Privacy notice

VERSION 1.19 · EFFECTIVE 2026-11-13

1. What we collect

Your account. Your university email address, and your password as a one-way hash we cannot read back. If you continue with Google, Google tells us that address and the name your university gave your account. We never see your Google password.

Your profile. Your name. Your gender, Woman or Man, which you say when you join. Your department, batch and programme, which we read from your university email. A photo, if you add one. Where you start from, if you say it, as an area about 100 metres across rather than a door, or that you live on campus. If you joined before gender was asked this way, we keep what you said then, and whether you chose not to answer when asked again.

Your student card. Only if you check your name against it, in one of two ways. A photo of the plastic card, taken in the app: our own server reads it, and no one else's does. Or the digital card your university gives you to download: it holds a QR code, and our server reads the code and asks your university's own card page whether the card is genuine. A digital card can be the PDF itself or an image of it, and a PDF is deleted once its check is decided, as an image is. Either way we check that your name is the one on the card and that it carries the registration number your university email does. We never keep what was read on a card, the link in its QR code, its signature or what your university's page said, except one thing: the day a digital card runs out. We keep that your name was checked, when, and how: the card was read as a photo or as a digital card, a person checked it, or your university's Google account gave the name. We use the day a digital card runs out to remind you a month before, and to ask for a new card after it.

Your vibes. Up to three things you are about, such as Music on, Quiet rides or Chai, from a list we keep, if you pick any. None until you do.

Your vehicles. The type, the number plate and the seats. The make, model, colour and whether it is electric, if you add them. If you type a make and model that are not in our list, we count how often those words are typed, so we can add what is missing. The count is not linked to you.

Your vehicle's registration card. If you send it: a photo of the back of a vehicle's registration card. Our own server reads the text on the photo to find the number plate, maker, colour and seating, and fills them in for you. It does not keep that text. It keeps whether the photo came from the camera or from your files, and an unreadable fingerprint of the plate, only to check that the photo is for the plate your vehicle carries. A photo of the card's front, or of something that is not a card, is deleted at once and nothing is kept. A vehicle that passes shows riders a verified tick; you can offer rides without it. A card taken with the camera, read as that vehicle's own, can show the tick before a person has looked. A person at Chalen then looks at every card within a day, and can take the tick back. Only you and the staff who check it see the photo, every time staff open it is logged, and its location data is removed when it is uploaded. We delete the photo once it is checked or refused, when you send a newer one or remove the vehicle, and after 30 days at most. We keep that a card was sent, whether it was accepted and if not why, when, and who decided, but never what the card says. Changing the plate removes the tick until a new card is checked.

Your trips. The trips you offer, the seats and rides you book, your ride requests and offers, why you cancelled a request if you say, pickup and drop-off points, fares, when you boarded, whether you said you are still going on a date you hold a seat on, receipts, and the ratings you give and get.

Asking for a ride. If you ask for a ride at a time: the campus end and where you start from, as an area about 100 metres across, the names you gave them, which only you see, the time, how many seats, whether you would like a driver of your gender first, whether a driver's yes should book your seat for you, and which drivers answered. If you choose that a yes books your seat, it does, and you can give the seat back for free.

Waiting for a seat, and following a driver. If a carpool is full and you ask to be told when a seat opens: your place in line, and the seat held for you for a short while when one does. If you follow a driver you rode with to the end: who, and the route of the trip you followed them after, so we can tell you when they publish another one that way. We tell you at most once a day.

Links you share. A link to a carpool, to a ride you asked for, or to a carpool group, if you make one: which it is, when it was made, how many times it was opened and how many seats were booked through it. Those two numbers are shown to you, as the one who made the link. If you drive, whether your links show your first name. It is off until you turn it on.

Invitations. If you invite someone you rode with to a carpool group: that you did, who, and when.

Inviting your class. Your own invite code, which is your first name and two or three characters. We keep how many people made an account through it, and, for each, that they did and when. If you join through a classmate's code, we keep that you did and when, with no name.

Giving rides. While Drive is open in front of you, you are online: we keep the vehicle you are driving and where you are, so we can show you the requests near you. Stay online keeps you online after you close the app. If you say where you are going, where you are is kept as an area about 100 metres across. If you do not, it is kept as a square about a kilometre across, and while Drive is open the square moves to the one you are in: your online record holds the latest square, not a trail of them. Online records are kept after you go offline, with their last square or area, because the offers made from them refer to them. Each offer you make also keeps where you were when you made it, as an area about 100 metres across. A request near you is placed on your map by that same square, never by the exact pickup. Staying online has an end, and you can add an hour to it, up to two hours in all.

