Privacy policy

This policy explains what personal data Trakty collects when you use the Trakty app and this website, why, who receives it, how long we keep it, and what rights you have. It follows North Macedonia's Law on Personal Data Protection (Official Gazette 42/2020 and its amendments) and the EU's General Data Protection Regulation (GDPR), which that law is based on.

Who is responsible

The controller, the one who decides how your data is used, is Valdrin Muharemi, Shipkovica, Ul. 101 br. BB, 1200 Tetovo, North Macedonia. For anything about your data, write to [email protected]. We have not appointed a data protection officer; that address reaches the person responsible.

What we collect, why, and on what basis

The law lets us use personal data only for a stated reason and on a legal basis. Ours are: to provide the service you signed up for (a contract), our legitimate interest in keeping Trakty secure and working, and your consent where we ask for it.

• Your account: your email address, your password, which we store only as a scrambled hash nobody can read back, your role (rider, driver, or company), and when you signed up. If you sign in with Google or Apple, we store the account id they give us, never your password there; for Apple, also a token that lets us revoke Trakty's access when you delete your account. Basis: contract. Without an email address you can't have an account.
• Rides you request: the pickup point and address, when you want to be picked up, which taxi company, which driver took the ride, and the time of each step (accepted, picked up, finished, cancelled). Basis: contract.
• Your position, as a rider: while the map is open, the app sends your position to find the free taxis near you. We use it for that answer only and don't store it; only a pickup point you choose is saved, with the ride. The app asks for your permission to use location first. Basis: consent, which you can withdraw in your phone's settings.
• Drivers: if you drive for a taxi company on Trakty, your company adds your name and car plate. While you are online, the app sends your position and whether you are free, so riders see free taxis and rides reach the nearest driver. We keep only your latest position, and delete it when you go offline. We also record which rides you were offered and declined. Basis: contract (the service your company uses Trakty for).
• Notification token: an id for your phone (and whether it is Android or iPhone), so we can tell you about your rides. It is removed when you sign out. Your phone asks for permission first. Basis: consent.
• Car plates you save to your account. Basis: contract.
• Feedback you send us. Basis: legitimate interest in improving Trakty.
• Sign-in and security records: scrambled sign-in tokens that expire after 60 days, and password-reset links that expire after one hour. Our servers also keep short technical logs of each request (time, address called, result, and the app or browser type) to find faults and abuse. Basis: legitimate interest in security.
• Companies' listings: bus lines, stops, travel offers and photos that bus companies and travel agencies publish. These are about the business, not about you, unless a company puts a person in a photo.

We don't sell your data and don't use it for advertising. This website sets no cookies and has no trackers, and the app uses no analytics or advertising trackers.

Decisions made automatically

When no driver accepts a ride within 30 seconds, Trakty offers it automatically to the nearest free driver, then the next nearest, and finally to the nearest free driver of another taxi company. This only decides who is offered a ride; it has no legal or similarly significant effect on you, and a driver can always decline.

Who sees your data

• Taxi companies and their drivers. Free drivers near your pickup point see the pickup point and time so one of them can take the ride. If none of the chosen company's drivers takes it, a driver of another company may get it, and the ride moves to that company. The company that has the ride, and its drivers, also see your email address with it. They use it to carry out your ride and keep it in their own records, for which they are responsible themselves.
• Riders. The map shows a free taxi's company and position only. While a driver carries out your ride, you see their name, car plate and position, until the ride ends.
• Service providers that process data for us, under contracts that require them to protect it and use it only for us:
  • Cloudflare (USA) carries all traffic to our servers and this website and protects them from attacks, so it sees your IP address. It also stores the photos companies publish (img.trakty.app).
  • Google Firebase Cloud Messaging (USA), and for iPhones Apple's push service (USA), deliver our notifications. They receive the notification and your phone's token.
  • Proton (Switzerland) sends our emails, such as password-reset links, and stores our encrypted nightly backups.
• Google and Apple for sign-in, only if you choose to sign in with them. Their own privacy policies apply to what they do.
• Authorities, only where the law requires us to share data.

Where your data is

Our servers and database are in North Macedonia. The providers above process some data in the USA and Switzerland. We transfer data there only as the Law on Personal Data Protection allows: to countries the law treats as providing adequate protection or with prior notification to the Personal Data Protection Agency, and under the providers' data processing terms, with the European Commission's standard contractual clauses where they are needed. You can ask us for a copy of these safeguards.

How long we keep it

• Your account and what belongs to it stay until you delete your account.
• A driver's position: only the latest one, deleted when the driver goes offline.
• Sign-in tokens: 60 days at most. Password-reset links: one hour. Notification tokens: until you sign out.
• Server logs: kept up to a fixed size (30 MB) and then overwritten by new ones.
• Backups: 14 days.

When you delete your account, your account, car plates, notification tokens and sign-ins are deleted. Rides you took stay in the taxi company's records without their pickup points and no longer tied to you, and so does feedback you sent. If you own a taxi company on Trakty, the company is removed too, and its drivers leave the map. Deleted data disappears from our backups within two weeks.

How we protect it

All traffic is encrypted (HTTPS). Passwords, sign-in tokens and reset links are stored only as hashes. Our servers are reachable only through Cloudflare, backups are encrypted, and each person in Trakty sees only what their role needs. If a breach puts your rights at high risk, we will tell you and the Personal Data Protection Agency without delay.

Your rights

You can ask us:

• what data we hold about you, and for a copy of it (access);
• to correct it (rectification);
• to delete it (erasure); you can also delete your account yourself in the app or on trakty.app/delete-account;
• to limit how we use it while a question is open (restriction);
• for your data in a common machine-readable format, to take it elsewhere (portability);
• to stop using it where we rely on legitimate interest (objection).

Where we rely on your consent, you can withdraw it at any time, for example by turning off location or notifications for Trakty in your phone's settings; this doesn't affect what we did before. Email [email protected] from the address you signed up with. We answer within one month, and it costs nothing.

You can also complain to the supervisory authority: the Personal Data Protection Agency (Агенција за заштита на личните податоци), Blvd. Goce Delčev 18, 1000 Skopje, azlp.mk, [email protected].

Children

Trakty is not meant for anyone under 16, and you must be at least 16 to create an account. If we learn that a child under 16 has an account, we delete it.

Changes

If we change this policy, we update the date above. For important changes, we tell you in the app before they apply.