservations, and payment amounts and routes. Analytics events do not contain your name, email, or phone number.
We use Firebase Crashlytics to diagnose crashes, linked to your account ID.
On iOS, signing in with Facebook triggers Apple’s App Tracking Transparency prompt, because Facebook requires it for its login service.
The app does not use browser cookies. Payment pages opened for top-ups are the payment provider’s own web pages and may use the provider’s cookies.
We do not use third-party advertising networks.

11. Children

The service is for adults only. Users under 18 are not permitted to create an account, and we require a date of birth at registration. If we learn that an account belongs to a person under 18, we close it and delete its data. If you believe a minor is using the app, contact merrudhe@gmail.com.

12. Security

All communication between the app and our servers is encrypted in transit.
Data is stored on Google Firebase infrastructure with access controls, and access within our team is limited to what is needed to operate the service.
Card payments are handled entirely by the payment providers; we never store full card numbers.
Wallet crediting happens only after a cryptographically signed confirmation from the payment provider, which protects against tampering and duplicates.
No system is perfectly secure. If a breach affects your data, we will inform you and the competent authority as the law requires.

13. Changes to This Policy

We may update this Policy. Each version carries a version number and effective date. We will notify you in the app of material changes, and where the change concerns processing based on your consent, we will ask for it again.

14. Contact

Udhë Sh.p.k. Email: merrudhe@gmail.com

Write to us for any question, request, or complaint about your personal data.