Sabay

Privacy Policy

Last updated: May 26, 2026

Sabay (“the app”, “we”) is a small tool for splitting fuel and parking costs between members of a carpool. This page explains what personal data we collect, why we collect it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

Who is the controller

The data controller is the operator of this app, reachable at alessandrorafaelcruz@gmail.com. See also our contact page.

What we collect

  • Account data (Supabase Auth): your email address, a hashed password if you set one, and the timestamps of your sign-ins. Stored by our authentication provider, Supabase, in the EU region.
  • Carpool data you enter: group names, member display names, vehicle details, fuel fill-ups, trips you drove or rode in, and payment status. Stored alongside your account in Supabase.
  • Server & IP logs (Vercel): request logs that include your IP address, user agent and the URL you requested. Used for debugging, abuse protection and aggregate analytics. Retained by Vercel for a short period (typically up to 30 days).
  • Push notification subscriptions: if you enable push notifications, your browser’s push endpoint and public keys are stored so we can send you reminders. You can revoke this at any time from the Account page or your browser settings.
  • Optional Google Sheets export: if you connect a Google account to export data to a spreadsheet, we use the Google OAuth token only to write the sheet you choose. We do not read your other sheets or store the spreadsheet contents on our servers.

Why we process this data (legal basis)

  • Contract (Art. 6(1)(b) GDPR): to provide the carpool features you signed up for.
  • Legitimate interest (Art. 6(1)(f) GDPR): server logs for security, abuse prevention and debugging.
  • Consent (Art. 6(1)(a) GDPR): push notifications and the optional Google Sheets export. Withdraw anytime.

Who can see your data

Carpool data is only visible to members of the groups you belong to. We do not sell personal data, and we do not share it with advertisers. The infrastructure providers that process data on our behalf are:

  • Supabase (database & authentication)
  • Vercel (hosting & request logs)
  • Sentry (error reporting; IP addresses are scrubbed)
  • Upstash (rate-limiting counters keyed by email or IP)
  • Google (only if you opt in to the Sheets export)

How long we keep it

Account and carpool data are kept until you delete your account. Server logs are kept for up to 30 days. Backups are rotated within 90 days.

Your rights

Under the GDPR you can access, correct, export, restrict or delete your personal data, and object to processing based on legitimate interest. The app provides self-service tools for the most common requests:

  • Export — download a JSON copy of your data from the Account page.
  • Delete — delete your account and associated rows from the Account page.
  • Change email — from the Account page.

For anything else, email alessandrorafaelcruz@gmail.com. You also have the right to lodge a complaint with your local data protection authority.

Cookies

We use only the cookies that are strictly necessary to keep you signed in (set by Supabase). No tracking or advertising cookies are used.

Changes

If we change this policy in a material way, we’ll notify signed-in users in the app before the change takes effect.