Privacy Policy

Last updated: April 11, 2026

1. Introduction

Cholche ("we," "us," or "our") operates the Cholche mobile application and web platform (collectively, the "Platform"). This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use our ride-sharing, shifting (moving), and vehicle leasing services in Bangladesh.

By creating an account or using the Platform, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Information You Provide

  • Account information: full name, phone number, email address, and password when you register.
  • Profile information: profile photo, address, and preferred operating areas.
  • Driver & vehicle verification: National ID (NID) number and image, vehicle registration documents, license plate number, vehicle photos, brand, model, year, and color.
  • Trip details: pickup and drop-off locations (division, district, upazila, area, and GPS coordinates), scheduled times, notes, stopovers, and pricing preferences.
  • Bids and negotiations: proposed prices and counter-offers exchanged between customers and drivers.
  • Ratings and reviews: scores and written feedback you leave after trips.
  • Support and reports: trip dispute descriptions, report types, and any messages you send us.

2.2 Information Collected Automatically

  • Location data: precise GPS coordinates when the app is in use (foreground). We use location to display maps, match rides, and provide navigation.
  • Live trip location (drivers): from the moment a driver taps "On my way" until the trip is completed or cancelled, the driver app shares the driver's position every few seconds. The trip's customer sees it live on a map, and Cholche staff can see it for support and safety. The route of each trip is kept as its record, saved every few minutes, and deleted automatically after the retention period we show drivers (currently 90 days). Drivers are shown this before any sharing begins and must accept it to take trips. A customer's own location is never tracked.
  • Device information: device type, operating system, platform (Android/iOS), and whether the device is physical or emulated.
  • Push notification tokens: device identifiers for delivering notifications about bids, trip updates, and promotional campaigns.
  • Usage analytics: app events (login, signup, screen views, and session data) collected through PostHog, a third-party analytics service.

2.3 Information from Third Parties

  • Phone verification: we verify your phone number through SMS OTP via our SMS gateway provider (sms.net.bd) and may use Firebase Authentication.
  • Google Sign-In: if you sign in with Google, we receive your Google account ID, name, and email.
  • Geocoding: we use Google Maps and Barikoi APIs to convert addresses to coordinates and vice versa. These services may receive your location queries.

3. How We Use Your Information

We use your information to:

  • Provide our services: create your account, match trip requests with drivers, facilitate bidding, process bookings, and enable navigation.
  • Process payments: calculate fares, commissions, driver earnings, manage wallet balances, and track financial transactions.
  • Communicate with you: send booking confirmations, trip status updates, bid notifications, OTP codes, and customer support responses.
  • Verify identities: validate driver and vehicle credentials using NID and registration documents to ensure safety and trust.
  • Improve the Platform: analyse usage patterns, diagnose technical issues, and enhance the user experience through aggregated analytics.
  • Enforce policies: detect fraud, resolve disputes, investigate reports of misconduct, and enforce our Terms of Service.
  • Marketing: send promotional campaigns, coupon offers, and discounts. You can opt out of promotional notifications at any time through your device settings.

4. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

  • Between customers and drivers: when a trip is confirmed, we share relevant details (name, phone number, pickup/drop-off location, vehicle information) so both parties can coordinate.
  • Service providers: we use third-party services to operate the Platform, including cloud hosting (Render), mapping (Google Maps, Barikoi), analytics (PostHog), SMS delivery (sms.net.bd), authentication (Firebase), and push notifications (Expo). These providers access data only as needed to perform their functions.
  • Legal requirements: we may disclose information if required by law, regulation, legal process, or government request, or to protect the rights, safety, or property of Cholche, our users, or the public.
  • Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Storage and Security

Your data is stored on secure servers hosted by Render (cloud infrastructure) with PostgreSQL databases. We implement industry-standard security measures, including:

  • Passwords are hashed using bcrypt — we never store plaintext passwords.
  • Authentication tokens (JWT) are stored in your device's secure keystore (Expo SecureStore).
  • OTP codes expire after 5 minutes and are rate-limited to prevent abuse.
  • HTTPS encryption for all data transmitted between the app, web dashboard, and our servers.
  • Role-based access controls restrict admin and staff access to sensitive data.

While we take reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

  • Account data: retained as long as your account is active. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, preventing fraud).
  • Trip history: retained for record-keeping, dispute resolution, and regulatory compliance.
  • Financial records: wallet transactions, earnings, and commission data are retained as required by applicable tax and financial regulations.
  • Analytics data: aggregated usage data may be retained indefinitely in anonymised form.
  • Verification documents: NID images and vehicle registration documents are retained for the duration of the driver's active account and deleted upon account closure unless required by law.

7. Your Rights and Choices

You have the right to:

  • Access your data: view your profile, trip history, wallet transactions, and ratings through the app.
  • Update your information: edit your name, email, phone number, profile photo, and address in your account settings.
  • Delete your account: request account deletion by contacting us at support@cholche.com. We will process your request within 30 days.
  • Opt out of marketing: disable promotional notifications through your device notification settings. Service-related notifications (trip updates, security alerts) cannot be disabled while your account is active.
  • Location permissions: you can revoke location access through your device settings. Note that core features (ride matching, map display) require location access to function.
  • Withdraw consent: you may withdraw consent for data processing at any time by contacting us, though this may limit your ability to use certain features.

8. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected data from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at support@cholche.com.

9. Third-Party Services

Our Platform integrates with the following third-party services, each governed by their own privacy policies:

  • Google Maps Platform — mapping, directions, and geocoding.
  • Barikoi — Bangladesh-specific address search and geocoding.
  • PostHog — product analytics (hosted in the United States).
  • Firebase (Google) — phone authentication.
  • Expo / EAS — push notification delivery and app builds.
  • sms.net.bd — SMS OTP delivery in Bangladesh.

We encourage you to review the privacy policies of these services.

Credits: map data © OpenStreetMap contributors (ODbL); routes and place search by Barikoi and openrouteservice (HeiGIT); weather data from MET Norway (CC BY 4.0).

10. International Data Transfers

Your data may be processed and stored on servers located outside Bangladesh (including the United States) through our cloud hosting and analytics providers. By using the Platform, you consent to the transfer of your data to these locations. We ensure that appropriate safeguards are in place to protect your information in accordance with this policy.

11. Cookies and Tracking (Web Platform)

Our web-based admin dashboard may use cookies and similar technologies for authentication, session management, and analytics. You can manage cookie preferences through your browser settings.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by updating the "Last updated" date at the top of this page. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

  • Email: support@cholche.com
  • App: Contact us through the Cholche mobile app support section
  • Address: Cholche, Dhaka, Bangladesh
© 2026 Cholche. All rights reserved.