This Privacy Policy explains how Metro Meter collects, uses, stores, and protects information when you use the Metro Meter mobile application, website, or signed-in web app.
1. Information We Collect
Metro Meter may collect or process the following types of information:
- Location data: GPS location, route points, distance, duration, accuracy, heading, speed, timestamps, and movement data during rides or live sharing you enable.
- Ride and business data: fare totals, rate cards, timestamps, ride history, route points, receipt details, surcharges, tips, work sessions, and notes you enter.
- Regular Rider and selected contact data: names, phone numbers, email addresses, notes, ride counts, and saved fare preferences you choose to enter or copy from one contact you select with the system contact picker. Metro Meter does not upload or scan your full address book.
- Payment and financial records: ride fares, tips, taxes, adjustments, earnings, the payment method and status you record, saved public payment handles, and provider transaction references. Metro Meter does not receive payment-app passwords, full payment-card numbers, bank-account numbers, bank login details, balances, or provider account histories.
- Optional account and identifier data: your name, email address, account ID, authentication information, and session data when you choose to create an account.
- Subscription and product-usage data: App Store product and transaction identifiers, purchase and entitlement status, trial dates, Fare Estimate usage counts, and selected free rate-card identifiers.
- Place search and personalization data: search text, location proximity, recent or saved places, rate cards, preferences, and settings used to return requested places and routes and restore your chosen setup.
- Live-sharing data: rider-sharing sessions, claim status, expiration and revocation times, cryptographic token hashes, and the latest location made available for sharing.
- Support data: information you provide if you contact support.
2. How We Use Information
We use information to operate Metro Meter, including to:
- Calculate ride distance, time, fare estimates, and receipts.
- Support background location tracking during active rides.
- Provide temporary rider tracking that you control.
- Save ride history and app preferences.
- Authenticate accounts, associate backups with the correct user, enforce trial and free-tier limits, and verify or restore Premium access.
- Open selected payment providers, record payment status, calculate earnings, and create receipts.
- Return requested place-search and route results and personalize saved rate cards, riders, places, and settings.
- Maintain app reliability, security, and account integrity.
- Respond to support requests.
3. Location and Background Location
Metro Meter uses location data to track active rides, calculate fares, save completed route geometry, measure mileage during a mileage-tracked work session, and provide live sharing you enable. If you grant background location permission, Metro Meter may continue collecting location while an active ride or mileage-tracked work session is running even if the app is not visible.
You can disable location permission in device settings, but doing so may prevent ride tracking, fare calculation, route history, live sharing, and related features from working correctly.
4. Record-Level Cloud Synchronization and Recovery
Metro Meter saves business changes locally before attempting a network request. For eligible signed-in accounts, it synchronizes supported data as individual, versioned changes rather than a whole-business snapshot. Supported data may include rate cards, Regular Rider records, completed ride and financial records, work sessions, logical settings groups and payment handles, and completed route replays. Saved and recent places are not synchronized.
Record payloads are sent over an encrypted network connection and encrypted before database storage using service-managed keys. Completed route geometry is separately compressed where practical, encrypted, and stored in private object storage. This is not end-to-end or zero-knowledge encryption: authenticated Metro Meter server functions can decrypt records being synchronized, recovered, validated, or conflict-resolved.
Only changes acknowledged by the synchronization service have reached cloud storage. Recovery incrementally merges server-acknowledged revisions with local state; it does not replace the local database with a whole-account snapshot. Metro Meter does not treat a record missing from one device as a deletion. Normal deletions create explicit tombstones, and incompatible device changes are retained for review.
Cloud recovery does not include active or unfinished rides, active GPS samples, pending Square handoff state, device permissions, sign-in sessions, payment-app logins, local saved places, or unsynchronized changes. Completed ride maps recover separately only when their encrypted route upload was acknowledged. If upload eligibility expires, local editing continues and queued changes remain, but uploads may pause until eligibility resumes.
5. Rider Live Location Sharing
When you choose to share with a rider, Metro Meter creates an opaque, expiring link for the current trip. The first browser session that successfully claims the link becomes the authorized viewer. Another device using the same link is rejected. The authorized browser may refresh or reconnect using its browser-held credential.
While the session is active, the rider can receive your latest latitude, longitude, accuracy, heading, speed, and recording time. Rider access ends when you stop sharing, complete the ride, revoke the session, or the session expires. After revocation, the link does not provide the latest or historical location. It never authorizes access to account settings, earnings, payments, contacts, other trips, or completed route history.
When you enable rider location sharing, Supabase stores sharing-session identifiers, token hashes, viewer-claim information, expiration and revocation times, and a replaceable latest-location record containing coordinates, accuracy, heading, speed, and recording time. This feature can upload location during an active ride even though active rides are excluded from business backup. Ending access is separate from deleting stored records; stopping sharing does not mean all sharing records are immediately erased.
6. Payments, Trials, and Subscriptions
Metro Meter stores the payment method you select for a ride, payment status, amount, time, and, when returned by a provider such as Square, a transaction reference. It uses these records for receipts, unpaid and paid ride status, earnings, and optional cloud restoration. Except for cash and Square, payment handoffs open the payment app you select. Saved public payment usernames let riders scan a QR code to pay through that provider. Square payments open the Square app on your phone. Metro Meter does not receive payment-app passwords, full payment-card numbers, bank-account numbers, bank login details, balances, or provider account histories, and it does not independently move money. A payment handoff may send the provider a public payment username, amount, currency, and ride note.
Apple processes App Store billing outside Metro Meter. RevenueCat receives subscription product, transaction, purchase-status, account identifier, and entitlement information so Metro Meter can verify and restore Premium access. Neither Metro Meter nor RevenueCat receives the payment card or bank details entered with Apple. For signed-in users, Supabase stores trial dates, Fare Estimate usage counts, selected free rate-card identifiers, and entitlement status to apply access limits consistently across sessions and devices. This information is not used for advertising.
7. Maps and Place Search
Metro Meter uses Apple Maps and Mapbox for map display, route estimates, and place search. Precise coordinates or proximity and search text may be sent to those providers only when you request the related feature. Recent and saved places remain on the device and are not synchronized by this implementation. Metro Meter does not use location or search history for advertising or tracking. The providers’ handling of data is governed by their own privacy policies.
8. QR Codes, Receipts, and Links
Metro Meter may generate receipt pages, QR codes, or rider links. When you share one, anyone with access to it may be able to view the information it authorizes. Metro Meter does not control what a recipient does with information after receiving it.
9. Third-Party Services
Metro Meter uses Supabase for accounts, identifiers, access-limit records, cloud data, routes, and sharing; RevenueCat and Apple for subscription products, purchases, identifiers, and entitlement status; Apple and Google for optional sign-in; Apple Maps and Mapbox for coordinates, proximity, search text, maps, and routing; Expo for app updates; and Venmo, Cash App, PayPal, or Square only when you choose a payment handoff. These providers process information under their own privacy policies and terms. Metro Meter does not include advertising, cross-app tracking, analytics, or crash-reporting SDKs.
10. Data Sharing
We do not sell personal information. Information is disclosed only to service providers needed for features you use, to recipients you authorize through receipts, QR codes, or rider links, or when required by law or necessary to protect legal rights. Service providers are expected to protect information consistently with their contracts and applicable law.
11. Data Retention and Deletion
We retain information as reasonably needed to provide and secure the app, comply with legal obligations, resolve disputes, and enforce agreements. Local ride data remains until you delete it, clear app data, or uninstall the app.
Current synchronized records, explicit tombstones, recent recoverable versions, conflicts, mutation receipts, and device/workspace metadata remain as reasonably needed to provide, recover, secure, and audit synchronization. Older versions may move to encrypted cold storage or be compacted under the then-current retention policy. A local deletion reaches the cloud only after the server accepts its explicit mutation.
Deleting your Metro Meter account removes account-linked database records and schedules separately stored encrypted route objects for retried deletion after a safety delay; cleanup may not finish at the instant the account disappears. It does not erase business records remaining locally on a device. Uninstalling the app, signing out, or pausing sync does not delete existing server data. Apple, Google, RevenueCat, and payment providers may retain their own records under their policies or legal obligations.
12. Your Choices
You can control many privacy choices directly from your device or app store settings, including:
- Granting or revoking location permissions.
- Allowing or disabling background location.
- Stopping rider sharing.
- Reviewing synchronization status and conflicts.
- Deleting app data or uninstalling the app.
- Deleting an optional account from the Account screen.
- Contacting support about privacy questions or data requests.
13. Security
We use reasonable technical and organizational safeguards. Share links contain long, random tokens; the server stores cryptographic hashes rather than raw URL tokens. Rider links also bind to the first successful browser claim. Authentication credentials use secure device storage. No app, link, device, storage system, or network transmission is perfectly secure, and we cannot guarantee absolute security.
14. Children’s Privacy
Metro Meter is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can take appropriate action.
15. International Users
If you use Metro Meter outside the United States, your information may be processed in the United States or other countries where service providers operate. Privacy laws may differ from those in your location.
16. Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of Metro Meter after changes are posted means you acknowledge the updated policy.
Terms Acceptance Records
When you explicitly accept the Terms, Metro Meter records the terms version, a document fingerprint, the acceptance statement, the app or website used, and the acceptance time. Signed-in acceptance is associated with your account and stored separately from optional business backups. Signed-out acceptance is stored on the device and is not evidence of acceptance by a later signed-in account. Account-linked acceptance records are removed with account deletion under the current database policy.
17. Contact
Questions about this Privacy Policy may be sent to: support@metrometer.app