Transportation
A ride records the precise GPS of your whole journey, both ends, tied to your account, and trip records commonly stay seven to ten years under tax and accounting rules. Every policy reserves the right to hand the trail to police and regulators on request.
The read at a glance
Every trip is logged with a pick-up, a drop-off and a time.
A leak exposes everywhere you have been and when, tied to your card.
Trip and payment history is kept for years; driver checks longer.
Riders give payment; drivers pass identity and background checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
Trip records map where you go and when you are away from home. One operator's breach took riders and drivers alike, and the licence and payment details attached make it a fraud kit too.
What repeats in the policies
Every ride records two people and the route between them
A ride hands over the precise GPS of your whole journey, both ends, tied to your account, and on some apps the trail keeps running whenever the app is open, not only during the trip. Each ride also names two people to each other: you get the driver's name, photo and live location, they get your name and where you are going. The platform keeps both sides, plus the ratings you leave each other.
Your trips can leave without a warrant
Every policy reserves the right to hand your data to police, courts and government on request. Several release data to regulators and licensing bodies as a standing condition of being allowed to operate, with no court order involved. In some cities the location of every shared scooter and bike trip goes to the transport authority to keep the permit, so the licence itself is what lets the data out.
Leaving rarely clears the trail
Trip records are commonly kept seven to ten years to meet tax and accounting rules, and where a policy gives no number it keeps your data for as long as it judges necessary. A deletion request meets carve-outs for safety, fraud, disputes and unpaid fees, and several policies say the account cannot always be deleted. In London, private-hire rules set a floor no company can waive: your name, agreed pickup and destination stay on the booking record for at least six months.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Where you go Highly likely
Pick-ups and drop-offs map your whole routine.
Who matters to you Possible
Repeat destinations imply who and where matters to you.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Identity and age-check records They set it as long as they choose
To prove they checked your age or identity and to block known fraud, sometimes held by a separate verification company.
Employment and payroll records Law sets it about 6 years
Payroll, right-to-work, and pension records carry statutory retention.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
In one case the personal data of 57 million riders and 600,000 drivers was taken, and the company's own security chief paid the hackers to stay quiet. The cover-up ended in a criminal conviction. A separate breach at a car-rental firm exposed customers' names, dates of birth, driver's licences and payment cards.
Sold or shared Likely
Trip data has an established resale and partnership market.
AI training Moderate
Routes and demand train pricing and routing models.
Even anonymised, this can still be you
Trip traces are mobility data, where four time-and-place points single out 95% of people (de Montjoye et al., Scientific Reports, 2013).
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Location traces Typical
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
How you write Sometimes
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
Face and voice Typical
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browsing fingerprint Sometimes
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“harsh braking, harsh acceleration, speeding, and other driver behaviour monitoring”
Continuous scoring of how the person at the wheel drives, taken from their own phone or the car itself, used to grade them and, on some platforms, to switch off the account. It falls on ride-hail drivers and self-drive car-share renters alike.
The move A request pulls the driving record they scored you on into your own hands.
“except as necessary for purposes of safety, security, fraud prevention or compliance with legal requirements”
Retention after you have asked to delete, for as long as the company decides safety or fraud requires, with no outside review. One version keeps a banned user's data on purpose, so the platform can recognise them if they come back.
The move A request marks what they keep after deletion, and why.
“retained for tax purposes, in line with our accounting obligations”
Holding the whole trip record, both endpoints, times and payment, for seven to ten years under a bookkeeping reason. The accounting need is for the amount paid, not the map of where you went that stays attached to it.
The move A request separates what the law makes them keep from what they only choose to.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.