Privacy policy

Who we are

Naveto ("we") runs a carpooling service in Morocco through the Naveto mobile app and the naveto.ma website. For any privacy question or request, write to hello@naveto.ma.

Information we collect

• Sign-in: when you sign in with Google, we receive your Google account identifier, name, email address and profile picture.

• Profile: your first name and last initial, passenger or driver mode, home and work places if you save them, language, and notification and promotion preferences. Gender is optional and only used for women-only rides. We ask you to confirm that you are 18 or older; we do not collect your date of birth.

• Rides and bookings: routes, pickup and drop-off areas, dates and times, seats, contribution amounts, notes, seat requests, recurring seats, cancellations and ride history.

• Messages: the messages you exchange with other members, with their time and read status.

• Ratings, reports and blocks: ratings from 1 to 5 given after confirmed bookings, reports and blocks you make or receive, and related moderation decisions.

• Driver verification: the photo you take of the front of your driving licence or national ID card, and the review result.

• Phone number: only if your account has one.

• Device and technical information: notification token, IP address, the country your sign-up came from (derived from your IP address), device or browser type, and server logs.

• Waitlist: the email address or phone number and the role (passenger or driver) you give us to be told when Naveto launches, the campaign tag of the link you arrived on (the "s" parameter), if any, and the route page you came from, if any.

• Referrals: your personal referral code; the referral code of the person whose link brought you to the waitlist, if any; and a private status-page link. We keep only a hash of the secret part of that link, so we cannot show it to you again.

• Website analytics: technical information about website visits, collected automatically.

How we use it

• To create and secure your account and keep you signed in.

• To publish, search and book rides, and to let members coordinate them.

• To deliver messages and send notifications about bookings, messages and reminders.

• To review drivers before they can publish rides.

• To keep the service safe: handle reports, prevent abuse and fraud, and review sign-ups from outside Morocco.

• To answer your requests and provide support.

• To understand website visits and improve the website.

• To send you promotions by email, SMS or push notification, only if you turn them on.

• To count referrals, award the founding member badge, and see which invitations bring people to the waitlist.

What other members can see

Other members can see your first name and last initial, when you joined, your number of completed rides, your verification badge, your founding member badge if you have earned it, your average rating and number of ratings, and the details of the rides you publish or join.

The founding member badge is earned when three referrals have counted for your waitlist contact. A referral counts once, when the person you referred signs in to Naveto with a Google email that matches their waitlist sign-up (or, once phone verification is available, with a verified phone number that matches it). The badge stays on your account until you delete it. Anyone who holds your private status-page link can see how many people joined through your link and how many have counted; they never see who joined.

Anyone with a ride share link can see that ride's details and the driver's first name and last initial, but no phone number.

If your account has a phone number, it is shown only to the driver or passengers of a confirmed booking with you.

Your gender is never shown on your profile, although taking part in a women-only ride may let others infer it. Your verification photos are never shown to other members.

Messages are delivered to the other person in the conversation. People may keep what they have received, for example as screenshots, and deleting your account cannot erase those copies.

Location and camera

If you allow location access, the app uses your location on your device to suggest a nearby place. Your exact coordinates are not sent to our servers; only the place you choose is. You can always choose a place manually instead. We do not share your live location.

The camera is only used to photograph a document for driver verification. The app does not browse your photo library.

You can turn off either permission in your device settings at any time.

Service providers

We use these providers to run Naveto:

• Google, for sign-in.

• Cloudflare, for hosting, the database, storage of verification photos, and security.

• Expo, Google Firebase Cloud Messaging and Apple Push Notification service, to deliver notifications. A message notification can include the sender's name and the message text.

• PostHog, for automatically enabled website analytics.

We do not sell your personal information and we do not show advertising. We may disclose information when the law requires it, or when it is necessary to investigate abuse or protect someone's safety.

Where your information is processed

Our database and verification photos are hosted by Cloudflare, configured to use servers in Western Europe. Our providers may also process information in other countries, including for sign-in and notifications.

How long we keep it

• Account and profile: until you delete your account. We do not delete inactive accounts automatically.

• Rides, bookings, messages, ratings, reports and moderation records: until you delete your account, then deleted with it.

• Verification photos: deleted 30 days after the review decision. The review result is kept until you delete your account.

• Sign-in sessions: expire after at most 90 days.

• Waitlist contacts, and the campaign tag, route page and referral data kept with them: kept until we announce the launch, then deleted within 6 months. You can ask us to delete yours sooner.

• Counted referrals: deleted when the referred account is deleted.

• Founding member badge: kept on the referrer's account until that account is deleted, even after the waitlist entries have been deleted.

• Server logs: up to 30 days.

• Backups: deleted information disappears from our database backups within 30 days.

• Notifications already delivered to other members stay in their accounts.

Your choices and rights

• You can see and change most of your information in the app. To ask for a copy, a correction or the deletion of your information, or to object to how we use it, write to hello@naveto.ma. We reply within 30 days and may ask you to confirm that the account is yours.

• You can delete your account in the app settings or at naveto.ma/delete-account, without reinstalling the app.

• Promotions are off unless you turn them on, and you can turn them off at any time in the app settings.

• Website analytics run automatically and use memory-only storage. To ask about this processing or object to it, write to hello@naveto.ma.

• Deleting your Naveto account does not delete your Google account.

Security

All connections to Naveto use HTTPS, and access to accounts and verification photos is restricted to authorized people. Messages are stored on our servers and are not end-to-end encrypted. No system is perfectly secure; if you notice misuse, write to hello@naveto.ma.

Age

Naveto is only for people aged 18 or older, and every passenger must be 18 or older. If you believe a minor is using Naveto, write to hello@naveto.ma.

Changes and languages

When we change this policy, we update the version and date at the top of this page, and we tell you in the app or by email before significant changes take effect.

This policy is available in French, English and Arabic. If the versions differ, the French version applies.