Privacy Policy

1. Who we are

BringYa is a local small-parcel delivery platform for Edmonton, Alberta, Canada. For privacy requests and general support contact support@bringya.ca.

2. Information we collect

Account: full name, phone number, email address, password (stored as a one-way hash, never in plain text), role (customer and, if approved, rider), and timestamps when you accept the Terms and this Policy.

Verification: a six-digit SMS one-time code (stored only as a hash), attempt counts, and expiry. We do not log production OTP values.

Deliveries: pickup and drop-off addresses and coordinates, receiver name and phone, optional receiver email and instructions, package description, photos and names captured as proof of pickup or delivery, delivery PIN (hashed for riders; shown to the customer and receiver when policy allows), public tracking-link tokens (stored hashed where practical), and order status history.

Location: when you search or pin an address we use the location you provide (and, if you allow it, the device location while the app is in use). If you use Rider mode, we collect precise location while you are online or on an active job so we can match nearby jobs, show customers and receivers progress after pickup, and operate live dispatch. Background / Always location is optional and only used if you grant it, so tracking can continue if you switch apps. We do not permanently store every GPS ping; selected checkpoints may be kept for disputes, safety, and proof of delivery.

Payments: payment method (cash or card), amounts in cents, cash collected/remitted ledger entries, and rider earning snapshots. We do not store full card numbers, CVV, or magnetic-stripe data. Card data is handled by a payment processor when card checkout is enabled.

Rider applications: legal name, date of birth, residential address, vehicle details, and identity or eligibility documents you upload (driver’s licence, insurance, and similar). Files are stored privately and served through authenticated routes.

Device and security: IP address, user agent, approximate device metadata for sessions, and push-notification tokens if you enable notifications. We use this for rate limiting, fraud prevention, and session security.

Support and public pages: if you email us, we receive the content of that message. Public tracking pages collect basic access metadata (time and count) for the tracking token.

3. How we use information

We use personal information to create and secure your account, verify your phone, quote and fulfil deliveries, calculate fares and rider pay, process cash and card payments, show live tracking, review rider applications, operate dispatch, send transactional SMS and push notifications, prevent fraud and abuse, keep audit logs of sensitive admin actions, comply with law, and improve reliability of the Services.

We do not sell your personal information. We do not use your content to train third-party generative AI models.

4. Legal bases and consent

We process information because you ask us to provide the Services (contract), because you consent (for example location permission, SMS OTP, optional notifications), because we have a legitimate interest in security and fraud prevention that does not override your rights, and where law requires us to keep records.

You can withdraw optional consents in device settings (location, notifications, photos). Some features cannot work without the related data. You may delete your account at any time as described below.

5. Location — please read (App Store & Play)

Customer mode: location is used while the app is in use to help you pick pickup and drop-off points. We do not require background location for customers.

Rider mode: if you go online or accept a job, BringYa needs precise location while you use the app. While Using the App is enough. We do not require “Allow all the time” / Always. The rider Home screen may show an optional reminder that All the time is better so customers can keep seeing live position if you switch apps or lock the phone. You may go offline to stop receiving offers. You may revoke location permission in iOS Settings or Android Settings; Rider mode will then be unavailable.

Receivers who open a tracking link see live rider location only after the parcel is picked up, and not after a terminal status such as delivered or cancelled.

6. Photos, camera, and files

The app may ask for camera or photo-library access so riders can upload proof of pickup/delivery and so riders can submit documents. Images are stored with randomized names, type and size checks, and authenticated access. We do not use photos for advertising.

7. Who we share with

Other users of a delivery: the assigned rider sees job details needed to complete the trip; the customer sees rider first name, vehicle summary, and tracking; the receiver sees a limited public view (status, destination area, rider first name, PIN if enabled, live map after pickup). We do not show the receiver the customer’s email, payment card, or rider documents.

Service providers who process data for us: SMS delivery (for example Twilio when configured), transactional email for the website contact form (Mailjet / SMTP from notify@bringya.ca), maps and address search (Google Places), map tiles and routing (OpenStreetMap / CARTO tiles and our routing engine), hosting and database infrastructure, and a card payment processor when cards are enabled. They may process data only to provide their service to us.

Apple and Google receive the information required to distribute the app through their stores. Law enforcement or regulators if required by law. A buyer of the business, under appropriate safeguards.

8. Retention

We keep account data until you delete the account. Order, payment, cash, payout, and audit records are kept as long as needed for tax, dispute, and legal obligations (typically at least seven years for financial records in Canada, or longer if a claim is outstanding). Location streams are primarily transient; selected checkpoints may be kept with the order. OTP challenges expire automatically. Deleted accounts are anonymized so the original phone and email can be reused.

9. Security

We use HTTPS in production, hashed passwords (Argon2id), hashed OTPs and refresh tokens, hashed delivery PINs, permission checks on APIs and sockets, and private file storage. No method of transmission or storage is 100% secure. Tell us at support@bringya.ca if you believe your account was compromised.

10. Your rights

Subject to Canadian privacy law, you may request access to, correction of, or deletion of personal information we hold, and you may withdraw consent where processing is consent-based. To exercise these rights email support@bringya.ca. You may also delete your account in the app or on the website without emailing us.

You can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta if you are not satisfied with our response.

11. Delete your account (required for App Store & Play)

If you created an account, you can delete it yourself: in the BringYa app open Account → Delete account, or on the website open Account → Profile → Delete account. You will be asked to confirm. Deletion immediately signs you out everywhere, sets the account to deleted, and anonymizes your name, email, and phone so they can no longer be used to sign in.

You may also email support@bringya.ca from the email address on the account and ask us to delete it. We will complete the request without unreasonable delay. We may retain limited records as described in Retention (orders you placed, amounts paid, cash ledgers, and legally required audit logs).

12. Children

BringYa is only for users 18 years of age or older. We do not knowingly collect personal information from children. If you believe a minor has created an account, contact support@bringya.ca and we will delete it.

13. International processing

Our primary operations and intended hosting are in Canada. Some providers (for example SMS, maps, or stores) may process data in other countries with contractual or legal safeguards. By using the Services you understand that your information may be processed in Canada and in those locations.

14. Push notifications

If you allow notifications we may send job offers, order status, document requests, and similar operational alerts via Apple Push Notification service or Firebase Cloud Messaging. You can disable them in system settings. We do not send marketing push without a separate opt-in.

15. Changes to this policy

We will post updates at https://bringya.ca/privacy and in the app with a new “Last updated” date. Material changes that require a new consent will be presented in the product where required by law.

16. Contact

Support and privacy: support@bringya.ca. Postal region: Edmonton, Alberta, Canada. Website: https://bringya.ca.