FairFare privacy information

Fisemarco OÜ, registration code 14933422, Tallinn, Estonia, operates FairFare. For privacy questions, access, export, correction or deletion requests, contact hello@fisemarco.com.

Information used by the apps

FairFare uses account and contact details, booking locations and times, operator and driver authorisation records, ride communications, agreed fares, self-reported direct payments, support cases and security/audit events. Optional rider comfort presets and per-ride requests, driver-declared languages, word-puzzle history, shared Spotify playlist identifiers and book requests are also stored when those features are used. Drivers and operators submit the documents required by the verification workflow, including evidence of the driver–operator relationship and, for Tallinn, applicable service-language qualification or a recognised alternative/exemption. Submit only relevant pages and redact unrelated pay and personal information. FairFare does not request general criminal-history or medical reports.

Account authentication and the optional demo

You can sign in with an email code or, if set, an email and password. Password authentication is handled by Supabase Auth; the apps do not save your password. Access and refresh tokens use the device secure-storage mechanism. You can set or change a password in Account, and email-code sign-in remains available for recovery.

The optional isolated demo uses fictional people, vehicles, fares and public example pickup pins. Its ride state, messages, preferences, ratings and local issue reports remain in app memory and clear when you exit. They do not create production bookings, payments, licence approvals, dispatch requests or support cases, and the demo does not collect device GPS. Viewing its map still contacts the map provider for the public example map area. Choosing reading or playlist links contacts those external providers as described below; no FairFare credentials are passed to them. The demo is available to signed-in users and is clearly labelled throughout.

Location, Bluetooth and notifications

Location is requested when you choose location-based features. Pickup sharing and Bluetooth proximity are optional and limited to the assigned pickup partner. Bluetooth proximity does not establish an exact position. Trusted-contact sharing uses an expiring link; anyone receiving that link can view the information it permits until it expires or is revoked. Push alerts require device registration and permission.

Driver background location while online

Choosing Go online in the installed Driver app enables precise location while the app is in the background or the phone is locked. This supports nearby ride offers, pickup ETAs and scheduled-pickup protection. Android shows an ongoing service notification; iOS uses its location indicator. Go offline or sign out to stop location updates. Only the latest driver position is retained, not a route history; existing position cleanup removes stale points after five minutes. A shift identifier and online choice remain until replaced or the account is deleted. Stale GPS prevents dispatch eligibility even while online is selected. Notification sound and background operation depend on permissions, phone settings, connectivity and operating-system restrictions. Force-stopping the app or restarting the phone can interrupt updates. This permission does not enable optional supply-planning area sharing.

Providers and recipients

Supabase supports account, database and private-file services; Vercel hosts the server and sharing pages. Resend delivers account sign-in and operational emails. Twilio Verify receives your phone number and verification requests to deliver and check SMS codes, with fraud-prevention controls. Verification codes are entered in the app; FairFare does not ask you to share them in chat or with drivers. Expo supports mobile builds and push delivery when configured. Map viewing, address search and directions use Mapbox with OpenStreetMap attribution. Mapbox receives search text, route coordinates and requests for the viewed map area. Stored searched addresses use permanent geocoding only when enabled. Choosing Google Maps or Waze for navigation sends the selected pickup or next-stop coordinates to that provider. Navigation opens only after you tap its button; those providers process the request under their own privacy terms. FairFare does not include rider names or account credentials in the navigation link. Approved operators and assigned drivers receive information necessary for the ride. Support staff access reports through controlled workflows. Passenger fares are paid directly to taxi operators by cash or their physical card terminals; FairFare does not collect ride payments or vault passenger payment cards.

Optional waiting activities and music

Puzzle history is linked to the rider account to avoid repeating grids and ten-word sets. It is removed when account deletion is requested. Comfort requests are disclosed to the eligible or assigned driver for that booking; drivers record readiness and riders approve any proposed alternative. Playlist links are optional, readable by the current assigned partner and removable by the rider. Spotify is opened only on an explicit action; its service terms and privacy practices apply. Free digital reading opens the Project Gutenberg website inside the app, so that publisher receives the reading connection. FairFare does not pass its account credentials to Spotify or the reader. Book requests are reviewed by support for availability and reading rights.

Optional area sharing for supply planning

You can separately opt into approximate area sharing in Account. Location permission alone does not enable this feature. While the app is open, coordinates are reduced to approximately 1 km cells for Tallinn. Only the latest area per app role is retained; the planning dashboard receives area counts, not names, account IDs or raw GPS coordinates. Authorised operations staff can compare recent areas, open apps and actual waiting requests with eligible driver supply. Activity expires after 90 seconds and recent areas disappear after 24 hours. The cleanup worker removes expired records. Turn sharing off to remove your area immediately; data export and optional-data deletion cover this feature. Coarse areas are not guaranteed anonymous. No area collection continues while the app is closed.

Optional driver demand suggestions

Drivers can separately enable demand suggestions after enabling area sharing and push permission. The server uses the driver’s existing online location and a routing provider to estimate travel to a coarse shortage area. Only Driver app devices receive these pushes. Suggestions are optional, do not guarantee a fare and do not change scheduled bookings. Busy drivers and drivers with nearby reserved commitments are excluded; eligibility is checked again before delivery and opening. Authorised operations staff can view driver name/ID, push delivery status, acceptance/decline timestamps, navigation response, route ETA estimates and timestamps when fresh online positions show movement towards or arrival near the suggested area. The system stores an initial distance and milestone timestamps, not a movement trail. Shortage recovery is recorded separately and does not prove that a particular driver resolved it. The operations map can show an alerted driver’s approximate current cell while sharing remains enabled, the driver remains eligible and the online position is fresh. Stale or withdrawn positions disappear; background positions require an active online shift and OS permission. Precise driver coordinates are not exposed in this table or map. Administrative changes to replacement settings record the staff account, timestamp and saved values in the restricted audit ledger. Operations staff may manually review and send optional invitations under the same eligibility and reservation safeguards. Follow-up alerts record missing observed progress, unavailable data, long ETA or expiry. Operations may enable automatic replacement invitations for missing observed progress or a long current ETA, subject to fresh-data checks, reservation protections and per-area limits. Automatic attempts are recorded for up to one day and included in relevant exports and deletion workflows. Operations may also review a replacement; the original commitment is released only when a replacement invitation is queued, and the original driver receives a release notice. Follow-up records follow the same one-day suggestion retention and data-rights controls. Short-lived review batches record the staff account and reviewed recipients for up to one day; export and optional-data deletion include your relevant records. Suggestion records are removed after 24 hours by the cleanup worker and are included in data export and optional-data deletion. Disabling suggestions stops new suggestions. Device registration records identify whether the installation is Rider or Driver.

Trip quality, support and optional safety

Message reports retain the selected reported message for private review. Blocking stops chat and future matching without cancelling an active trip. Support cases record status, staff ownership, replies and restricted evidence files. Ratings are human-reviewed before inclusion in summaries; a sparse rating does not automatically determine eligibility. Receipt uploads remain private to the booking parties and authorised staff and are distinct from FairFare’s journey summary. Business expense details and per-trip purpose snapshots are private to the rider.

Adult passenger invitations require explicit adult consent through a private, revocable 24-hour link before assignment. The booking account retains control of the reservation; the passenger pays the operator directly. Weekly plans require explicit confirmation of each occurrence. Flight information is sent to the configured flight provider when used; it does not automatically reschedule a ride. Private calls, when enabled, are connected by the configured calling provider using verified account phone numbers; personal numbers are not shown to the other party.

Both parties must opt into proactive trip check-ins. The server uses only fresh Driver GPS and the planned route to identify a long stop or repeated deviation. It retains the latest check point rather than a movement trail, removes it after the ride or one day, and treats signals as possible ordinary stops or GPS errors. Help requests create private support cases; this does not automatically contact emergency services.

Optional incident recording is disabled in standard builds and in the database. It requires documented legal review, a separate native configuration, server encryption setup and both parties’ consent. If enabled, explicit visible foreground recording lasts at most two minutes and stops when leaving the app. A single encrypted device clip replaces its predecessor and expires after seven days, with cleanup on app use. Only an explicit report-bound upload sends it to private storage; authorised staff access is audited. Closed case content and incident evidence are eligible for cleanup after 30 days; unresolved investigations preserve necessary evidence. Operator receipt files use a 400-day technical retention default, subject to the reviewed legal schedule. Authentication deletion is soft deletion with approved retention review; retained records and holds require a lawful basis.

Incognito: destination optional

Incognito does not ask for a destination before pickup and is not anonymous. Verified account/contact details, the pickup, assigned operator/driver/vehicle, tariff, cumulative measured distance and time, start/end confirmations, final stop and any support evidence are still processed for transport, safety and required records. Your driver supplies the journey location observations; riders can select a pickup manually without granting location permission. The meter stores cumulative distance and the most recent observation, not a route trail. The last observation is removed when the metered journey closes. GPS interruptions freeze the fare for review rather than estimating missing distance. A confirmation timeout releases the driver without adding charges or fabricating agreement.

Entering Incognito switches off optional rider area sharing and removes its current area entry. It stays off until you explicitly enable it again. Incognito pickups are not added as saved places or recurring routes. Maps and address searches still contact the configured map provider. Incognito records, including cancelled requests, follow the approved journey/payment retention schedule and complaint/legal holds; required records are not immediately erased or excluded from account exports. A documented support decision is distinguished from matching participant confirmations.

Service providers and notification choice

Production configuration determines which processors are active: Supabase for authentication/database/private files, Expo with Apple APNs or Google FCM for opted-in push alerts, Mapbox for maps, traffic and address geocoding, OpenStreetMap-based Photon search (currently hosted by komoot) for supplementary landmarks and house numbers, and the configured email/SMS providers for authentication and support. Requests may disclose the IP address and the coordinates or query required for that operation. The launch privacy notice must identify the actual providers and transfer safeguards. Driver installation credentials authenticate an online device separately from notification permission; a push token is not collected for that registration when push is declined. Push alerts and sound are optional. Without them, drivers can view offers in the open app; background/locked-screen alerts may be unavailable.

Controls and retention

Use Account → Your data rights to request an export or deletion. Access is restricted by role and ownership. Optional data and expired sharing records are removed by the relevant workflows. Complaint, safety, licensing and legally required records may be retained under a documented review. Contact us for the applicable retention period and basis for your records.

This page describes the current technical implementation. Final legal bases, retention schedules, international-transfer arrangements and launch-specific provider disclosures require completion before city activation.

Driver demand map

The Driver map can show your own position while open using foreground location permission. Opening the map does not make you available for rides or show your individual position to other drivers. Approved drivers can view coarse areas of current ride-request demand in their approved city. Each area is about 2 km wide; groups of fewer than three distinct riders are suppressed and larger groups are shown as demand bands, without rider names, exact counts, individual pickup pins or destinations. This uses active booking requests for dispatch planning; optional area-sharing data collected for operations is not reused for this driver map. Snapshots expire after 75 seconds. Mapbox’s traffic map shows road congestion separately from demand; traffic data can lag conditions and is not a promise of pickup time.