Privacy policy

GzaGzaCar is run by Jomo LLC, a company registered in Georgia (identification code 405713553). We decide how your data is used and are responsible for it. You can reach us at support@gzagzacar.com.

GzaGzaCar connects drivers who have free seats with people going the same way, so they can share the cost of the trip. This policy covers the GzaGzaCar app and the website gzagzacar.com.

Your account

• Name, email address, and a password stored only as a one-way hash. If you sign in with Google or Apple, we get the ID they give us for you, and the name and email you allow them to share. With Google, that includes your profile photo.
• Phone number, if you add one.
• Date of birth, to make sure members are adults.
• Gender, if you tell us. We use it only for women-only rides.
• Profile photo, a short “about you” and travel preferences (chat, music, smoking, pets), if you add them.

Identity check (optional)

If you verify your identity, you send photos of your ID document (front and back), a selfie, and a selfie holding the document. A person at GzaGzaCar compares them and records the result. We delete the photos 30 days after that decision and keep only the result (verified or not) and its date.

Your car

Make, model, colour and licence plate, which passengers see so they find the right car.

Rides and bookings

• Rides you publish or book: where from and to, stops, meeting points, dates, times, seats and prices.
• Flight numbers you give us for airport rides.
• Requests for a ride (“I need a ride”) and invites you send to drivers.

Location

• With your permission, while you use the app, we use your location to show you on the map and suggest pickup points nearby.
• When you drive, from the moment you tap “I’m on my way”, your phone sends its position so your passengers see how far away you are. We keep only the latest position, each update replaces the last, and it is deleted when you tap “Start ride”.
• During the trip, your phone keeps checking how far the car is from the destination, so the app can offer to finish the ride when you arrive. Passengers never see your position.
• When you tap “I’m here” as a driver, we keep how far your phone was from the meeting point.
• Sharing stops when the ride ends. iOS shows a blue location indicator whenever it is on.

გზად (“on the way”)

• If you turn on გზად as a driver, while you drive between towns your phone sends where the car is, which way it is heading and how fast, so we can tell you about someone waiting on your road. We keep only the latest point, nothing before it. It is not in our backups, and it is deleted 10 minutes after your phone stops sending. If you allow location “Always”, this also works with the app closed.
• If you wait by the road for a car, we keep where you are waiting and where you are going, to offer you to drivers heading that way. A driver who is offered you sees your first name, that spot and your destination, and nothing else.
• Once a driver is coming for you, while your pickup screen is open your phone shares where you stand, so the driver can find you. That point is never stored: it stays in our server’s memory and is forgotten when you meet, when the car sets off, or two minutes after the last one. We record that you met, when, and where to about 100 metres.

Ride posts from public Telegram groups

• Drivers also post rides in public Telegram groups and channels. We read the posts in the groups we follow, and show a ride in the app’s search until it leaves: the name the writer uses on Telegram, the phone number they posted, the route, time, seats, price, car, and a link to the post. The number appears only when someone taps Call, and we count those taps.
• An hour after the ride leaves, the name, number, car and the post’s words are deleted; the route, day and group stay, for counting.
• If it is your number, tap “This is my number. Remove it” on the card, or write to support@gzagzacar.com. Every ride with that number comes off at once, and we keep only a one-way code of it, so it is never shown again.

Ride codes and pickups (ბეჭედი)

• Every booking has a four-digit ride code that only the passenger sees. The driver types it into their phone when the passenger gets in. We never show it to the driver.
• We record when each passenger got in and how (with the code or without), when either of you tapped “I’m here”, how far from the meeting point the phone was and where (to about 100 metres), and whether anyone didn’t come.
• Bluetooth at pickups (iPhone app): at the pickup, the driver’s phone and the passenger’s phone exchange a short signed message over Bluetooth to confirm they were together. Drivers are asked to allow it; for passengers it is optional; nobody needs it to board. We record that the two phones found each other, when, how strong the signal was, and whether the driver’s Bluetooth was on. While waiting, a passenger’s phone only signals that a GzaGzaCar phone is nearby, with no name or number. We collect and keep nothing about other devices.
• These records form a chain in which each entry seals the ones before it, so nobody, including us, can change one without it showing. We publish a fingerprint of the chain every day.
• Where you were is erased from the record after 180 days, or when you close your account. The rest is kept with your bookings.

Messages, reviews and reports

• Messages you send to other members in the app. We don’t read them unless someone reports a conversation to us or the law requires it.
• Reviews you give and receive.
• Reports you make about other members, or that others make about you.

Payments

• Card payments are handled by our payment provider, Flitt. We never see or store your full card number. We keep the masked number (for example •••• 4242), the card type, and the token Flitt gives us so you can pay again in one tap.
• A record of every payment and refund: amounts, dates and status.
• If you drive: the card or bank account you add for payouts, and what you earned and were paid.

Your device and how you use the app

• Notification tokens, so we can send you notifications, and tokens for the ride card on your lock screen.
• A record of each sign-in: IP address, device and app version, to protect your account.
• Which screens and features are used, the app version and the platform, to improve GzaGzaCar.

