Privacy Policy

Effective date: [TODO: effective date]

This policy explains what Rascal, operated by [TODO: legal entity name], collects and why. It covers the Rascal website and the Rascal iPhone app. It should be read with our Terms of Use.

Short version

• Rascal works without sending your conversations to a server when you use on-device AI; online (server) AI is a separate option that sends the data described below.
• We store your account and the trips, places and settings you save so they can follow your account.
• Location sharing and nearby discovery only happen if you opt in, for a time you choose.
• We do not sell your data.

What we collect

• Account. Your email address and sign-in credentials, handled by our authentication provider (Supabase). Sign-in uses secure, HttpOnly session cookies on the website.
• Saved workspace. Trips, saved places, notes and the memories you or the assistant keep, stored against your account (up to 100 trips and 100 memories).
• Friends and messages. If you use friends: requests, names you give, and text, voice notes, location shares and pit-stop proposals you send to accepted friends. Email invites are blind: the person inviting never learns whether an address has an account.
• Ride sharing. If you start or join a group: your display name and your latest location fix, for the duration you choose. Rascal keeps only the latest fix, not a trail, and positions expire when your sharing ends.
• Nearby discovery. If you turn it on: a name and short bio you provide and a short-lived, foreground location fix used to find riders within about 10 metres. Raw coordinates are not shown to other people.
• Ride logs. If you save a ride: its name, route points, stats and optional tags. Full tracks stay private to you. If you choose to make a ride public, only a simplified, privacy-clipped path without timestamps is visible to others, along with its name and approximate centre.
• Subscription. If you subscribe to Rascal Pro: the product, expiry date, environment and Apple’s original transaction identifier for your subscription. We do not receive your payment card or Apple ID details.
• Usage counters. Per account, per month: counts of online AI requests (assistant, speech-to-text, text-to-speech), token counts, audio seconds, characters synthesized and cost as reported by the AI provider. These are used to apply the fair-use limit and understand service cost. Short-term rate-limit counters are also kept.
• Server logs. Technical events such as request time, model used, message length, latency, error codes and usage numbers.

Online (server) AI

If you use online AI, the app sends your request to our server, which forwards it to OpenRouter, an AI gateway, to be processed by the selected AI model. The request includes what you said or typed and recent conversation turns plus context the app builds to help answer, which is limited to:

• An approximate location (latitude and longitude rounded to about three decimal places, roughly a neighbourhood), only when a recent, accurate device fix is available; otherwise the app says location is unavailable.
• The names (not addresses, phone numbers or emails) of some saved places and contacts that have an address, capped in number.
• Your rider name, a limited number of saved preferences and your core memory notes, truncated to bounded lengths.
• Your current trip draft or ride status (such as destination, stops, remaining time and next manoeuvre) and any pending proposal or options being discussed.

OpenRouter and the model provider it routes to process this data under their own terms and privacy policies. Use on-device AI instead if you do not want this data to leave your phone. On-device AI uses Apple’s on-device model on supported iPhones, or an open model you choose to download to your iPhone from Hugging Face; what you say to it is not sent to our servers.

In normal operation our server logs do not include the content of AI requests or replies; they record metadata such as length and timing. Content logging is a switch that is off unless an operator deliberately enables it for debugging.

Optional server speech

If you turn on server speech-to-text, a short audio clip of your command (up to about 20 seconds) is sent to our server and then to OpenRouter for transcription. If you turn on server text-to-speech, the text Rascal is about to speak is sent to OpenRouter to be turned into audio. Our server does not keep the audio or text; it keeps usage counts and technical metadata. Apple’s on-device speech recognition is the alternative, and runs on your iPhone.

Location

The iPhone app uses your location for the map, search and guidance, and processes it on the device. Location leaves your phone only when you choose a feature that needs it: ride sharing, nearby discovery, sharing a location with a friend, or online AI (rounded as above). Rascal does not archive ambient audio.

How we use data

To provide and secure your account and features, sync your trips, run the features you turn on, verify your subscription, enforce limits, diagnose problems and meet legal obligations. We do not use your data for advertising.

Who processes your data

• Supabase: authentication and database for accounts, saved data, friends, ride sharing and usage counters.
• OpenRouter (and the AI model providers it routes to): online AI and optional server speech.
• Apple: App Store purchases and subscription verification, Apple Maps and Apple Music features on your device, and on-device Apple models. Apple’s own privacy policy applies to its services.
• Hugging Face: hosts the optional open on-device models. If you download one, your iPhone fetches it directly from Hugging Face, which sees a normal download request (such as your IP address). Nothing you say to the model is sent.
• Our hosting provider: the website is hosted on Vercel, which handles requests and logs for the service.

We do not sell personal data. We may disclose information if required by law or to protect rights and safety.

Retention

Account data, workspace, friends and ride logs are kept until you delete them or your account is removed. Ride-sharing groups and nearby-discovery sessions are time-limited and expire at the end of the period you chose. Usage counters are kept per month for as long as your account exists. Server logs are kept by our hosting provider under its own retention practices. Deleting a trip in the app removes it from your saved workspace.

Your choices and rights

You can edit or delete saved trips, places and memories in Rascal, stop sharing at any time, turn off server speech and use on-device AI. There is not yet a self-service button to delete your whole account. To ask for access, correction, export or deletion of your account and data, contact [TODO: contact email]. Depending on where you live, you may have additional legal rights, and you can complain to your local data protection authority. To stop a subscription, use your Apple ID subscription settings.

Children

Rascal is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

Security

Data is sent over encrypted connections and protected by access controls in the database that restrict each account to its own data. No system is perfectly secure.

Changes

We may update this policy as Rascal changes. The effective date above shows the latest version.

Contact

[TODO: legal entity name], [TODO: contact email].