Privacy Policy

Account information you provide

When you create an account, we collect only what is needed to let you log in and use the service:

• Your email address, required for login and password recovery.
• Your password, which is stored solely as a bcrypt hash. We never retain or transmit the plain text value.
• A display name you choose (optional).
• Your home city and ZIP code (optional). If you provide a city, we convert the city name into an approximate latitude and longitude using Mapbox's geocoding service and store that coordinate pair. This coordinate represents the centroid of the city you chose. It is not collected from your device.
• A profile photo URL, if you set one.

Operational data you generate

If you log a shift, configure a vehicle, or set a goal, we store what you enter:

• Shift records. Platform name, start and end time, total hours, miles, gross earnings, tips, expenses, notes, and the zone you worked in. These values are entered by you; we do not pull them from any gig-platform account.
• Vehicle profile. Vehicle type, MPG, fuel cost, and maintenance cost. If you choose a year and model, we also store the EPA fuel-economy record associated with that vehicle.
• Preferences. Weekly earnings goal and driver mode (delivery, rideshare, or both).

Payment information

If you subscribe to a paid tier, Stripe, Inc. processes the transaction on its own systems. We receive from Stripe only your subscription tier, billing period, and a customer reference identifier. Card numbers, CVV codes, and bank details are never transmitted to or stored by Qwkroute.

Authentication tokens

When you log in, the application issues two JSON Web Tokens (an access token and a refresh token) and stores them in your browser's local storage. These tokens are sent back to our API to authenticate subsequent requests. They are cleared when you log out and are not transmitted to any third party.

To avoid ambiguity, the following categories are intentionally out of scope. We do not collect them and have no mechanism to collect them.

• Device location. The application does not call the browser or operating system geolocation API. The only coordinates associated with your account are the city centroid described in Section 01.
• Telephone numbers. We do not request, store, or transmit a phone number. Account recovery is email-only.
• Gig-platform credentials. Qwkroute does not connect to DoorDash, Uber, Lyft, Instacart, GrubHub, or any other gig platform via OAuth, API, or any other means. Platform selection within the app is a user-entered label.
• Behavioral analytics. We do not integrate with Google Analytics, Mixpanel, Segment, PostHog, Amplitude, Hotjar, or any comparable service. We do not record your clicks, page visits, or session duration.
• Date of birth or age. The service is intended for adults 18 years of age or older (see Section 09) but we do not collect a date of birth.
• Government identifiers. We never ask for Social Security numbers, driver's license numbers, or tax identification numbers.

Your information is processed only for the purposes listed below.

• To authenticate you and maintain your account, including password resets and email verification.
• To deliver the features you use, including the dashboard, analytics, AI shift planning, demand map, and transactional email.
• To compute aggregated community statistics (for example, metro-wide median hourly earnings). Aggregates are computed only where at least three contributing shifts exist, and no individual user is identified in the output.
• To process subscription billing through Stripe for paid tiers.
• To secure the service against abuse (rate limiting, anomaly detection, audit logging of security-relevant events).

We do not sell personal information. We do not exchange personal information for advertising or other commercial purposes. We do not build or license advertising profiles of our users.

The service providers below process limited data on our behalf to operate the service. Each provider has access only to the data it requires for its specific function.

Qwkroute does not disclose personal information to any party not listed above, except where required by law or to protect the safety of a person. If a new service provider is engaged that processes personal data, this list will be updated before that provider is activated.

Qwkroute uses only essential storage to operate the service. Specifically:

• Two authentication tokens are stored in the browser's local storage after login. These are cleared when you log out and are not transmitted to any third party.
• Your cookie-preference selection is stored in local storage so the banner does not reappear on each visit.
• The shift timer (if used) stores its start time in local storage so the timer survives page reloads.

Stripe may set its own cookies on its checkout pages. Those cookies are governed by Stripe's privacy notice. No analytics cookies, advertising cookies, or cross-site tracking technologies are set by Qwkroute. See our Cookie Policy for the full inventory.

You have the following rights regardless of jurisdiction. Most can be exercised directly in account settings. All can also be exercised by contacting us at the email address in Section 12.

• Access. You may request a copy of the personal information we hold about you. We respond within thirty (30) calendar days.
• Correction. You may correct your account profile, shift records, vehicle profile, and preferences from within the application.
• Portability. You may export your shift history as a CSV file from the analytics page.
• Deletion. You may delete your account from account settings. Upon deletion your email address and display name are replaced with an anonymous placeholder, your home city is cleared, your authentication tokens are revoked, your notification history and any raw parsed-offer data are permanently deleted, and your shift earnings are retained only in anonymized aggregate form. Deletion is irreversible.
• Objection and restriction. You may object to specific processing or request that we restrict certain processing by contacting us.

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, and other states with comprehensive privacy statutes may have additional rights under those statutes. We honor those rights for all users regardless of residence. See also our California privacy notice for statute-specific disclosures.

Account data is retained for as long as your account remains active. Upon deletion:

• Personal identifiers on the account record are overwritten within minutes (email, display name, home city).
• Notification history and any raw parsed offer data are permanently deleted at the same time.
• Shift earnings are retained in anonymized form to power community statistics. They cannot be linked back to you.
• Billing records are retained for seven (7) years to comply with United States tax recordkeeping requirements.
• Application logs containing IP addresses and request metadata are retained for thirty (30) days for security purposes and then automatically purged.

• All traffic between your device and our servers is encrypted using HTTPS (TLS 1.2 or higher).
• Passwords are stored exclusively as bcrypt hashes with a per-password salt.
• The production database is operated by Supabase on Amazon Web Services infrastructure in the United States, with encryption at rest.
• Rate limiting and anomaly detection are applied to every public endpoint.
• Account deletion runs an explicit anonymization job that overwrites personal fields with non-identifiable placeholders.

No system can be guaranteed secure. If we confirm a security incident that affects your personal information, we will notify you by email within seventy-two (72) hours of confirmation, and will file any reports required by applicable law.

Qwkroute is intended for adults 18 years of age or older. Gig-driving work generally requires the user to be of legal working age in their jurisdiction. We do not knowingly collect personal information from anyone under the age of 13. If you believe a child under 13 has created an account, contact us and we will delete the account and its associated data.

Qwkroute is operated from the United States. Our application servers and database are located in the United States. If you access the service from outside the United States, you consent to the transfer of your personal information to and its processing within the United States. At present Qwkroute is focused on US gig drivers and does not actively support non-US gig platforms.

We may update this policy from time to time. The "Effective" date above reflects the current version. If we materially change what information we collect or who we share it with, we will email registered account holders at least fourteen (14) days before the change takes effect. Minor clarifications (typographical corrections, formatting, restructuring without substantive change) may be made without notice.

To exercise any right in this policy, ask a question, or raise a concern about our privacy practices, contact us at:

We respond to substantive privacy inquiries within thirty (30) calendar days. If you have contacted us and are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.