OnRoute India is built to help daily metro commuters connect with people who share their route and travel timing, and (via the optional Connect feature) with people who share their college, company, or other group.
What we collect at signup
- Your phone number, verified through OTP (via Firebase Authentication). It is never shown to other users.
- Your email address and date of birth (used to confirm you are 18 or older).
- If you sign up with Google, the name associated with your Google account is captured for our internal records. This real name is never shown to other users and is not returned in any profile data.
- Your age, gender, and the gender you are interested in, so we can show you relevant matches.
- Your boarding station, destination station, and usual travel timing, so we can match you with commuters on your route.
- Your chosen display name and any profile photos you upload — these are shown to your matches.
Chat messages and media
- Messages you send within the app are stored so conversations can be delivered and kept in your chat history.
- Photos, videos, and voice notes you share in chat are uploaded to our cloud storage (Cloudinary) temporarily. Once the recipient's device confirms it has downloaded the file, we delete it from Cloudinary. "Self-destructing" media is deleted from Cloudinary as soon as the recipient opens it. In both cases, a reference to the file (its web address) can remain in our database even after the underlying file is deleted.
Connect: college and company verification
- Connect lets you find other users affiliated with the same college, company, or group ("pool"). There are two ways to verify: (A) submit a photo of your college/company ID card, choose your institution, and take a live selfie, or (B) if you don't have such an ID, take a live selfie only. We do not collect an ID number or email address from the ID card itself — only the photo.
- The selfie step asks you to make a simple hand gesture, which is detected on your device (not on our servers) to confirm you're a live person, not a photo of a photo. Only your final captured selfie photo is uploaded — the camera preview frames used for gesture detection are never sent to us.
- Every verification submission (both the ID card photo and the selfie) is reviewed manually by a member of our team. We do not use automatic face-matching or text-recognition (OCR) software to approve or reject submissions. Manual review can make mistakes — see "Your rights" below for how to ask for a re-check.
- These photos are stored privately, not in public storage. Only members of our admin team can view them, when reviewing your submission; they are not shown to other users, including your matches or Connect pool members.
- Once an admin approves or rejects your submission, the photos are deleted and the saved links to them are cleared.
- If a submission stays unreviewed for too long, it is deleted automatically, and you can resubmit.
- We also keep a one-way photo fingerprint (a hash) of each submitted photo, even after the photo itself is deleted, to help detect the same photo being reused across different accounts or fake accounts. This fingerprint cannot be used to recreate or view the photo.
- If your verification is rejected, we keep the rejection reason so you know what to fix, and you can resubmit after a short cooldown.
Connect: search, pools, and what other users can see
- Without Connect access (no Premium and no Campus-Pass), you only see a limited preview: a display name, gender, a partially masked institution name (for example "*****rat University"), and a placeholder instead of a real photo. This preview does not show age, bio, a real photo, or a verified badge, and — during periods with few real users on the app — some preview profiles shown to you may be example profiles, not real accounts.
- With Connect access (Premium, or a "Campus-Pass" grant — which can come from an approved college ID verification or from a promotional coupon), you can search any active college or company pool, including ones you are not personally a member of, and see the display name, age, gender, bio, profile photo (if that user has chosen to show a photo on their card), and verified badge of other members, plus the pool's institution name in full (unmasked). There are daily limits on how many different pools you can search, and extra searches beyond the free daily amount can be unlocked by watching a rewarded ad or by having Premium.
- If you verify with a college/company ID (path A), any Connect-access user who searches your institution can find your profile as described above.
- If you verify with a selfie only (path B), you can additionally join up to 5 pools yourself, without any admin approval or check against institution records, and change your chosen pools once every 30 days. You then appear in those pools' search results with the same verified badge as anyone else — for a selfie-only user, this badge confirms we manually reviewed a live selfie, not that you belong to that particular institution.
- Other users never see your submitted ID card image or selfie image — only your display name, chosen photo, and badge as described above.