Position during a trip. While a trip is live, the driver's phone sends the car's position, also when the app is in the background. It is held in memory and never written to the database. When the trip ends we keep one line of the route, with no times on its points. A passenger's own position is read once, on their phone, to place a pickup pin.

Letting your driver find you. If you choose to, your phone sends where you are standing to your driver in the last few minutes before the car reaches your pickup. Your position is held in memory and never written to the database; only your newest one is held, and the driver sees it only while it is under a minute old. We keep that you once said yes, and your choice for each pickup: on, paused or not now. The first time, we ask. You can pause or stop at any time.

Messages. What you write in a trip's chat or a carpool's group, the voice messages you record there, the photos you send there and their captions, the stickers you send, the polls you start in a group and your votes, who you mention, the reactions you add, a picture you give a group, the groups you are put in or leave, which of a group's messages you can read, and the chats and groups you mute. A carpool you send into a chat is a card holding the two ends by area; its seats and price are read fresh each time. A note you put over your face is one line of up to 60 characters. If you share where you are standing in a chat between two people, the line holds a clock, not the place: your position is held in memory only.

When your messages arrive and are read. For each message you send in a chat between two people, we keep when it reached the other person's phone and when they read it. In a carpool group, we keep how far each member has received and read, and when each of those moved. That is what draws the ticks beside a message, and what a message's Info shows to the person who sent it.

When you were last here. The last time your app left the foreground or lost its connection. It is one time, replaced when it changes and at most once a minute. It is not a trail.

Photos you send in a chat. Before anyone sees one, our server makes a new copy of it. The copy carries no location or camera details from your phone. Stickers are a set we draw; sending one sends only which it was.

The microphone. Only while you hold the record key, or after you lock a recording to keep going hands-free. Nothing is recorded at any other time.

Safety. The names and phone numbers of the trusted contacts you add. Who you sent a live link to. SOS alerts. Reports you make, with up to three photos, and blocks. What you add to a report, a second look you ask for, and what Chalen tells you about it. If you say you were at a pickup you were marked absent from, that report holds the times the record shows: when the driver said they arrived, when you were due, when the wait began, whether you had said you were coming, and when you were marked.

Your phone. A push notification token, and a name for each phone you sign in on. A record of the notifications we sent you. Around 8 PM we send one notification a day when rides leave your way the next morning or afternoon, worked out from where you said you start from, or from the times of your commute if you set them. We keep the evening we last sent it and how many we have sent. If you have not opened five in a row, we stop sending them and say so; you can turn them off or back on in Settings, or from the notification itself.

2. What we do not collect

A phone number for you. Passengers and drivers reach each other in the trip's chat.
Card or bank details. Fares are paid in cash.
Your address book. If you invite a friend from your phone's contacts, the app reads them on your phone and they stay there; nothing about them is sent to us. You type a trusted contact's number yourself.
Advertising identifiers. The app carries no advertising and no analytics trackers.

3. Who sees what

Your gender is shown on your seat. Whoever can see your seat, your card or your request sees whether you are a woman or a man. You cannot switch this off. If you joined before gender was asked this way and have not said one of the two, your seat shows none.

