RailRobin is in a private pilot. We are finalising these terms with our legal advisers before the public launch; we will tell you in the app before any material change. Items highlighted like this are still being confirmed.
Who we are
[Company legal name], [registered address] (“RailRobin”, “we”, “us”) is the Data Fiduciary for personal data processed through the RailRobin app, its “follow my trip” pages and this website.
- Contact: support@railrobin.in
- Grievance Officer: [Name], [email], [phone], [postal address]
This policy is written for India's Digital Personal Data Protection Act 2023 (“DPDP Act”) and the DPDP Rules 2025.
The short version
- Your location is checked once when you check in at a station. It is never tracked during your ride.
- We don't sell personal data or use it for third-party advertising. Sponsored content is chosen by city and date, not by profiling you, and is always labelled.
- Robin's questions are not stored unless you turn on “Save my Robin chats”. Personal details are removed before a question reaches the AI model.
- We don't access your contacts, photos or microphone, or your location in the background.
- Our servers and database are in Bengaluru, India. Some providers process data elsewhere; they are listed below.
What we collect, why, and for how long
| Data | Why | Basis | Kept for |
|---|---|---|---|
| Mobile number | Sign-in with a one-time code; one account per person; fraud prevention | Consent at sign-up | While the account exists, plus [30] days |
| One-time codes, sign-in tokens | Keeping your account secure | Consent | Stored only as keyed hashes. Codes last 5 minutes; refresh tokens 30 days |
| RailRobin ID (@handle), display name | Shown to group members and in social features | Consent | While the account exists |
| Birthday (day and month, optional) | Birthday bonus | Consent | While the account exists |
| Location at check-in (one GPS reading) | Confirming you are at a station before crediting coins | Consent (the phone's location permission) | One point per check-in, never a trail; [retention period] |
| Location for “nearby” features | Finding stations, exits and offers near you | Consent (location permission) | Not stored or logged. Only compared with station positions |
| Rides, coins and vouchers | Running the rewards programme; resolving disputes; preventing fraud | Consent; legal obligation for accounting records | While the account exists; ledger records for [8] years |
| Game answers and scores | Quizzes; not repeating questions; daily caps | Consent | [90 days] for question history |
| Groups and secret gift swaps | Social features you choose to use | Consent | Until you leave or the group is deleted |
| Shared trip links | Showing your trip's progress (stations and arrival time, not your location) to people you send the link to | Consent, each time you share | Deleted a day after the trip ends |
| Crowd reports | Showing how busy stations are | Consent | Stored with a keyed hash instead of your id; deleted after 24 hours |
| Questions to Robin | Answering your question; for a follow-up, the last few messages of the same chat are sent too | Consent | Not stored, unless you turn on “Save my Robin chats” (see below) |
| Saved Robin chats (only if you turn on “Save my Robin chats”) | Your chat history on any phone you sign in on; improving Robin's answers | Consent (the setting, off until you turn it on) | 90 days, or until you delete them |
| Call-back requests | Calling you back about your question, on your verified number | Consent (you tick a box each time) | [retention period] |
| Bug reports and feedback (with up to 3 screenshots, if you add them) | Fixing problems you report | Consent (you choose to send) | [retention period] |
| Usage analytics (screens viewed, buttons used, in buckets) | Understanding which features help riders | Consent (on by default; switch off in Me → Settings → Privacy) | Firebase's analytics retention period |
| Crash reports and app errors | Keeping the app stable | Legitimate use for the security and reliability of the service | [retention period] |
| Push notification token | Sending alerts you opted into | Consent (the notification permission) | Until you turn notifications off or uninstall |
| App Check token | Confirming requests come from the genuine app on a genuine device, to prevent fraud | Legitimate use for security | Not stored. Verified and discarded |
| Server logs (IP address, time, request) | Security, abuse prevention, debugging | Legitimate use | [1 year] |
Analytics, crash reports and error logs never include your phone number, name, rider id, voucher codes or anything you type (such as Robin questions, search terms or feedback text). Numbers that could single you out, such as scores and coins, are sent as ranges.
View and tap counts on sponsored items are kept as counts per item per day, with nothing about you or your phone.
Robin and saved chats
By default, the text of your questions to Robin is not stored. For a follow-up question (“and the last one?”) the app also sends the last few messages of the same chat, so Robin understands it. Before anything reaches the AI model we remove phone numbers and email addresses, and your name, phone number and account id are never sent to the model.
Saved Robin chats
This applies only when you are signed in and turn on Save my Robin chats in Me → Settings. It is off until you turn it on.
- What we save: each question you ask Robin and its answer, the sources Robin cited, your city, the app's language and the time. Phone numbers and email addresses are removed from your questions first. We don't save your location or what is in your account.
- Why: so you can see your Robin chats on any phone you sign in on, and so we can check and improve Robin's answers.
- Who can see them: you, in the app. RailRobin staff can read them to check answer quality. Staff see a short code instead of your phone number or name, and every chat a staff member opens is recorded in our audit log.
- How long: 90 days, then they are deleted automatically.
- Turning it off and deleting: turn off “Save my Robin chats” in Me → Settings, and nothing more is saved. You can delete one chat or all of them in Me → Settings at any time; they are deleted from our servers straight away.
Don't put personal information in your questions. AI answers can be wrong: check important details with the cited source or the operator.
What we don't do
- We don't collect your contacts, photos or microphone, or your location in the background.
- We don't sell personal data, and we don't use it for third-party advertising.
- We don't show your route, live location or commute times to other riders or to advertisers.
- We don't knowingly track or target children with ads.
Consent and how to withdraw it
We ask for consent at sign-up, with this policy, and through your phone's own permission prompts for location and notifications.
- Location or notifications: turn them off in your phone's settings. Check-in rewards then stop working.
- Usage analytics: Me → Settings → Privacy → “Share usage analytics”.
- Saved Robin chats: turn the setting off and delete your chats in Settings.
- Everything else: delete your account, or write to the Grievance Officer.
Withdrawing is as easy as consenting, and it doesn't affect processing that happened before.
Children
RailRobin accounts are for people aged 18 or over, or with the verifiable consent of a parent or lawful guardian. We don't knowingly process children's data without that consent, and we don't track or target children with ads.
Who processes data for us, and where
We share personal data only with service providers (Data Processors) who process it for us under contract, and only for the purposes in this policy.
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | Our servers (API) and database | Bengaluru, India |
| Google Firebase | Sign-in codes by SMS (Phone Authentication), usage analytics, crash reports, App Check (device integrity), push notifications, and distributing pilot builds of the app | Google's global infrastructure |
| Microsoft Azure | Robin's answers, through Azure OpenAI. Receives the question text (and, for a follow-up, the last few messages of the chat) with personal details removed, plus our reviewed metro content | Japan East (for now) |
| Microsoft Azure | Bug-report screenshots, and app and server error logs | Central India |
| Amazon Web Services (Bedrock) | Planned: generating Robin's answers in India instead of Japan | Mumbai, India (planned) |
| Partner outlets | Checking a voucher code when you redeem it. They see the voucher, not your phone number | India |
Some of this processing happens outside India. Transfers follow section 16 of the DPDP Act, which allows them unless the destination is restricted by government notification. We may also disclose data where the law requires it, for example to a court or another lawful authority.
Your rights
As a Data Principal, you can:
- get a summary of your personal data and how we process it;
- correct, complete or update it;
- have it erased, unless the law requires us to keep it;
- withdraw consent;
- have your grievance addressed; and
- nominate someone to exercise your rights if you die or become incapacitated.
- Write to the Grievance Officer or to support@railrobin.in, or use Me → Help & support in the app.
- We may verify your identity by sending a code to your registered phone.
- We respond within [the period set by the DPDP Rules; 90 days at most].
- If you're not satisfied, you can complain to the Data Protection Board of India after using our grievance process.
Retention and deletion
We keep personal data only as long as the purpose needs it, as listed above. When you delete your account:
- your profile, phone number, groups, saved Robin chats and push tokens are erased within [30] days;
- ride, coin and voucher records are anonymised, or kept only as the law requires.
Inactive accounts. We erase accounts with no sign-in for [3 years], after giving 48 hours' notice.
Security
- Encrypted connections, and hashed sign-in codes and tokens.
- Tokens stored in your phone's Keystore or Keychain; one device per account.
- App Check, so only the genuine app can call our servers.
- Least-privilege cloud roles, and audit logs of staff actions that never contain phone numbers, tokens or locations.
- Staff access only through our admin portal, with two-person approval for published content.
If a personal data breach happens, we will inform the Data Protection Board and affected riders as the DPDP Act and Rules require.
This website
railrobin.com uses no cookies, no analytics and no third-party trackers, and loads nothing from other websites. Our web server keeps short-lived technical logs (IP address, time, page requested and browser type) for security and troubleshooting. See the cookie notice.
Changes to this policy
We will tell you in the app before material changes to this policy. Where the purpose of processing changes, we will ask for your consent again. The date at the top shows when it last changed.