Privacy Policy
This Policy explains what HU Carpool collects, why it is used, when it is shared, how long it is kept, and the choices available to you. Providing information is voluntary; the service does not extract timetable images, contacts, or precise location from your device.
Effective and last updated: 17 August 2026Who operates this service
HU Carpool is an independent project operated by Ammar Adnan. It is not a Habib University system, and Habib University is not the controller or recipient of information submitted here. Privacy questions and requests may be sent through the Support page.
Information you choose to provide
To create and use an account, you provide a Habib University student email, password, name, gender, WhatsApp number, broad Karachi origin and route areas, weekly reach and leave times, transport mode, seat availability where relevant, women-only and notification preferences, feedback, reports, and account-deletion requests. The service does not ask for an exact home address, CNIC, payment-card information, or live GPS location.
Information created during use
The service records email-verification and password-reset events, policy acceptance date and version, sign-in time, matching and account status, deliberate phone-number reveals, moderation history, email delivery status, and limited security or operational logs such as IP addresses associated with short-lived OTP requests.
Why information is used
Information is used to verify student-email access, create and secure accounts, compare routes and weekly schedules, apply eligibility preferences, display compatible profiles, reveal a WhatsApp number only on request, deliver operational emails, prevent abuse, investigate reports, administer account choices, and maintain service reliability. It is not sold and is not used for unrelated advertising.
Timetable screenshots stay on your device
Screenshot import is optional. The selected image is processed inside your browser to suggest timetable values; the image itself is not uploaded to or stored by HU Carpool. Only the reach and leave times you review and submit are stored.
Who can see information
Other eligible students may see your name, broad area, schedule compatibility, transport mode, and relevant preferences. Your WhatsApp number is withheld from match-list HTML and is shown only after another verified student deliberately requests it. You can review active reveal records, which expire after 90 days. Report details and administrator notes are restricted to moderation.
Service providers and disclosures
The hosting provider stores the application and database. An email-delivery provider processes recipient addresses and messages. Google reCAPTCHA processes anti-abuse information under Google’s terms. jsDelivr supplies the optional timetable-reading script, and opening WhatsApp or LinkedIn sends you to those independent services. Information may also be disclosed where reasonably necessary to comply with law, respond to valid legal process, protect users, investigate abuse, or defend legal rights.
Security—not an absolute guarantee
HTTPS protects information in transit. Passwords and OTP codes are stored as one-way hashes, not readable plaintext. Queued email bodies are encrypted with AES-256-GCM. Other profile information is stored in an access-controlled production database and is not field-by-field encrypted by the application. Administrative access is restricted and sensitive configuration is kept outside the public web root. No internet service can promise absolute security.
Retention and deletion
Expired OTP records are removed after their operational window. Phone-reveal records expire after 90 days. Requesting deletion hides the profile immediately and provides a 30-day recovery period; after that, direct profile fields are erased or anonymized by maintenance. Some limited records may remain where needed for security, abuse prevention, legal compliance, backups, or dispute resolution.
Your choices
You may review or update profile information, pause matching, disable match emails, choose whether to reveal another person’s number, request deletion, or recover a pending deletion within 30 days. You may decline the Policy by not registering or by signing out and requesting deletion. Contact Support to ask for access, correction, or assistance with deletion.
Changes
Material changes will receive a new version date. Existing students may be asked to review and affirm the updated Policy before continuing.