Other passengers see that a seat is taken, and the gender of whoever holds it. Never your pickup. Your name, photo and programme reach them only through the carpool's group, which you are in once you hold a seat (next).
Members of a carpool group you are in see your first name and the first letter of your last name, your photo, programme and batch, your rating once you have three and how many trips you have made, your vibes if you picked any, what you write there, the voice messages, photos, stickers and polls you send there, how you vote in its polls, your reactions, how far you have read, and whether you are online if you show that. The driver's rating and trips are the ones they have as a driver, shown with their vehicle's model and colour and never its plate; a passenger's are the ones they have as a passenger. Never your pickup, your seat or what you pay, with one exception: in the group of a carpool that carries one passenger at a time, such as a motorbike or a scooty, members see which of its coming dates each of them holds the seat on. A member reads what is written in the group from when they joined, not before. The driver can share up to the last 100 messages written before someone joined with them, once each time they join; the group is told when they do, and those messages show who shared them. A carpool's driver is in its group from the start. A passenger is put in it when they come to hold a seat on the carpool, by a booking or by a request the driver accepts, with nothing to tap. Leaving holds: someone who leaves is not put back, not even by a later date of the same repeating carpool, and can join again themselves if they change their mind. A driver who removes someone keeps them out.
A carpool's driver, and its passengers on a date, see in its group how many of that date's passengers said they are still going, from 8 PM the evening before until half an hour before it leaves. Never who said it, except in a carpool that carries one passenger at a time, where its driver sees whether that day's passenger said so.
The sender of a message in a carpool group sees which of its members received it and which read it, and when. A group always shows this. Read receipts do not apply to it.
The other person in a chat between two people sees whether what they wrote reached your phone, and whether you read it. If you or they switch read receipts off, they see that it reached your phone and not whether you read it, and you see the same of theirs. They also see when you were last here, if you and they both show when you are online.
Your vibes are seen only by the people in a carpool group you are in. Nowhere else.
Someone you mention in a group is told that you mentioned them.
A voice message is heard by the people in the chat you send it to, and nobody else.
A photo you send in a chat is seen by the people in that chat, and nobody else.
A notification about a message you send shows the people it is for your first name (in a group, with the first letter of your last name), your photo, what you wrote, and the group's name. For something other than words it says what you sent: a photo and its caption, a voice message, a sticker, a poll and its question, or a pickup point, never where that point is. Whoever holds their phone can read it on the lock screen, unless the phone's own setting hides what notifications say.
A group's picture is seen by the group's members, and nobody else. The group says who set it.
Your driver sees your name, photo, gender, seat and pickup point. Your pickup point goes to no other passenger. If you are asked the evening before whether you are still going, your driver sees your answer: yes, or not answered. Never a no. If you chose to let your driver find you, they see where you are standing, as above, and nobody else does.
Your passenger sees the driver's name, photo, gender, programme and batch, rating, vehicle and plate.
On Ride now, drivers near the pickup, or going that way, see a request before it is accepted: the names of the pickup and the destination, how long the trip is to the half kilometre, and the fare, with the passenger's gender, programme, department, batch and rating. How far the pickup is from them is measured to a square about a kilometre across around it, never to the pickup itself. They never see the passenger's name, photo or exact pickup point. A map of the requests near a driver puts each one on the centre of that same square.
On Ride now, the passenger sees each driver who makes an offer: their first name, photo, gender, programme, department and batch, rating, how many trips they have driven, the vehicle and whatever make, model and colour the driver gave it, how far away they are and how many minutes, the note they add, and their fare. The driver's whole name and the number plate are shown only after the passenger accepts. Accepting shows each side the other.
Passengers looking for a ride see how many drivers are online nearby, as a number. Never who they are or where they are. You are one of that number while Drive is open, or while you stay online.
The people on a trip see where the car is while the trip runs.
A link to a carpool that its driver or a passenger shares opens a page for anyone who has the link, with no sign-in. It shows the route by area, never a street or a house, the day and time, the seats left and the price of a seat. It never shows a photo, the plate or a pickup point. It shows the driver's first name only if the driver turned that on, and it never shows a rider. A link to a ride you asked for shows the area, the time and the seats asked for, and nobody. The carpool itself is seen only in the app.
A link to a carpool group opens a page that shows the group's name and its badge, the little picture beside the name, with the route by area, the days and time and the seats left. It never shows a member. The name is words a member wrote, and it is shown because a member chose to share the link.
When you ask for a ride at a time, drivers going that way see only how many students asked for that time and how many seats, each student's gender as a seat shows it, and the area they start from, about 100 metres across, with the campus. Never a name, a photo or an exact point. A driver who answers is shown to you by first name, with their run, and you book the seat yourself.
An invitation to a carpool group goes only to someone you shared a trip with in the last 90 days, who is not in the group and has not blocked you or been blocked by you, and not more than once a week for the same person and group. It says your first name and never the group's name. An invitation does not put anyone in a group: a booked seat does.
Your phone's contacts, if you let the app read them to invite a friend, are read on your phone only and are never sent to us. Inviting a friend from them opens WhatsApp on your phone with that one person's number and the group's link.
A trusted contact you send a live link sees your first name, who is driving (the driver's first name and the first letter of their last, their photo and their rating once they have three), the car on its route, its plate and when it is due. They never see another rider, and the link shows nothing live once the trip ends.
A classmate who opens your invite link sees your first name, and its first letter in a circle. Never your photo, surname or programme, and never who joined. If you choose to be told, you get a notice that a classmate joined, which names nobody. It is off until you turn it on.
A note over your face is seen for 24 hours by people you shared a trip with in the last 30 days, never rider to rider, and by the members of your groups. Not by anyone you or they blocked. It can carry a carpool of yours that is still open for booking. A reaction to it reaches you only as a message in an open chat between the two of you, and carries a copy of the note's words.
A carpool card in a chat shows the two ends by area, the day and time, the seats left and the price to the people in that chat. It can be taken back within the hour. It is not sent for a driver who has blocked or been blocked by the sender.
Where you are standing, in a chat between two people, is seen by the other person alone, for 15 minutes at most, and ends sooner if you stop it, are picked up, give the seat back or the trip ends.
A driver you follow sees how many follow them, as a number, never who. A rider in line for a seat is never shown a place or who else is waiting; a driver sees only how many are.
Chalen's staff read reports and their photos, and the note on a rating. A person looks at a student card only if our server could not read it, or your university's card page could not be asked, and you sent it for review; every look is logged. A person can correct your gender when you write to us, and that is logged too. A trusted contact's number is encrypted, shown to you masked, and opened only to send a text. Every opening is logged.

