Privacy Policy

Last updated: 8 September 2026

This Privacy Policy explains how personal data is collected, used, shared, and protected when you use the Coast ride-matching mobile application (the “App”) and the Coast website at coastapp.in (the “Site”).

1. Who is responsible for your data

Coast is operated by MAMIDALA SOM PRANEETH BABU, an individual based in Hyderabad, India (the “Operator”, “we”, “our”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Operator is the Data Fiduciary for the personal data described below.

Contact for privacy matters and grievances:

Email: coastnowapp@gmail.com (the primary channel)
Grievance Officer: MAMIDALA SOM PRANEETH BABU, reachable at the email above
Postal address: CH4V+8, Hyderabad, Telangana, India

2. Personal data we collect

2.1 Data you provide

Account: your full name, email address, and phone number, given when you create an account in the App.
Trip details: destination, departure time, and number of seats, when you post a trip. An approximate pickup area is derived from your location — see 2.2.
Ride requests and matches: the link between you and another rider when a request is sent, accepted, declined, or cancelled.
Ratings: the rating you give a co-rider after a completed ride.
Reports: if you report another user, the report and the trip it relates to.
Blocks: the list of users you have blocked.
Gender (optional): a self-identified gender, only if you choose to set one. It is used only to power the optional “match with the same gender only” preference and can be left unset or cleared at any time.
Waitlist (Site): if you join the pre-launch waitlist on the Site, your email address, and optionally your name and phone number.

2.2 Data collected automatically by the App

Approximate location: the App reads your device’s location while the App is open and in the foreground to show trips near you. Before any trip is stored, every coordinate is offset by a random 60–180 metres. Your precise position is never stored, logged, or shared — only the offset (approximate) coordinate is saved. The App does not access location in the background.
Push notification token: a device identifier issued by the operating system and the push service, stored so we can send you ride-request alerts. Removed if you turn notifications off in the App.
Diagnostics: crash reports (stack trace, device model, operating-system version, app version) via Google Firebase Crashlytics.
Usage analytics: screen views and product events (for example: a trip was posted, a request was sent, a number was revealed) via Google Firebase Analytics. Event parameters do not contain your name, phone number, email, destination text, or coordinates. Analytics events are linked to a resettable pseudonymous identifier tied to your account.
Advertising identifiers are NOT collected. The Android Advertising ID and SSAID collection are disabled in the App’s configuration.

2.3 Data from third parties

Destination search: the place-name text you type into the destination field is sent to our server, which queries OpenStreetMap’s Nominatim geocoding service (restricted to results in India) and caches them. Your device does not contact OpenStreetMap directly.

3. Why we use your data, and our lawful basis

Under the DPDP Act we process personal data on the basis of your consent, given when you accept this Policy at sign-up, and as a legitimate use where the DPDP Act permits (for example, data you voluntarily provide for a purpose you have not objected to, and use necessary to provide a service you have asked for).

Purpose	Data used	Basis
Create and operate your account; sign you in	Name, email, phone	Consent; service delivery
Match riders heading the same way and show nearby trips on a map	Approximate location, trip details	Consent; service delivery
Exchange phone numbers between two riders who have matched	Phone number, and only after a request is accepted and the owner has not turned off number sharing	Consent; service delivery
Send ride-request notifications	Push token; the counterparty’s first name and destination text appear in the notification	Consent
Same-gender matching preference	Gender (optional)	Consent
Safety and moderation: investigate reports, suspend abusive accounts	Reports, ride-request records, blocks	Legitimate use; legal obligation where applicable
Keep the App stable; understand which features are used	Crash reports, usage analytics (no direct identifiers in parameters)	Legitimate use
Waitlist: notify you when the App launches	Email, optional name and phone	Consent

We do not use your data for advertising, profiling for advertising, or sale to third parties.

4. Who we share data with

We share personal data only with the following service providers (Data Processors), who process it on our instructions:

Provider	What they do	Where processing occurs
Supabase	Database, authentication, realtime, server functions — the primary store of your account and trip data	Amazon Web Services, India (Mumbai region)
Expo	Delivery of push notifications; app build and update infrastructure	United States
Google Firebase (Crashlytics, Analytics) and Firebase Cloud Messaging	Crash diagnostics, usage analytics, and Android push transport	Google infrastructure, outside India
Resend	Sending account emails such as one-time sign-in codes	United States
OpenStreetMap Foundation (Nominatim)	Destination place-search, queried by our server	European Union
Esri	Map background tiles displayed in the App. Esri receives the map area you are viewing, not your account data.	United States

We may also disclose data where required by law, court order, or a lawful government request, or to protect the rights or safety of users.

5. Storage outside India

Your core account and trip data are stored in India. Some processing necessarily occurs outside India — specifically crash and analytics data (Google/Firebase), sign-in emails (Resend), push delivery (Expo/Google), and map tiles (Esri). We rely on these providers’ contractual and technical safeguards. We do not transfer personal data to any country or territory that the Government of India has restricted for such transfers.

6. Retention and deletion

We keep your personal data for as long as your account is active, and only as long as needed for the purposes above or to meet a legal obligation.

You can delete your account and all associated data yourself, immediately, from the Profile tab in the App, or by writing to coastnowapp@gmail.com. This removes your profile, trips, ride requests, ride history, ratings, reports, blocks, and push token from our database.

One exception: crash and usage-analytics data already sent to Google Firebase is retained by Google according to Firebase’s own retention settings and is not linked to your name, email, or phone number. It is not deleted by deleting your Coast account. Analytics identifiers reset if you create a new account.

7. Your rights

Under the DPDP Act, you have the right to:

Access a summary of the personal data we hold about you and how it is processed.
Correct, complete, update, or erase your personal data.
Grievance redressal — raise a complaint with us about how your data is handled.
Nominate another person to exercise your rights in the event of your death or incapacity.
Withdraw consent at any time. You can revoke location and notification permissions in your device settings, and delete your account in the App. Withdrawing consent does not affect processing already carried out, and may mean you can no longer use the App.

To exercise any of these, email coastnowapp@gmail.com. We will respond within a reasonable period and in any case within the timelines the DPDP Act requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Visitors in the European Economic Area or United Kingdom may additionally have rights under the GDPR / UK GDPR (access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority). Contact us at the same address to exercise them.

8. Security

We use encrypted connections (HTTPS/TLS) for all data in transit, email one-time-code authentication (no passwords to leak), row-level security so a user can only read their own data, an encrypted device keystore for your session, and least-privilege access to our infrastructure. No system is perfectly secure, but we take reasonable safeguards appropriate to the data.

9. Data breaches

If a personal-data breach occurs, we will assess it promptly and, where the DPDP Act requires, notify the Data Protection Board of India and each affected user without undue delay.

10. Children

The App is for users 18 years and older. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. If you believe a child has provided us data, contact coastnowapp@gmail.com.

11. Cookies

The App and the Site do not use cookies or similar tracking technologies. See our Cookie Policy.

12. Changes to this Policy

We may update this Policy. Material changes will be notified in the App or on the Site. The “Last updated” date above always reflects the current version.

13. Contact

Questions or concerns about this Policy or your personal data: coastnowapp@gmail.com.