Privacy Policy

Effective as of 2026-07-21

This privacy policy applies to the Pooly app for mobile devices, together with any related services operated by the service provider (collectively, the “Application”). Pooly is a carpool coordination tool: it helps people who already know each other share rides to events. This policy describes what information the Application collects, how it is used, and who can see it.

Information We Collect

The Application collects the following information, which you provide directly:

Account information. Your phone number, used to create your account and sign in via a one-time SMS code, and your display name.
Profile and carpool details. Your default pickup location — an address and its map coordinates — the number of seats available in your car, and whether you prefer to drive, ride, or both.
Contacts you select. If you choose to invite people from your address book, only the phone numbers of the contacts you explicitly select are uploaded, and they are used solely to send those people your invitation. No other address book information (names, emails, photos, or any details of unselected contacts) ever leaves your device.
Events and rides. The events you create or join, your attendance and driving availability for each occurrence, ride requests and offers, pickup locations, and the status and timing of your carpools.

The Application also collects some information automatically:

Device information. A push notification token for your device, your device model and operating system version, and your IP address.
Usage analytics. Which screens and features you use, as pseudonymous events tied to internal identifiers. Analytics events never contain addresses, map coordinates, phone numbers, or names.

How We Use Your Information

Your information is used to operate the Application:

matching riders and drivers for events and coordinating pickups;
delivering invitations you send to events and organizations;
sending push notifications about your rides, events, and requests;
showing your carpool history and statistics;
keeping the service secure and preventing abuse; and
understanding aggregate usage so we can improve the Application.

We do not sell your personal information, and we do not use it for advertising or share it with anyone for advertising or marketing purposes.

Information Visible to Other Users

Pooly is a coordination tool, so some of your information is shown to other users — but only ones you have a relationship with:

Your display name and your attendance are visible to members of the events and organizations you join.
When you make yourself available to carpool, eligible carpoolers for that event see only an approximate area for your home location, never your address.
Your exact pickup address is shared only with your matched driver, and only after you request a ride or accept a driver’s offer.
Once a ride is confirmed, you and your matched driver or rider can contact each other (for example by call or text) to coordinate the pickup.

Third Parties

We do not sell your personal information or share it with third parties for their own use. Your information is processed only by service providers acting on our behalf to run the Application, under agreements that limit their use of it to providing their service to us:

Supabase — backend hosting, authentication (including delivery of sign-in SMS codes), and database storage.
Amplitude — pseudonymous usage analytics.
Google — push notification delivery (Firebase Cloud Messaging) and maps, address search, and geocoding (Google Maps Platform).

The service provider may also disclose your information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Cookies and Similar Technologies

The Pooly website uses cookies only to keep you signed in. Where required by applicable law, the service provider will obtain consent before using non-essential tracking technologies.

Your Rights

You may request access to, correction of, or deletion of your personal data held by the service provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the service provider at support@poolyapp.com.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. The service provider does not sell or share personal information as defined by the CCPA/CPRA. To exercise your CCPA/CPRA rights, contact the service provider at support@poolyapp.com.

International Data Transfers

The service provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the service provider will use appropriate mechanisms.

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions or other legally recognized transfer mechanisms
Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the service provider will apply appropriate safeguards and obtain any consent required for the transfer.

Opt-Out Rights

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the service provider.

To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the service provider at support@poolyapp.com.

Data Retention Policy

The service provider retains personal data based on its necessity for the stated purposes:

User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
Data required for legal compliance: Retained as long as required by applicable law

You may request deletion of your personal data, subject to any legal obligation to retain it. If you want the service provider to delete User Provided Data submitted through the Application, please contact them at support@poolyapp.com. Please note that some User Provided Data may be required for the Application to function properly.

Children

The Application is not intended for children under 18 years of age, or such higher age as required by applicable law. The service provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The service provider does not knowingly collect personally identifiable information from children under 13 years of age in violation of applicable law. In the event the service provider discovers that a child has provided personal information, the service provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the service provider with personal information, please contact the service provider (support@poolyapp.com) so that they will be able to take the necessary actions.

Security

The service provider is concerned about safeguarding the confidentiality of your information. The service provider provides physical, electronic, and procedural safeguards to protect information the service provider processes and maintains.

Data Breach Notification

If a data breach occurs that affects your personal data, the service provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The service provider may update this Privacy Policy from time to time. The service provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the service provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the service provider at support@poolyapp.com.

This privacy policy is effective as of 2026-07-21

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the service provider via email at support@poolyapp.com.