Onboard — Privacy Policy
Last updated: 12 September 2026
Onboard ("the App") is a commuter shuttle management platform operated by MindSpring PLC ("we", "us", "our"). This policy explains how we collect, use, and protect your personal information.
1. Information We Collect
Account Information
- Full name
- Phone number
- Username and PIN/password (stored securely as hashed values)
- Membership type and preferred shuttle stops
Active-Trip Background Location
- Who: We collect real-time GPS location only from an authorised Onboard operator — an assigned driver, navigator, or administrator acting as the active operator — while operating an authorised trip.
- When collection starts: Location sharing begins only after the operator starts or resumes a trip and the trip is confirmed as active. It is required to operate that trip.
- Background operation and notification: On Android, active-trip location sharing may continue while the operator uses navigation, backgrounds the App, or locks the device. The App displays an ongoing system notification stating that Onboard trip tracking is active.
- Who can receive it: The current live bus location is available only to authorised Onboard users under our trip-access controls, including relevant riders and authorised administrators. It is not public and is not sold, rented, or used for advertising.
- When collection stops: We stop live location sharing when the active trip is ended. The operator can also stop sharing by ending the trip or revoking location access, although revoking the required permission prevents starting another tracked trip.
- Riders: We do not collect riders' device location for live bus tracking.
Trip & Booking Data
- Trip reservations, boarding status, cancellation history
- Seat assignments and pickup/drop-off stop selections
- Billing records (amounts due, payment status)
Device Information
- Push notification token (for trip alerts via Firebase Cloud Messaging)
- Device type and OS version (for diagnostics)
2. How We Use Your Information
- Provide the service: Process bookings, assign seats, display trip schedules, show live bus positions to passengers, and generate billing.
- Notifications: Send trip-start alerts, booking confirmations, waitlist promotions, and billing updates.
- Active-trip operations: Use an authorised operator's live location to show the active shuttle position, estimate arrival information, update trip progress, and provide pickup alerts to authorised users.
- Billing: Calculate monthly/weekly fares based on your membership type and route distance.
3. Data Sharing
We do not sell, rent, or trade your personal information. We may share data with:
- Payment processors (Paystack) — to process mobile money and card payments when activated.
- Cloud infrastructure (Railway, AWS) — where our backend securely stores your data.
- Authorised Onboard users — live bus location is shared only with users permitted by our trip-access controls, including relevant riders and authorised administrators, while the trip is active.
- Google Maps Platform — live bus location is used to render the in-app map; Google's privacy policy applies to map tiles.
- SMS providers (Arkesel) — your phone number is shared solely to deliver OTP verification codes.
4. Data Retention
- Account data is retained while your account is active.
- Trip and billing history is retained for up to 24 months for audit and dispute resolution.
- Active-trip GPS coordinates, speed, heading, and last-update time are held only in the live trip record to provide real-time tracking. These live fields are cleared when the trip ends; we do not maintain a separate location-history record after completion.
- You may request account deletion by contacting us (see below).
5. Data Security
- All data in transit is encrypted via HTTPS/TLS.
- Passwords and PINs are hashed (never stored in plain text).
- Access to production systems is restricted to authorised administrators.
- Database backups are encrypted and access-controlled.
6. Your Rights
Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Withdraw consent for data processing
- Lodge a complaint with the Data Protection Commission of Ghana
7. Children's Privacy
The App is not intended for use by children under 18. We do not knowingly collect personal information from minors.
8. Active-Trip Location Permission and Controls
The App requests precise and background location access only for authorised operators who start or resume a live trip. For Android active trips, an ongoing system notification identifies that Onboard trip tracking is active while the App shares the trip location in the background. Riders are not required to grant location for live bus tracking.
Location sharing begins only after a trip is successfully started or resumed and ends when that trip is ended. An operator may end the trip or revoke location permission through device settings; revoking the required permission prevents starting another tracked trip. The App does not use background location for advertising, profiling, or unrelated purposes.
9. Account & Data Deletion
You can request deletion of your Onboard account and all associated personal data at any time by emailing the address below with the subject "Delete my account". We will remove your account data (name, phone number, credentials, and booking history) within 30 days, except records we are required to retain for legal, audit, or dispute-resolution purposes. Driver GPS location is never stored after a trip ends.
10. Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the App after changes constitutes acceptance.
11. Contact Us
If you have questions about this privacy policy or wish to exercise your data rights: