Privacy Policy

1. Who we are and what this covers

Lineup Labs (OPC) Private Limited operates roads.fyi and is responsible for the personal data described in this Privacy Policy ("Policy"). This Policy covers the roads.fyi website, accounts, maps, road reports, and related services (the "Service").

2. Personal data we collect

2.1 Account and verification data

• your verified mobile number;
• mobile-verification request records and verification time;
• your account identifier, creation time, last-login time, and country preference;
• session identifiers, expiry, and revocation status; and
• the date and versions of the Terms and Policy you accepted.

2.2 Road reports and location data

• the road you select, your rating, condition tags, and report history;
• precise latitude, longitude, and reported device accuracy when you submit a report;
• the time of submission and technical road-source identifiers; and
• tag suggestions, site feedback, or other content you intentionally submit.

We use report location to check that you are near the selected road. Do not submit a report from a location you do not want associated with your account in our internal records.

2.3 Browser and technical data

• an essential HTTP-only session cookie named for roads.fyi, used to keep you signed in;
• your selected country stored in your browser's local storage so the Service can preserve that preference;
• IP address and a one-way derived rate-limit value used to prevent OTP abuse;
• standard request, browser, device, error, and security information that our servers and service providers may process when you use the Service; and
• searches, selected places, map viewport, and coordinates you choose to send to map or place-search features.

3. How we use personal data

We use personal data to:

• verify mobile numbers, create accounts, and maintain sessions;
• save country preferences and show relevant road information;
• validate, publish, aggregate, rank, update, and delete road reports;
• prevent duplicate ratings, fraud, abuse, and unauthorized access;
• operate, secure, troubleshoot, and improve the Service;
• enforce our Terms and respond to support, rights, and legal requests; and
• comply with law and protect users, the public, and our rights.

4. What other people can see

Road ratings, tags, counts, rankings, report times, road locations, and related aggregated or public report information may be visible to anyone. Your mobile number, precise submitted device location, session data, and account identifier are not intentionally displayed publicly.

Public or aggregated information can be copied, cached, or shared by others. Removing a report or account may not remove copies already made by third parties or de-identified information that no longer identifies you.

5. Legal bases and consent

Depending on applicable law, we process personal data with your consent, to provide the Service you request, to comply with legal duties, and for legitimate interests such as security, fraud prevention, service integrity, and legal claims where those interests are not overridden by your rights.

At account creation, you actively accept this Policy and our Terms. We record the acceptance time and policy versions. Where processing depends on consent, you may withdraw it by deleting your account or contacting us. Withdrawal does not affect earlier lawful processing and may make account features unavailable.

6. Service providers and data sharing

We share data only as needed with:

• MSG91, which sends and verifies mobile OTPs and processes your mobile number and verification data;
• Google Maps Platform and Places, when you use place search, autocomplete, or geocoding. Google may receive searches, selected places, coordinates, IP address, device information, and related usage data under the Google Privacy Policy;
• Sentry, which processes limited technical error and performance data after roads.fyi removes request bodies, credentials, account and contact identifiers, precise location, and query values;
• map and road-data providers, including OpenFreeMap, OpenStreetMap, and Overture Maps, whose resources your browser may request and which may receive standard network and device information;
• hosting, database, network, security, and support providers that process data under our instructions; and
• authorities, advisers, counterparties, or other persons when reasonably necessary for law, safety, fraud prevention, legal claims, financing, reorganization, merger, acquisition, or sale of the Service.

We do not sell personal data or share it for cross-context behavioural advertising. We do not currently use third-party advertising or analytics services.

7. Third-party terms

Google Maps and Places use is also subject to the Google Maps/Google Earth Additional Terms and the Google Terms of Service. Other third-party services have their own terms and privacy notices. We encourage you to report them before using the relevant feature.

8. Retention and deletion

• Account data, legal acceptance, and country preference are kept while your account is active and then for only as long as needed for deletion, security, disputes, and legal obligations.
• Road reports and their precise submission evidence are kept until you delete the report or account, subject to limited legal, security, de-identified, and backup retention.
• Sessions expire within the configured session period, currently no more than 90 days, or earlier when revoked. Expired records may remain until routine cleanup.
• Verification, abuse-prevention, request, error, and security records are kept only for the period reasonably needed for those purposes or required by law.

Account deletion removes ordinary account and contribution data from the active Service. Some records may remain temporarily in backups or longer where required to establish, exercise, or defend legal claims, comply with law, investigate abuse, or protect the Service. We delete or de-identify data when those reasons end.

9. Security

We use measures designed to protect personal data, including encrypted transport, OTP-based authentication, HTTP-only secure session cookies in production, hashed session tokens, access controls, input validation, and rate limiting. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

10. International processing

We and our providers may process data outside your state, province, or country. Where required, we use lawful transfer mechanisms and safeguards. Local laws in a processing location may differ from those where you live.

11. Your choices and rights

Depending on where you live, you may have rights to access information about processing, obtain a copy, correct data, delete data, withdraw consent, object or restrict processing, port data, nominate another person, seek grievance redressal, and complain to a data-protection authority. Rights may be subject to lawful exceptions.

You can change your country preference, delete individual reports, and delete your account through the Service. To make another request or appeal a response, contact support@roads.fyi. We may need to verify your identity before fulfilling a request.

12. Children

Account and reporting features are for people aged 18 and older. We do not knowingly collect personal data from a child for those features. If you believe a child has created an account or submitted personal data, contact us so we can investigate and take appropriate action.

13. Automated decisions

We aggregate reports and calculate road rankings and scores. These outputs are informational and do not produce legal or similarly significant effects about an individual. We do not use personal data for automated decisions that produce such effects.

14. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will update the date above and, where required, provide additional notice or request renewed consent before a material change takes effect.

15. Contact and grievance redressal