My Travel Privacy Policy

1. Introduction and Overview

This Privacy Policy explains how My Travel ("My Travel," "we," "us," or "our") collects, uses, stores, and protects personal information when passengers and drivers use our mobile application and related transportation services in Cambodia.

My Travel is an inter-provincial ride-hailing and travel platform connecting passengers with independent drivers traveling between Phnom Penh and Cambodia's 24 provinces. Our core features include trip discovery, vehicle seat booking, driver vehicle and route management, real-time GPS pickup tracking, passenger boarding verification, trip notifications, and customer support.

We are deeply committed to user privacy and data security. We do not sell personal data, and we do not track users across third-party apps or websites for advertising purposes.

2. Information We Collect

A. Account and Profile Information

When you create or update an account as a passenger or driver, we collect:

• Personal details: Full name, mobile phone number, profile photo, user role (passenger or driver), account ID, and account creation timestamp.
• Account credentials: Passwords are encrypted using secure cryptographic hashing algorithms. We never store or transmit your plain-text password.
• Device & session identifiers: Platform type (iOS / Android), device model, operating system version, trusted-device identifiers, and backend-issued session tokens used exclusively to authenticate and secure your account session.
• App preferences: Preferred display language (English or Khmer) and theme settings stored locally on your device.

B. Driver and Vehicle Information (Drivers Only)

To ensure passenger safety and comply with transportation standards, driver accounts provide:

• Vehicle details: Make, model, year, exterior color, license plate number, total seating capacity, and vehicle photos.
• Driver verification: A clear driver face photo for identity verification and passenger recognition during pickup.

C. Trip, Booking, and Route Information

To facilitate inter-provincial travel, we collect:

• Departure province/location, destination province/location, route stops, departure date and time, number of reserved seats, pickup and drop-off coordinates or landmark descriptions.
• Booking lifecycle status (pending, driver_arrived, passenger_boarded, completed, or cancelled).
• Booking reference numbers and historical travel records.

E. Precise Location Information

With your explicit device permission, My Travel collects precise foreground and background GPS location data:

• In-App Prominent Disclosure: Before requesting any device location permissions, My Travel presents a dedicated, prominent modal disclosure explaining what data is collected (precise GPS location), how it is used (trip discovery, real-time vehicle route sharing, active trip continuous tracking), and providing clear consent options ("Agree & Continue" or "Not Now").
• Foreground Location: Used when searching for vehicles departing from your current province, exploring nearby routes on the map, or selecting pickup and drop-off points.
• Continuous / Background Location (Active Trips Only):
  • For Drivers: When a trip is marked active or departed, the driver's device periodically shares live GPS coordinates (via a foreground service with an ongoing notification) so booked passengers can monitor the vehicle's approach along the route, even when the app is minimized, closed, or running in the background.
  • For Passengers: Passengers access location while actively using the app (foreground) to locate departure points and find nearby vehicles. Background location is not collected from passengers.
• Strict Location Stop Policy: Continuous location updates immediately terminate as soon as the active pickup or trip is completed, confirmed, or cancelled. We do not collect location data when the app is idle or outside an active trip. Location data is never shared with third parties or used for advertising.

F. Photos and Camera

If you grant camera or photo library permission, the app accesses images solely when you choose to take or upload a profile picture, driver face photo, or vehicle photo. The app does not scan or upload other photos from your media library.

G. Push and Operational Notifications

With your permission, we send operational notifications regarding booking confirmations, driver arrival alerts, passenger boarding requests, trip status changes, safety alerts, and account messages.

3. How We Use Information

We process personal information strictly for legitimate operational purposes:

• Service delivery: To enable passengers to discover trips, reserve seats, and communicate with drivers, and to allow drivers to publish routes and manage passenger seating.
• Live navigation & safety: To provide map visualization, real-time vehicle tracking, proximity calculations for arrival confirmation, and boarding verification.
• Account security: To authenticate users, prevent duplicate or fraudulent accounts, and verify trusted devices.
• Operational communications: To deliver trip updates, arrival alerts, and customer service assistance.
• Dispute resolution & legal compliance: To investigate safety incidents, resolve trip disputes, and comply with applicable laws and transportation regulations in Cambodia.

We never sell, rent, or trade your personal information. We do not engage in cross-app advertising tracking or profiling.

4. How Information is Shared

We share information only in the following limited circumstances:

• Between Assigned Passenger and Driver: Passengers see the driver's name, profile photo, vehicle model, license plate, contact phone number, and live vehicle location during an active trip. Drivers see the booked passenger's name, profile photo, contact phone number, reserved seat count, and pickup location during an active pickup.
• Third-Party Infrastructure and Technical Providers: Google Maps API (used for maps and geocoding under Google's Privacy Policy) and cloud infrastructure providers under strict confidentiality.
• Legal Requirements and Safety Protection: When strictly required by Cambodian law, court order, or official law enforcement request, or when necessary to protect the physical safety of passengers, drivers, or the public.
• No Sharing with Financial or Advertising Networks: Because My Travel operates on a physical cash basis, no personal or financial data is shared with banks, payment gateways, credit bureaus, or advertising networks.

5. Account Deletion and Data Retention

We believe in full user control over personal data. In compliance with Apple App Store Guideline 5.1.1(v) and Google Play User Data policies, users can easily and permanently delete their account at any time.

B. External Account Deletion Request (Web / Email)

If you have uninstalled the app, cannot access your device, or prefer to request deletion externally:

• Email Request: Send an email to virakoumst@gmail.com with the subject line "Account Deletion Request", including your registered mobile phone number.
• External deletion requests are verified and processed within 7 business days.

C. What Happens When an Account is Deleted

Upon deletion:

• Your user profile (name, phone number, password hash, profile photo) is permanently deleted.
• All active session tokens and trusted-device secrets are immediately revoked.
• Driver vehicle listings, seat configurations, and driver documents are permanently deleted.
• Live GPS tracking data is instantly purged.
• Any non-identifying operational trip logs required by Cambodian transport regulations, tax compliance, or unresolved dispute investigations are archived in an anonymized format stripped of your personal identifiers.

6. Data Security and Storage

We implement robust administrative and technical security measures:

• All communications between the mobile application and our servers are encrypted using Transport Layer Security (TLS/HTTPS).
• User passwords are cryptographically hashed and cannot be decrypted by our staff.
• Session authorization uses short-lived tokens and device-bound cryptographic secrets to prevent unauthorized session hijacking.
• Access to production databases is restricted to authorized personnel under strict principle-of-least-privilege access controls.

7. Children's Privacy

My Travel is not directed to children under the age of 13. We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information without parental consent, we will promptly delete such information. If you believe a minor has registered an account, please contact us at virakoumst@gmail.com.

8. Contact Us

If you have any questions, feedback, or requests regarding this Privacy Policy or your personal data, please contact our team: