Privacy Policy

1. Introduction

Homeward ("we," "our," or "the app") is a ride-share and safety network for college students, launching at Iowa State University. This policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

We collect the data you provide when you create an account and use the app:

• Account information: email address, display name, and phone number
• Profile details (optional): profile photo, dorm/residence, class year, bio, and Instagram/Snapchat handles you choose to add
• Hometown: the city you set as your hometown, including its geocoded coordinates, used to match you with rides and alerts heading that direction
• Location (optional, when granted): your device location, used to find rides near you and to geocode the areas you set ride alerts for. This is only accessed while you're using the app — never in the background
• Ride content: rides you post or request, including pickup/dropoff locations, timing, and trip preferences (e.g. smoking-free, pets allowed, luggage space)
• Messages: the content of messages you send other users to coordinate a ride
• Guardian links: if you connect a parent/guardian to your account (or accept a connection as a guardian), we store that link — see Section 6
• Push notification token: a device token from Apple (APNs, via Firebase Cloud Messaging) used to deliver the notifications you've enabled
• University affiliation: the school your account is associated with

We do not use SMS/OTP for sign-in; accounts are created with an email address and password.

3. How We Use Your Data

• To create and manage your account and connect you to your university's community
• To match you with rides and ride-alerts based on your hometown and search filters
• To let you post, find, and coordinate rides with other students
• To deliver push notifications for ride activity you've opted into
• To support the guardian-link feature described in Section 6

4. Data Storage & Security

Your account and app data (profile, rides, messages, guardian links) are stored using Supabase (PostgreSQL), which enforces row-level security policies so users can only access data they're authorized to see. Push notification delivery is handled by Google Firebase Cloud Messaging. We do not store passwords in plain text — authentication is handled by Supabase Auth, which follows industry-standard security practices.

Face ID / device biometrics: if you enable Face ID to secure the app, that authentication happens entirely on your device through Apple's system frameworks. We never receive or store any biometric data.

5. Data Sharing With Other Users

Homeward is built around coordinating rides with people at your school, so some information is visible to other users by design:

• Your display name, profile photo, and the ride details you post are visible to other students at your university browsing or searching for rides
• If you request or accept a seat on someone's ride, the phone number and social handles on your profile may become visible to that specific driver/rider so you can coordinate
• Messages you send are visible only to the people in that conversation
• If you set a hometown, other users may see a hometown-match tag on rides heading the same direction as you — this does not reveal your exact hometown to them beyond what's already shown on a matched ride

We do not sell your data, and we do not share it with advertisers or data brokers.

6. Guardian Links

Homeward lets a student connect a parent or guardian to their account. A link is only created when both people agree — one side sends a request and the other must accept it.

Once linked, a guardian account can view the student's rides and, depending on how the feature is used, act on the student's behalf (for example, posting or messaging as the student) — similar to how a family member might help manage a shared calendar. A student can end a guardian link at any time, which immediately removes that access.

We treat this as a deliberate, mutual-consent feature for family coordination — not passive monitoring. If you're a student, only link a guardian you actually want to have this level of access.

7. Location Data

Location access is optional and requested only when you use a feature that needs it (finding nearby rides, or setting the geographic area for a ride alert). You can grant "while using the app" access, and you can revoke location permission at any time in your device settings without losing access to the rest of the app — ride search and alerts based on hometown or manually entered locations will still work.

8. Your Rights

• Access your data: your profile, rides, and messages are visible within the app
• Update your data: edit your profile, hometown, and preferences at any time
• Delete your data: contact us to request account deletion, which removes your profile, ride history, and guardian links
• Export your data: contact us to request a copy of your data

9. Children's Privacy

Homeward is intended for current college students and their parents/guardians, not for children under 13. We do not knowingly collect data from children under 13.

10. Analytics & Advertising

We do not run ads, and we do not use your data for advertising or marketing purposes.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date.

12. Contact

If you have questions about this privacy policy or your data, contact us at [email protected].