Privacy Policy

Last updated: 19 August 2026

This Privacy Policy explains how personal information is collected, used, disclosed, and protected in connection with cruu (the "App"), a mobile and web application that lets people share their live location with a group for the duration of a trip or journey.

cruu is operated by Sulaiman Badmus ("we", "us", "our"), based in Ontario, Canada. We are the data controller responsible for your personal information. If you have any questions, contact us at support@cruu.ca.

The short version. cruu collects your email and name to create your account, and your device's location — including while the app is running in the background — so it can be shared with the members of a journey you have joined, for as long as that journey is active. We also use anonymized, aggregated analytics to understand how the app is used, which is never linked to your identity. We do not sell your personal information, and we do not use it for advertising. You can stop sharing your location or leave a journey at any time.

1. Who this policy applies to

This policy applies to everyone who uses cruu. cruu is intended for users aged 16 and over. We do not knowingly collect personal information from anyone under 16. If you believe a person under 16 has provided us personal information, contact us and we will delete it.

2. Information we collect

Information you provide

Account information: your email address and display name, provided when you register.
Journey content: journey ("cruu") names, destination addresses you enter, and the email addresses you use to invite others.

Information collected automatically when you use cruu

Precise location data: your device's GPS location. When you enable location sharing for a journey, cruu collects your location while the app is open and while it is running in the background or the screen is off, so that other members of that journey can see your position on a live map and estimated time of arrival. Location sharing runs only while a journey you have joined is active and only while you have location sharing turned on.
Notification token: a push-notification identifier so we can send you journey-related alerts (for example, an invitation or an arrival notification).
Anonymized usage analytics: aggregated, non-identifying data about how the app is used (for example, how many people join a journey), collected via Google Firebase Analytics. This data is not linked to your name, email, or account, and is never used for advertising or cross-app tracking.

Information we do not collect

We do not store your password. Sign-in and password handling are managed securely by Google Firebase Authentication; we never see your password.
We do not use advertising identifiers or behavioural, cross-app tracking.
We do not keep a historical log of your past locations. Only your most recent location during an active journey is stored, and it is overwritten as you move.

3. How we use your information

Purpose	Information used
Create and manage your account	Email, name
Share your live location and ETA with members of a journey you have joined	Precise location
Send invitations and journey notifications	Email, notification token
Provide maps, address search, and routing	Destination address, location
Keep the service secure and prevent misuse	Account identifiers
Understand app usage and improve cruu	Anonymized usage events

We rely on your consent to collect and share your location, which you give by turning location sharing on and which you can withdraw at any time by turning it off, leaving the journey, or revoking the permission in your device settings. We otherwise process your information as necessary to provide the service you have asked for.

4. How your information is shared

With other users

When you join a journey and enable location sharing, your display name and live location are visible to the other members of that specific journey for as long as it is active. Your location is not visible to anyone outside that journey.

With service providers

We use trusted third parties to operate cruu. They process personal information only on our behalf and only to provide their service:

Provider	Purpose
Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging, Hosting, Analytics)	Accounts, data storage, backend, push notifications, web hosting, anonymized usage analytics
Google Maps Platform	Map display, address search, and route calculation
Resend	Sending invitation and notification emails
Cloudflare	Domain, network security, and email routing

We do not sell your personal information, and we do not share it for advertising or for any purpose that would facilitate its sale.

For legal reasons

We may disclose information if required by law, or to protect the rights, safety, or property of our users or others.

5. International transfers

Our service providers may store and process your information on servers located outside your province or country, including in the United States. Where information is transferred outside Canada, it may be subject to the laws of the country where it is held. We take steps to ensure your information receives a comparable level of protection through our agreements with these providers.

6. How long we keep your information

Account information is kept while your account is active and until you ask us to delete it.
Journey data (names, destinations, membership) is kept until you or the journey's creator delete the journey, or you delete your account. If you delete your account, any journeys you created are also deleted and their members removed.
Location data is transient — only your latest position during an active journey is stored, and it is overwritten as you move. It is not retained as a history.
We aim to remove journeys that have been inactive for an extended period, and will honour any deletion request you make.

7. Your rights and choices

Depending on where you live, you may have rights under laws such as Canada's PIPEDA, the EU/UK GDPR, or the California CCPA. These include the right to:

Access the personal information we hold about you;
Correct information that is inaccurate;
Delete your account and associated personal information, either directly in the app (Profile → Delete Account) or by contacting us;
Withdraw consent to location collection at any time; and
Complain to us or to a privacy regulator.

To exercise any of these rights, email support@cruu.ca. We will respond within a reasonable time, and within 30 days where required by law. You can control location and notification permissions at any time in your device settings, and you can stop sharing or leave a journey directly in the app.

8. How we protect your information

Your information is stored on Google Firebase infrastructure and protected in transit and at rest using industry-standard encryption. Access to journey data is restricted so that only members of a journey can view its contents. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information and to notify you and the appropriate authorities of a breach where required by law.

9. Children's privacy

cruu is not directed to children under 16 and we do not knowingly collect their personal information. If you are a parent or guardian and believe your child has used cruu, contact us at support@cruu.ca and we will delete the information.

10. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above and, where the change is significant, provide notice in the app. Your continued use of cruu after an update means you accept the revised policy.

11. Contact us

For any privacy question, request, or complaint, contact:

Sulaiman Badmus
Ontario, Canada
support@cruu.ca

If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.