We do not sell your information, and we do not share it for advertising.

4. Others who handle it for us

Google signs you in, if you continue with Google: it tells us your university email address and the name on that account.
Expo, Google and Apple deliver push notifications. A notification says who and when, never where. One about a message carries what it shows: the sender's first name, a link to their photo that works for ten minutes, what they wrote or what kind of thing they sent, and the group's name.
Twilio sends texts to your trusted contacts for us, where we send them: their number and the message. Where your own phone sends them instead, they go through its messages app and not through us.
Google Maps or Apple Maps draws the map on your phone. On Android, Google's Maps software in the app sends your phone's device details, diagnostics and how you use the map to Google, under Google's own terms and not through us. Place search goes through our server to Google Places, and a dropped pin is named by a geocoding service, which receives the coordinates and nothing about you.
Cloudflare stores photos and voice messages, the photos sent in chats included. They are served only to signed-in members who may see or hear them.
Our email provider receives your address to send verification and password emails.
Sentry receives an error report when our server fails: what failed, where in the code, when, which version of the app asked, and your account's ID. Never your messages, photos, places or contact details. Reports are stored in the EU and kept for at most 90 days.
Sentry also receives an error report when the app fails on your phone: the error's text, where in the app's code it happened, the screen's name, the app's version and update, your phone's system and its version, whether the app closed, and your account's ID if you are signed in. Email addresses, phone numbers, exact coordinates, IDs, sign-in tokens, the search part of a link, and long numbers and anything in double quotes in its text are taken out, on your phone and again on our server. The app sends nothing of what is on your screen, and at most 20 reports an hour, with a random ID it makes only for counting them, which goes no further. Your phone keeps a report only until it is sent. Sentry keeps it as above. Our server passes it on and stores none of it; where Sentry is not set up, its log keeps a short summary instead, without your account's ID.
Your university's card page is asked about a digital card, if you check one. It receives the two values in the card's QR code, your registration number and a signature your university made, and nothing else: they go from our server and never from your phone, to the one address your university gave us. It answers whether the card is valid and gives the name, the registration number and the day the card runs out. Its page shows more than we use, and we keep none of it.
WhatsApp, if you share a link through it or invite a friend from your contacts, is opened by your phone with the link and, for a contact, that one person's number. We send it nothing.
Have I Been Pwned is asked whether a new password has appeared in a breach. It receives five characters of a hash, never the password.

5. How long we keep it

A car's live position: only while the trip runs.
Where you are standing, for your driver or in a chat: in memory only, replaced by your next position, never written to the database. A chat's line holds its 15 minutes and when you stopped it.
That you allowed your driver to find you: until you delete your account. Your choice for a pickup goes with the seat.
A note over your face: 24 hours, then it is deleted.
Your place in line for a full carpool: until you leave it, you book, or the carpool leaves. A seat held for you: at most ten minutes.
A driver you follow: until you stop following or delete your account.
An account whose email was never verified: deleted seven days after the last verification email we sent.
What the server made of a vehicle card photo (its source and the plate's fingerprint): until the card is decided, and one a day old that never reached a vehicle is deleted.
A photo of your student card, or the image of your digital card: until its check is decided. If our server reads it, that is at once. If you send it for review, it is until a person decides, and never longer than 30 days. A photo that was never checked is deleted after 30 days.
The day your digital card runs out: until you check a new card or delete your account.
The route line of a finished trip: with the trip's record.
Chat: you can open a trip's chat for 30 days after it ends. After that nobody can open it in the app.
A carpool group: each message can be opened for 30 days after it was sent. When the carpool stops running, its group closes a week after its last trip and can be read for 30 days more.
When your messages arrived and were read, and when a group member's reading moved: like the messages they are about.
The time you were last here: until it changes, or until you delete your account.
A voice message: like a message. It can be played for as long as the chat can be opened.
A photo sent in a chat: like a message. It can be opened for as long as the chat can.
An invitation to a carpool group: a week. After that it is forgotten and you may be invited again.
A link you shared, with its two numbers: kept, and turned off when it stops working. That is when you turn it off, when the carpool is cancelled, when you leave the group, or when you delete your account.
Your vibes: until you change them or delete your account.
A message you delete for everyone is hidden in the app at once. Its words, its recording or its photo are kept with the chat, in case somebody reports it.
The record of notifications we sent you: 30 days.
Reports, their photos and SOS alerts: kept, because they protect other people.
Our logs leave out email addresses, positions, message text and sign-in tokens.

6. Your choices

Change your photo, your vehicles and where you start from at any time. A name that was checked changes only by checking your card again. When a digital card runs out, you check a new one.
Your gender cannot be changed in the app. If it is wrong, write to support@chalen.pk and a person will correct it.
Pick up to three vibes, change them or clear them at any time.
Switch off showing when you are online. Your last seen goes with it, and so does everyone else's from you.
Switch off read receipts. Nobody sees whether you read their messages in a chat between two people, and you do not see whether they read yours. A carpool group is not affected.
Leave Drive, or turn off Stay online, to stop being counted among the drivers nearby.
Choose which notifications you get.
Remove a trusted contact, or stop sharing a live link.
Show your first name on links you share to your carpools, or stop.
Pause or stop letting your driver find you, or stop sharing where you are standing in a chat.
Take down your note over your face.
Leave the line for a full carpool, or stop following a driver.
Choose to be told when a classmate joins through your code. It is off until you do.
Turn off a link you shared to a carpool, a ride you asked for, or a group, and make a new one.
Block someone you travelled with, or someone in a carpool group you are in.
Leave a carpool group, and you are not put back in it, or take a group's picture off.
Mute a chat or a carpool group, for eight hours, a week or until you turn it back on.
Ask for a copy of what we hold about you by writing to support@chalen.pk.

7. Deleting your account

You can delete your account in the app. It takes effect at once and cannot be undone: you are signed out everywhere, and any seats, trips, ride requests and offers you had open are called off and the people on them are told. You cannot delete it while you are in a car or driving one. Our nightly backups are encrypted and kept by a storage company for up to six months, so what you delete stays in them until the last backup that holds it is removed.

We erase what identifies you: your email address and password, your name, the record of your card checks and the day your digital card runs out, your photo, gender, department and batch, where you start from, the rides you asked for at a time with the answers to them, the invitations you sent and were sent, your saved places, the number plates of your vehicles, the photos of their registration cards and the record of their checks, your trusted contacts, your notification token and settings, the evening we last told you tomorrow's rides, the record of notifications we sent you, your saved searches, alerts and standing seats, your vibes, the time you were last here, when you read a carpool group's messages, the words of the messages and offer notes you sent, your voice messages, the photos you sent in chats, the polls you started and your votes in polls, and the pictures you gave carpool groups, your invite code and the count of who joined through it, your place in line for full carpools, the drivers you follow and who follows you, that you allowed a driver to find you, your note over your face, and what the server made of your vehicle card photos. A chat that a report is about keeps what was sent in it. In a chat between two people, the marks that say when a message reached a phone or was read stay with the chat, because they are on the other person's record too.

We keep, without your name, what other people's records depend on: the trips you shared, with their pickup and drop-off points, fares and receipts; your ride requests, with their pickup and drop-off points, route and fare, and why you cancelled one if you said; the type, make, model and colour of a vehicle a trip used; the route line of a trip; your online records, with where you said you were going, and the offers you made, with their fares, each with the square or area it was made from; the ratings you gave and received; your choice of whether to be found at a pickup, which goes with the seat; that you joined through a classmate's code, with no name; the reports you made, with what you added and any no-show record in them; and the links you shared to carpools and groups, turned off, with their two numbers, so that a link you already sent says it is off. Reports and SOS alerts are kept too, and a chat that a report is about is kept whole. We keep a record that the account was deleted, and when.

A notification another member was already sent may show your first name until it lapses, 30 days at most. One already on their phone stays there, with what you wrote, until they clear it.

We also keep a one-way fingerprint of your email address. It cannot be turned back into the address. If you sign up again with the same address, it lets a block someone placed on you, or a removal from your campus, still apply.

If your account was removed, you cannot sign in to delete it. Write to support@chalen.pk and a person will delete it for you.

8. Security

Passwords are hashed. Connections are encrypted. Sign-in tokens are short-lived and can be revoked. Logging out ends that sign-in on our server, and resetting your password signs you out everywhere.

9. Changes

When this notice changes, the app shows the new version and its date.

10. Contact

Write to support@chalen.pk.

Also: Terms of use.