Sections: OnRoute Social and OnRoute Cupid
- One OnRoute account has two sections — OnRoute Social and OnRoute Cupid (dating). Some daily limits and Premium benefits are shared across both sections. You can hide yourself from either section at any time from Settings.
Location and OffRoute
- OffRoute is an optional matching mode inside OnRoute Social and OnRoute Cupid that shows you people near you, not just people on your metro route. It's available to all users — we ask for location permission only the first time you open the OffRoute tab. OffRoute shows people within roughly 20 km.
- We only read your device's location when you open the OffRoute tab — never at signup, never in the background, and never while you're using any other part of the app.
- Your exact coordinates are sent to our server only for that one moment, are used only to compute a coarse map grid area (roughly a few kilometers wide) that your device falls into, and are never saved or logged. We only store that coarse grid area, not your exact location.
- Other OffRoute users can see that you're active nearby, but never your distance, direction, or exact location. Your presence on OffRoute is visible to others for up to 6 hours after you last opened the tab; after that, your presence and the coarse grid area we stored for you are automatically deleted.
- When you like or match with someone through OffRoute, we record that it came from OffRoute, but not where either of you were.
- You can hide yourself from OffRoute at any time from Settings, separately for the OffRoute tab in Social and the OffRoute tab in Cupid. Hiding yourself from a whole section also hides you from its OffRoute tab.
Instant: live, no-signup route matching
- Instant lets you see and chat with other nearby commuters on the same metro route, right now, without creating an account — reachable from the app's pre-login screen and from our website. Anyone, including people who have never signed up, can turn Instant on. If you haven't turned Instant on, no other Instant user can see you.
- An Instant session lasts 40 minutes. You can end it yourself at any time before that, and turn it back on again immediately afterward, as many times as you like — there's no cooldown.
- If you use Instant without an existing OnRoute account ("as a guest"), we give your device a temporary, anonymous identity (via Firebase Anonymous Authentication) instead of a phone number. This identity is not linked to your name, phone number, or email unless you later choose to create a full account (see below).
- To turn Instant on as a guest, you provide a nickname, a preset avatar chosen from a fixed set (no photo upload), your city, the boarding/destination station you're travelling between right now, and your date of birth. We never ask Instant guests for a real name, phone number, or ID. If you already have a verified OnRoute account, you skip all of this — we use your account's existing city, and you only provide the boarding/destination station.
- Date of birth is collected from guests only, used only to confirm you are 18 or older, and is never shown to anyone, including other Instant users. If it indicates you are under 18, we do not create an Instant session, and we block that device and identity from using Instant again. If you already have an OnRoute account, you skip this step — your date of birth was already checked when you signed up.
- We also read a device identifier your app generates and your IP address, used to help enforce rate limits and recognize a device after it's been blocked. A block tied to your OnRoute account persists across logins, reinstalls, and different devices. A block tied only to a guest device identifier or IP address is a best-effort deterrent, not a guarantee — a guest's device identifier is generated by the app itself and can change if the app is reinstalled.
- By default, every Instant user — guest or signed in — appears to others only as a nickname and a preset avatar, never a real name or photo. If you're signed in, this nickname/avatar pair is generated once and stays the same across every Instant session until you choose to regenerate it ("reroll"); guests choose a new nickname and avatar each time they turn Instant on. If you're signed in, you can also choose to reveal your real name and photo for the current session only — this always resets to off the next time you turn Instant on. Guests never have a real name or photo in the system to reveal.
- While Instant is on, other Instant users whose route overlaps yours can see your nickname/avatar (or your real name/photo, only if you've turned reveal on) and how many stations you have in common with them — never your exact boarding or destination station, never your exact time, and never your phone number or location.
- Instant chat lets you send real text messages from the start — it is not limited to presets. If you haven't verified a phone number (true for every guest, and for a signed-in user who hasn't linked one), your messages are limited to 80 characters and 20 messages per chat, and cannot contain digits, links, email addresses, or @handles, so a stranger can't use Instant chat to move the conversation off-platform before you know who you're talking to. A set of preset quick messages (for example "Hi", "Same route every day?") is always available too, and counts toward the same 20-message limit. Once you've verified a phone number, these limits lift for your own messages — they still apply to the other person if they remain unverified.
