Skip to content
Bosta
Legal

Privacy Policy

Last updated: August 2026

This policy covers the Bosta rider app, the Bosta Driver app, and this website. It explains what we collect, why, and how you're in control of it — in plain language, matching what the apps actually do.

Information we collect

  • Account details — your name, phone number or email, and a securely hashed password. Never your plaintext password.
  • National ID — collected during booking to verify who's traveling and to prevent duplicate or fraudulent bookings. It's encrypted at rest and only used for identity verification, seat check-in, and — for a co-passenger listed on someone else's booking — confirming that person is really you.
  • Trip and booking data — routes, seats, schedules, parcel details, cancellations, and check-in status.
  • Wallet and payment data — your wallet balance and transaction history. Manual top-ups made through local payment rails are confirmed by an admin; we never see or store your card number for card payments, which are handled directly by our payment processor.
  • Location (Driver app only) — while you're on an active trip, the Driver app uses your precise location, including in the background, to navigate routes and keep trip status current for riders and dispatch. The rider app only ever requests your location in the foreground, to show nearby stops on the map — never in the background.
  • Camera (Driver app only) — used to scan passenger and parcel QR codes at check-in. Frames are decoded on your device and are not stored or uploaded.
  • Device and diagnostic data — crash reports and basic usage analytics (via Firebase), so we can find and fix problems and understand which features are actually used.
  • Push notification identifiers — used to deliver trip, wallet, and booking alerts (OneSignal for the rider app, Firebase Cloud Messaging for the Driver app).

How we use it

  • To create and manage your bookings, wallet, and account.
  • To verify identity for check-in and for the limited cases where a co-passenger can view a shared booking.
  • To route drivers, keep trip status accurate, and get parcels where they're going.
  • To send the notifications you'd actually want — booking confirmations, check-in status, wallet activity.
  • To find and fix bugs, and to understand overall usage patterns — never to build an advertising profile of you.
  • We do not sell your personal data, to anyone, ever.

Who we share it with

  • The bus or parcel operator you book with — only the booking details they need to run your trip (name, seat, route, contact info if you provide it).
  • Our payment processor, for card payments — they handle your card details directly; we don't.
  • Infrastructure and analytics providers we rely on to run the apps: Firebase/Google (crash reporting, analytics, push, maps) and OneSignal (rider push notifications). These are service providers, not advertisers — they don't get to use your data for their own purposes.
  • We may disclose information if required by law, or to protect the safety of riders, drivers, or the public.

How long we keep it

  • We keep your account and booking data for as long as your account is active, and afterward for as long as reasonably needed for bookkeeping, dispute resolution, or legal record-keeping.
  • National ID and financial transaction records may be retained past account deletion where record-keeping obligations require it, even if you've asked us to delete your account.

Your choices

  • You can review and update most of your account details directly in the app.
  • You can request a copy of your data, a correction, or deletion of your account by emailing us (below). We'll respond as quickly as we can, and explain if any part of your data needs to be retained for the reasons described above.
  • You can control notification permissions and location/camera access at any time through your device's app settings — the apps degrade gracefully if you turn them off, though some features (like live trip navigation) won't work without location access.

Children

  • The rider app isn't directed at children. The Driver app is for registered, verified drivers and operators only — access requires an account issued by a bus operator, not a general signup.

Security

  • Sensitive fields like national ID are encrypted at rest. All traffic between the apps and our servers is encrypted in transit (HTTPS). Access to personal data is restricted to what's needed to operate the platform.
  • No system is perfectly secure, but we treat anything that touches this policy — credentials, keys, personal data — as something to actively protect, not an afterthought.

Changes to this policy

  • If we make a material change to how we handle your data, we'll update the date at the top of this page and, where appropriate, let you know in the app.

Questions?

Reach us any time about this policy, or to make a data request:

info@busta.sy