Kept only on your phone

Your rides and bookings, so they open without signal, and your recent searches, so the app can suggest your usual trip. They are removed when you sign out.

The website

gzagzacar.com uses no advertising or analytics cookies and loads its fonts from our own server. Our web server may keep standard technical logs (IP address, page, time) for a short while, for security. If you sign in on the site to book a ride, one cookie keeps you signed in: it holds only your sign-in, the page’s scripts can’t read it, and it goes when you sign out, or after 7 days.

If you ask the site to email you when a ride appears on a road, we keep your email address, that road, the day and the page’s language. We first send one email asking you to confirm, and nothing more unless you do; after that, only emails about rides on that road, each with a link that stops them. It is deleted when you stop it, a day after its day (or after a month, for any day), or after 2 days if you never confirm.

• To provide what you ask for: your account, publishing and booking rides, payments, refunds and payouts, messages, notifications and ride updates. The legal basis is our agreement with you.
• With your consent: your location, notifications, Bluetooth at pickups if you are a passenger, and your gender for women-only rides. You can turn location, Bluetooth and notifications off in your phone’s settings at any time.
• To keep people safe and prevent fraud: identity checks, reviews, reports, blocking and sign-in records. The legal basis is our legitimate interest, and yours.
• To settle what happened on a trip: ride codes, pickup records and the phones’ Bluetooth link at pickups decide refunds when a driver or passenger doesn’t come, and whether a trip can be reported as never having happened. The legal basis is our agreement with you.
• To meet legal obligations: keeping payment and accounting records as tax law requires, and answering lawful requests from the authorities.
• To improve the app: usage events, which we look at without your name. The legal basis is our legitimate interest.

We don’t make decisions about you that are fully automated and have legal or similarly significant effects.

Other members

• Your profile is visible to everyone in the app: first and last name, photo, “about you”, travel preferences, verification badges, rating and number of rides. Your email address and phone number are not on it.
• When you publish a ride, its route, times, price and your first name are public, and so is a link to it you share.
• People in the same booking see what they need to meet: the meeting point, and the car and plate.
• If you share your trip, the link shows first names, the car and plate, and how the trip is going.
• A driver invite you send shows your first name and the trip you are looking for.

Companies that work for us, each receiving only what its job needs:

• Hetzner Online (Germany) runs our servers and database.
• Cloudflare stores profile and meeting-point photos, and our encrypted backups.
• Flitt (Georgia) processes card payments and refunds.
• Apple and Google handle signing in with them. Apple also delivers notifications to iPhones.
• Expo delivers notifications (it sees their text) and app updates.
• Google Maps Platform works out the road route when a driver publishes a ride. It receives the ride’s start, end and stop points, not who you are.
• OpenFreeMap supplies map images. Your phone downloads them directly, so it sees your IP address and the part of the map you are looking at.
• Mapterhorn supplies the elevation data the map draws its mountains from. Your phone downloads it directly, so it sees your IP address and the part of the map you are looking at.
• MET Norway supplies weather. Our server asks it for the forecast at a destination; nothing about you is sent.
• Resend sends our emails: the website’s booking notices and ride alerts. It receives the address and what the email says.
• Anthropic (United States) reads public Telegram ride posts for us, to find the route, time and price. It receives the post’s words and the name the writer uses on Telegram.

Others

• The authorities, when Georgian law requires us to disclose information.
• A buyer or successor, if GzaGzaCar is ever sold or merged. They would be bound by this policy.

Some of these companies process data outside Georgia, in the European Union or the United States. When they do, they are bound to protect it to the standard Georgian law requires.

You can delete your account at any time in the app: Account → Close account, once no trip of yours is still under way or ahead. When you do:

• Erased: your name, email, phone, photo, date of birth, gender, “about you” and preferences, the link to your Google or Apple sign-in, saved cards, notification tokens and sign-in records, your გზად settings and waits, and where you were in pickup records.
• Cancelled: rides you published that nobody has booked.
• Removed: your ID photos, at the next nightly clean-up.
• Kept without your name: payment and booking records, which tax law requires; reviews and messages you sent, which are part of the other person’s history too; and reports, for safety.
• In backups: copies are gone within 30 days, as old backups are deleted.

You can ask us to show you the data we hold about you or give you a copy, to correct it, to delete it, to stop or limit using it, and to withdraw a consent you gave. You can do most of this yourself in the app. For the rest, write to support@gzagzacar.com. We reply within 10 working days.

If you think we have handled your data wrongly, you can complain to Georgia’s Personal Data Protection Service (personaldata.ge). If you are in the European Union, you have the same rights under the GDPR.

• Everything between the app, the website and our servers is encrypted (HTTPS).
• Passwords are stored only as one-way hashes.
• ID photos are kept in private storage and deleted on schedule.
• Backups are encrypted.
• Only the few people who run GzaGzaCar can see account data, and what they do in the admin tools is logged.

No system is perfectly safe. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

GzaGzaCar is for people aged 18 and over. We don’t knowingly collect data from children. If you think a child has an account, tell us and we will delete it.

When we change this policy, we update the date at the top. If a change matters, we also tell you in the app before it takes effect.