- Every message — preset or free text — passes through automated moderation before it's delivered: phone numbers, email addresses, and links are masked out, and the message is screened for sexual content, grooming behaviour, age-probing, and attempts to move the conversation off-platform or arrange to meet in person, using both an automated keyword/pattern check and a third-party moderation service (OpenAI's moderation API). Messages that fail this check are never delivered or stored, and the sender sees a generic notice that the message wasn't allowed.
- You can report or block another user from inside any Instant chat. A block or report is tied to that person's account and device, never to the nickname they're using — if they regenerate their nickname afterward, that does not make them visible again to someone who has blocked them, and an open report still resolves to the same account. You cannot regenerate your own nickname while you're in an active Instant chat.
- If a user receives reports from 3 different people, or has 3 of their own messages blocked by the automated safety check (with 2 blocked messages inside a single chat ending that conversation immediately), they are automatically and permanently blocked from using Instant again.
- Reporting another Instant user as appearing to be under 18, or for sexual content involving a minor, is handled differently from every other report reason: a single report is enough. We suspend the reported person from Instant immediately, end their current session and any chats they're in right away, and a member of our team reviews the case. If confirmed, we permanently delete their OnRoute account and its data (if they had one), keep them permanently blocked from Instant, and — for confirmed child sexual abuse or exploitation — report the case to the appropriate authorities. If the review finds the report unfounded, we lift the suspension (unless another such report against the same person is still pending). We preserve that chat's messages separately as part of this review in every case, regardless of outcome, exempt from the usual immediate chat deletion and from the 12-month limit described below.
- Your Instant chats are deleted the moment either person's session ends — whether it expired after 40 minutes, that person turned Instant off early, or they closed or reinstalled the app — there is no multi-hour retention window, and we don't wait for both sides to finish, except as described above for a chat under review for a child-safety report.
- If you report another user, or one of your messages is blocked by our automated safety check, we keep a record of that — who reported or was reported, or which account triggered a block, and why — separately from the chat itself, for up to 12 months, for moderation and safety purposes, even after the Instant session and chat it relates to have been deleted. We do not keep the text of a blocked message, except as described above for a child-safety report, where we preserve the relevant chat messages indefinitely as part of that review.
- We show ads in Instant too, including to guests — see "Advertising" below. Premium users do not see ads anywhere in Instant.
- You can convert your anonymous Instant session into a full OnRoute account at any time by adding a phone number ("Save my chats — create account"). Doing so does not delete or restart your current Instant session or chat — your anonymous identity simply becomes attached to your new account. Any existing block on that identity or device is not removed by creating an account.
Notifications
- We send push notifications (for example, about new matches or messages) using Firebase Cloud Messaging, which requires your device to have a notification token registered with Google's service.
Advertising
- We show ads (rewarded, banner, native, and interstitial ad formats) through Google AdMob, including within Instant — banner ads on the matches and chat screens, and full-screen interstitial ads before your matches load and when your Instant session ends — shown to guests and signed-in users alike. Google may use your device's advertising ID to select and measure ads. Premium users are not shown ads anywhere in the app, including Instant.
Payments
- Paid unlocks and Premium subscriptions on Android are processed through Google Play Billing. We do not collect or store your card or payment details ourselves.
Other services that process your data
- Firebase Authentication (Google) — phone number verification (OTP) and sign-in.
- Firebase Cloud Messaging (Google) — push notifications.
- Firebase Crashlytics (Google) — crash and error reports to help us fix bugs; these can include technical details about what the app was doing when it crashed.
- Google AdMob (Google) — shows ads and uses your advertising ID, as described above.
- OpenAI — automated moderation (via OpenAI's moderation API) of Instant chat messages before delivery, to help detect abusive, grooming-related, or sexual content.
- Cloudinary — stores profile photos, verification photos, and chat/community media.
- Our database provider (MongoDB) — stores your account and profile data.
- Render — hosts our backend server.
- Google Play Billing — processes in-app payments.
What we do not do
- We do not track your location in the background, and we never show your exact location, distance, or coordinates to anyone. If you use OffRoute (see above), we read your device's location only while the app is open and only when you open the OffRoute tab.
- We do not access your photos, contacts, or other apps in the background. When you choose to upload a profile photo, a verification photo, or share media in chat, the app only accesses the specific file you select at that moment — nothing else.
- We do not share your registered phone number with other users at any point.
- We do not show your ID card or selfie verification photos to other users, including your matches or Connect pool members.
- Instant does not require creating an account, and we do not ask Instant guests for a real name, phone number, or ID.
How your identity stays anonymous
- Your registered real name and phone number are not shown to other users. Your chosen display name (for example, Rider_P73) and photos are shown to matches and, in Connect, to other pool members as described above — choose wisely. Avoid sharing identifiable info in chat to stay anonymous.
How we use your data
- To show you relevant matches based on route and timing overlap.
- To show you OffRoute matches based on approximate proximity, for users who open the OffRoute tab.
- To show you other users within a shared Connect pool, and to show your profile to them under the same conditions.
- To enable chat between matched users.
- To manually review Connect verification submissions and confirm institution affiliation.
- To detect and prevent abuse, spam, fake accounts, and duplicate verification submissions (including the photo fingerprint described above).
- To show Instant users other Instant users whose route overlaps theirs, to apply the rate limits and blocks that keep Instant safe, and to automatically screen Instant messages — including via a third-party moderation service — before they're delivered.
Data retention and account deletion
- You can delete your account at any time from Settings, or by visiting our account deletion page. This is a soft delete: it clears your display name, phone number, email, username, and profile photos.
- Account deletion also deletes any ID card and selfie photos you submitted for Connect verification, and clears your verification status, institution, and pool memberships.
- We keep the one-way photo fingerprint (hash) described above even after account deletion, to keep detecting duplicate or fake accounts. If you have any questions about your data, email us at onroute.support@gmail.com.
- Instant data (your temporary session, and any chat) is not a persistent account. A chat is deleted the moment either side's Instant session ends — whether it expired after 40 minutes or was turned off early — there is no multi-hour retention window, except for the messages of a chat under review for a report that a user appears to be under 18 or involves sexual content involving a minor, which we preserve separately and indefinitely for review (see "Instant" above). Reports and automated-safety-check records related to Instant are otherwise kept separately for up to 12 months, as described above. A block placed on your device, identity, or account for misusing Instant is kept to prevent re-abuse even after your Instant session ends, and is not removed by later creating a full account.
Children
- OnRoute India is restricted to users aged 18 and older. We check date of birth at signup and reject signups from anyone under 18. See also our Child Safety Standards.
- Instant guests confirm their date of birth before turning Instant on, and are blocked from Instant if it indicates they are under 18. Logged-in users rely on the date of birth already checked at signup instead of re-entering it. Anyone who hasn't verified a phone number — including every guest — is limited to short, restricted messages specifically to reduce the risk of a stranger moving a conversation off-platform before either side knows who they're talking to (see "Instant" above). If you report another Instant user as appearing to be under 18, or for sexual content involving a minor, we suspend them from Instant immediately on that single report and review the case; if confirmed, we permanently delete their account and data, if they had one, and report confirmed child sexual abuse or exploitation to the appropriate authorities.
Your rights
- You can leave a Connect pool, or choose not to submit verification, at any time.
- You can block or report any user you interact with.
- You can ask us to re-check a verification decision you believe is wrong, by emailing onroute.support@gmail.com.
- You can request a copy of your data or ask us to delete specific data (such as verification photos) by emailing onroute.support@gmail.com.
Grievance Officer
[GRIEVANCE OFFICER NAME AND EMAIL, TO BE FILLED BY OWNER]
Changes to this policy
We may update this Privacy Policy from time to time. Continued use of the app after changes means you accept the updated policy.
Contact
If you have questions about this policy, email us at onroute.support@gmail.com, or visit our contact page.