A ride records the precise GPS of your whole journey, both ends, tied to your account, and trip records commonly stay seven to ten years under tax and accounting rules. Every policy reserves the right to hand the trail to police and regulators on request.
A precise movement record. Worth keeping on the list.
Trip and payment history is kept for years; driver checks longer.
Riders give payment; drivers pass identity and background checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
Trip records map where you go and when you are away from home. One operator's breach took riders and drivers alike, and the licence and payment details attached make it a fraud kit too.
Every ride records two people and the route between them
A ride hands over the precise GPS of your whole journey, both ends, tied to your account, and on some apps the trail keeps running whenever the app is open, not only during the trip. Each ride also names two people to each other: you get the driver's name, photo and live location, they get your name and where you are going. The platform keeps both sides, plus the ratings you leave each other.
Your trips can leave without a warrant
Every policy reserves the right to hand your data to police, courts and government on request. Several go further, releasing data to regulators and licensing bodies not through a court order but as a standing condition of being allowed to operate. In some cities the per-trip location of shared scooters and bikes flows to the transport authority to keep the permit, and the licence itself lets the data out, no warrant needed.
Leaving rarely clears the trail
How long anything stays is their claim, not a fact: trip records are commonly kept seven to ten years to meet tax and accounting rules, and where a policy gives no number it keeps your data 'as long as necessary.' A deletion request meets carve-outs for safety, fraud, disputes and fees, and several policies say the account cannot always be deleted at all. In London, private-hire rules set a floor the company cannot waive: your name, agreed pickup and destination stay on the booking record for at least six months by law.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Pick-ups and drop-offs map your whole routine.
Repeat destinations imply who and where matters to you.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
To prove they checked your age or identity and to block known fraud, sometimes held by a separate verification company.
Payroll, right-to-work, and pension records carry statutory retention.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
These records sit where breaches happen, and where they have been covered up. In one case the personal data of 57 million riders and 600,000 drivers was taken, and the company's own security chief paid the hackers to stay quiet, a cover-up that ended in a criminal conviction. In the car-rental corner, a separate breach exposed customers' names, dates of birth, driver's licences and payment cards.
Trip data has an established resale and partnership market.
Routes and demand train pricing and routing models.
Anonymised is their word. Trip traces are mobility data, and four time-and-place points single out 95% of people in such data (de Montjoye et al., Scientific Reports, 2013).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“harsh braking, harsh acceleration, speeding, and other driver behaviour monitoring”
Continuous scoring of how the person at the wheel drives, taken from their own phone or the car itself, used to grade them and, on some platforms, to switch off the account. It falls on ride-hail drivers and self-drive car-share renters alike.
THE MOVE A request pulls the driving record they scored you on into your own hands. Their reply goes on your record.
“except as necessary for purposes of safety, security, fraud prevention or compliance with legal requirements”
Retention after you have asked to delete, for as long as the company decides safety or fraud requires, with no outside review. One version keeps a banned user's data on purpose, so the platform can recognise them if they come back.
THE MOVE A request marks what they keep after deletion, and why. The reply, or the silence, goes on your record.
“retained for tax purposes, in line with our accounting obligations”
Holding the whole trip record, both endpoints, times and payment, for seven to ten years under a bookkeeping reason. The accounting need is for the amount paid, not the map of where you went that stays attached to it.
THE MOVE A request separates what the law makes them keep from what they only choose to. Their reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →