Privacy Policy

1. Who we are and what this covers

Lineup Labs (OPC) Private Limited operates roads.fyi and is responsible for the personal data described in this Privacy Policy ("Policy"). This Policy covers the roads.fyi website, accounts, maps, road reports, and related services (the "Service").

2. Personal data we collect

2.1 Account and verification data

• your confirmed mobile number, if you add one;
• mobile-confirmation request records and confirmation time;
• anonymous-account access-link records;
• your account identifier, creation time, last-login time, and country preference;
• session identifiers, expiry, and revocation status; and
• the date and versions of the Terms and Policy you accepted.

2.2 Road reports and location data

• the road you select, your rating, condition tags, and report history;
• the time of submission and technical road-source identifiers; and
• tag suggestions, site feedback, or other content you intentionally submit.

If you share your location, we process your precise current location and device accuracy to check whether the selected road can count towards scores. We do not retain those coordinates or accuracy in report or submission history.

2.3 Browser and technical data

• an essential HTTP-only session cookie named for roads.fyi, used to keep you signed in, plus a temporary HTTP-only cookie used only to confirm that your browser can save the required session cookie before mobile confirmation;
• when you share your location, an encrypted essential HTTP-only location-grant cookie containing your current location and device accuracy for up to 30 days, so you do not need to request location access for every nearby report;
• your selected country stored in a browser cookie so the Service can preserve that preference while you are logged out;
• IP address and a one-way derived rate-limit value used to prevent OTP abuse;
• standard request, browser, device, error, and security information that our servers and service providers may process when you use the Service; and
• cookieless usage analytics, including the page URL without its query string or hash, page title, referrer, browser language, screen size, device and browser categories, approximate country, visit time, Core Web Vitals measuring page load, responsiveness, and layout stability, and fixed report-funnel interactions such as opening the report flow, choosing whether to share location, completing report fields, and the submission outcome. Umami processes the IP address and user agent to create an anonymous session value but does not store the IP address; and
• searches, selected places, map viewport, and coordinates you choose to send to map or place-search features.

3. How we use personal data

We use personal data to:

• create anonymous accounts, confirm mobile numbers, and maintain sessions;
• save country preferences and show relevant road information;
• validate, publish, aggregate, rank, update, and delete road reports;
• prevent duplicate ratings, fraud, abuse, and unauthorized access;
• operate, secure, troubleshoot, and improve the Service;
• understand aggregate visits, referral sources, and page usage;
• enforce our Terms and respond to support, rights, and legal requests; and
• comply with law and protect users, the public, and our rights.

4. What other people can see

Road ratings, tags, counts, rankings, report times, road locations, and related aggregated or public report information may be visible to anyone. Your mobile number, current device location, session data, and account identifier are not intentionally displayed publicly.

Public or aggregated information can be copied, cached, or shared by others. Removing a report or account may not remove copies already made by third parties or de-identified information that no longer identifies you.

5. Legal bases and consent

Depending on applicable law, we process personal data with your consent, to provide the Service you request, to comply with legal duties, and for legitimate interests such as security, fraud prevention, service integrity, and legal claims where those interests are not overridden by your rights.

At account creation, you actively accept this Policy and our Terms. We record the acceptance time and policy versions. Where processing depends on consent, you may withdraw it by deleting your account or contacting us. Withdrawal does not affect earlier lawful processing and may make account features unavailable.

6. Service providers and data sharing

We share data only as needed with:

• MSG91, which sends and verifies mobile OTPs and processes your mobile number and verification data;
• Google Maps Platform and Places, when you use place search, autocomplete, or geocoding. Google may receive searches, selected places, coordinates, IP address, device information, and related usage data under the Google Privacy Policy;
• Sentry, which processes limited technical error and performance data after roads.fyi removes request bodies, credentials, account and contact identifiers, precise location, and query values;
• Umami Cloud, which provides cookieless usage analytics without receiving URL query strings or hashes. We do not use Umami to identify account holders. Report-funnel events use fixed names and do not include account or road identifiers, coordinates, query values, or free-form event data. See the Umami Privacy Policy;
• map and road-data providers, including OpenFreeMap, OpenStreetMap, and Overture Maps, whose resources your browser may request and which may receive standard network and device information;
• hosting, database, network, security, and support providers that process data under our instructions; and
• authorities, advisers, counterparties, or other persons when reasonably necessary for law, safety, fraud prevention, legal claims, financing, reorganization, merger, acquisition, or sale of the Service.

We do not sell personal data or share it for cross-context behavioural advertising. We do not use third-party advertising or cross-site behavioural analytics.

7. Third-party terms

Google Maps and Places use is also subject to the Google Maps/Google Earth Additional Terms and the Google Terms of Service. Other third-party services have their own terms and privacy notices. We encourage you to report them before using the relevant feature.

8. Retention and deletion

• Account data, legal acceptance, and country preference are kept while your account is active and then for only as long as needed for deletion, security, disputes, and legal obligations.
• Road reports and revision history are kept until you delete the report or account, subject to limited legal, security, de-identified, and backup retention. Precise device location is not retained in that history.
• The location-grant cookie expires within 30 days and can be removed earlier by clearing roads.fyi site data in your browser.
• Sessions expire within the configured session period, currently no more than 90 days, or earlier when revoked. Expired records may remain until routine cleanup.
• Verification, abuse-prevention, request, error, and security records are kept only for the period reasonably needed for those purposes or required by law.
• Umami analytics are kept for the period configured in our Umami Cloud account and deleted or aggregated when no longer needed to understand and improve the Service.

Account deletion removes ordinary account and contribution data from the active Service. Some records may remain temporarily in backups or longer where required to establish, exercise, or defend legal claims, comply with law, investigate abuse, or protect the Service. We delete or de-identify data when those reasons end.

9. Security

We use measures designed to protect personal data, including encrypted transport, OTP-based authentication, HTTP-only secure session cookies in production, hashed session tokens, access controls, input validation, and rate limiting. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

10. International processing

We and our providers may process data outside your state, province, or country. Where required, we use lawful transfer mechanisms and safeguards. Local laws in a processing location may differ from those where you live.

11. Your choices and rights

Depending on where you live, you may have rights to access information about processing, obtain a copy, correct data, delete data, withdraw consent, object or restrict processing, port data, nominate another person, seek grievance redressal, and complain to a data-protection authority. Rights may be subject to lawful exceptions.

You can change your country preference, delete individual reports, and delete your account through the Service. To make another request or appeal a response, contact [email protected]. We may need to verify your identity before fulfilling a request.

The Umami tracker respects a supported browser Do Not Track setting. You may also block the tracker without losing access to the Service.

12. Children

Account and reporting features are for people aged 18 and older. We do not knowingly collect personal data from a child for those features. If you believe a child has created an account or submitted personal data, contact us so we can investigate and take appropriate action.

13. Automated decisions

We aggregate reports and calculate road rankings and scores. These outputs are informational and do not produce legal or similarly significant effects about an individual. We do not use personal data for automated decisions that produce such effects.

14. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will update the date above and, where required, provide additional notice or request renewed consent before a material change takes effect.

15. Contact and grievance redressal