Privacy Policy
Last updated: 31 October 2026
This Privacy Policy explains how personal data is collected, used, shared, and protected when you use the Coast ride-matching mobile application (the “App”) and the Coast website at coastapp.in (the “Site”).
1. Who is responsible for your data
Coast is operated by MAMIDALA SOM PRANEETH BABU, an individual based in Hyderabad, India (the “Operator”, “we”, “our”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Operator is the Data Fiduciary for the personal data described below.
Contact for privacy matters and grievances:
- Email: coastnowapp@gmail.com (the primary channel)
- Grievance Officer: MAMIDALA SOM PRANEETH BABU, reachable at the email above
- Postal address: CH4V+8, Hyderabad, Telangana, India
2. Personal data we collect
2.1 Data you provide
- Account: your full name, email address, phone number, and age, given when you create an account in the App. Age is used only to confirm you meet the 18+ minimum required by our Terms of Service — it is not shown to other users.
- Trip details: destination, departure time, and number of seats, when you post a trip. An approximate pickup area is derived from your location — see 2.2.
- Ride requests and matches: the link between you and another rider when a request is sent, accepted, declined, or cancelled.
- Ratings: the rating you give a co-rider after a completed ride.
- Reports: if you report another user, the report and the trip it relates to.
- Blocks: the list of users you have blocked.
- Gender (optional): a self-identified gender, only if you choose to set one. It is used only to power the optional “match with the same gender only” preference and can be left unset or cleared at any time.
- Waitlist (Site): if you join the pre-launch waitlist on the Site, your email address, and optionally your name and phone number.
2.2 Data collected automatically by the App
- Approximate location: the App reads your device’s location while the App is open and in the foreground to show trips near you. Before any trip is stored, every coordinate is offset by a random 60–180 metres. Your precise position is never stored, logged, or shared — only the offset (approximate) coordinate is saved. The App does not access location in the background.
- Push notification token: a device identifier issued by the operating system and the push service, stored so we can send you ride-request alerts. Removed if you turn notifications off in the App.
- Diagnostics: crash reports (stack trace, device model, operating-system version, app version) via Google Firebase Crashlytics.
- Usage analytics: screen views and product events (for example: a trip was posted, a request was sent, a number was revealed) via Google Firebase Analytics. Event parameters do not contain your name, phone number, email, destination text, or coordinates. Analytics events are linked to a resettable pseudonymous identifier tied to your account.
- Advertising identifiers are NOT collected. The Android Advertising ID and SSAID collection are disabled in the App’s configuration.
2.3 Data from third parties
- Destination search: the place-name text you type into the destination field is sent to our server, which queries OpenStreetMap-based place-search services — Photon, run by Komoot, and Nominatim, run by the OpenStreetMap Foundation (restricted to results in India) — and caches the answers. They receive the text you typed and your approximate area (your location rounded to about 11 km), not your exact position and not your name or account. Your device does not contact them directly.
3. Why we use your data, and our lawful basis
Under the DPDP Act we process personal data on the basis of your consent, given when you accept this Policy at sign-up, and as a legitimate use where the DPDP Act permits (for example, data you voluntarily provide for a purpose you have not objected to, and use necessary to provide a service you have asked for).
| Purpose | Data used | Basis |
|---|---|---|
| Create and operate your account; sign you in | Name, email, phone | Consent; service delivery |
| Confirm you meet the 18+ minimum age to use the App | Age | Consent; legal obligation |
| Match riders heading the same way and show nearby trips on a map | Approximate location, trip details | Consent; service delivery |
| Exchange phone numbers between two riders who have matched | Phone number, and only after a request is accepted and the owner has turned number sharing on (it is off by default) | Consent; service delivery |
| Send ride-request notifications | Push token; the counterparty’s first name and destination text appear in the notification | Consent |
| Same-gender matching preference | Gender (optional) | Consent |
| Safety and moderation: investigate reports, suspend abusive accounts | Reports, ride-request records, blocks | Legitimate use; legal obligation where applicable |
| Keep the App stable; understand which features are used | Crash reports, usage analytics (no direct identifiers in parameters) | Legitimate use |
| Waitlist: notify you when the App launches | Email, optional name and phone | Consent |
We do not use your data for advertising, profiling for advertising, or sale to third parties.
4. Who we share data with
We share personal data only with the following service providers (Data Processors), who process it on our instructions:
| Provider | What they do | Where processing occurs |
|---|---|---|
| Supabase | Database, authentication, realtime, server functions — the primary store of your account and trip data | Amazon Web Services, India (Mumbai region) |
| Expo | Delivery of push notifications; app build and update infrastructure | United States |
| Google Firebase (Crashlytics, Analytics) and Firebase Cloud Messaging | Crash diagnostics, usage analytics, and Android push transport | Google infrastructure, outside India |
| Resend | Sending account emails such as one-time sign-in codes | United States |
| Komoot GmbH (Photon) | Destination place-search, queried by our server | European Union |
| OpenStreetMap Foundation (Nominatim) | Destination place-search, queried by our server | European Union |
| Esri | Map background tiles displayed in the App. Esri receives the map area you are viewing, not your account data. | United States |
We may also disclose data where required by law, court order, or a lawful government request, or to protect the rights or safety of users.
5. Storage outside India
Your core account and trip data are stored in India. Some processing necessarily occurs outside India — specifically crash and analytics data (Google/Firebase), sign-in emails (Resend), push delivery (Expo/Google), and map tiles (Esri). We rely on these providers’ contractual and technical safeguards. We do not transfer personal data to any country or territory that the Government of India has restricted for such transfers.
6. Retention and deletion
We keep your personal data for as long as your account is active, and only as long as needed for the purposes above or to meet a legal obligation.
You can delete your account and all associated data yourself, immediately, from the Profile tab in the App, or by writing to coastnowapp@gmail.com. This removes your profile, trips, ride requests, ride history, ratings, reports, blocks, and push token from our database.
One exception: crash and usage-analytics data already sent to Google Firebase is retained by Google according to Firebase’s own retention settings and is not linked to your name, email, or phone number. It is not deleted by deleting your Coast account. Analytics identifiers reset if you create a new account.
7. Your rights
Under the DPDP Act, you have the right to:
- Access a summary of the personal data we hold about you and how it is processed.
- Correct, complete, update, or erase your personal data.
- Grievance redressal — raise a complaint with us about how your data is handled.
- Nominate another person to exercise your rights in the event of your death or incapacity.
- Withdraw consent at any time. You can revoke location and notification permissions in your device settings, and delete your account in the App. Withdrawing consent does not affect processing already carried out, and may mean you can no longer use the App.
To exercise any of these, email coastnowapp@gmail.com. We will respond within a reasonable period and in any case within the timelines the DPDP Act requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Visitors in the European Economic Area or United Kingdom may additionally have rights under the GDPR / UK GDPR (access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority). Contact us at the same address to exercise them.
8. Security
We use encrypted connections (HTTPS/TLS) for all data in transit, email one-time-code authentication (no passwords to leak), row-level security so a user can only read their own data, an encrypted device keystore for your session, and least-privilege access to our infrastructure. No system is perfectly secure, but we take reasonable safeguards appropriate to the data.
9. Data breaches
If a personal-data breach occurs, we will assess it promptly and, where the DPDP Act requires, notify the Data Protection Board of India and each affected user without undue delay.
10. Children
The App is for users 18 years and older. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. If you believe a child has provided us data, contact coastnowapp@gmail.com.
11. Cookies
The App and the Site do not use cookies or similar tracking technologies. See our Cookie Policy.
12. Changes to this Policy
We may update this Policy. Material changes will be notified in the App or on the Site. The “Last updated” date above always reflects the current version.
13. Contact
Questions or concerns about this Policy or your personal data: coastnowapp@gmail.com.
See also: Terms of Service · Cookie Policy · Delete your account