Effective date: 13 October 2026
Applies to: the Return Trip mobile application and returntrip.app
Published at: https://returntrip.app/privacy-policy
This is not legal advice and was not written by a lawyer. It is an accurate description of what the software does, which is the hard half and the half a lawyer cannot do for you. Have a practitioner in Bangladesh — and one in India before the West Bengal market opens — read it before you rely on it.
Return Trip is operated by Gosoft, of 43, 4 Khodadad Khan Rd, Kushtia 7000, Bangladesh.
We run a marketplace that matches empty return journeys. A driver who has carried a passenger or a load one way, and is going back with an empty vehicle, advertises that return leg. Passengers and parcel senders travelling the same corridor book a seat, the whole vehicle, or luggage space. We operate in Bangladesh and in India (West Bengal).
For anything in this policy, write to hello@returntrip.app.
Everything below is collected because a specific part of the product needs it. Where a field is optional, it says so.
| What | Why | Required? |
|---|---|---|
| Mobile phone number | It is your account. You sign in with a one-time code sent to it, and it is how the other party in a journey reaches you. | Yes |
| Name | So the person getting into or driving the car knows who they agreed to travel with. | Yes |
| Gender | Only to honour gender preferences on a booking — some passengers will only share a vehicle with women, and some drivers only offer that. | Optional |
| Date of birth | Age rules: a driving licence has a minimum age, an unaccompanied minor is a question we have to be able to answer, and insurance asks. | Optional |
We do not ask you for an email address or a password. Those fields exist in our database for administrator accounts only — the staff who run the dispute desk — and are never populated for an ordinary passenger or driver.
If you drive, we collect, through the app: your National ID number and photographs of its front and back; your driving licence number and photographs of its front and back; your vehicle's registration number, model and colour; and a photograph of the vehicle.
If you want a verified badge as a passenger, we collect a photograph of an identity document and a three-second video of your face ("liveness"), which exists to show that a real person is holding the document rather than a copy of someone else's.
This is the most sensitive material we hold. It is stored on a private disk: the files have no public address, are not readable by anyone who guesses a path, and are opened only by staff reviewing a verification or a dispute. The vehicle photograph is the single exception — it is public, because a passenger waiting at a roadside needs to recognise the car.
Journeys you post or book, seats, fares agreed, cancellations, and completion. Your reliability score and any penalty owed, which fall out of cancelling after someone has committed to you.
No photograph at boarding. The driver checks your boarding PIN. Nobody photographs you at the car door.
Some older bookings also carry a passenger selfie taken at the time of the proposal. That stopped being required; new bookings mostly carry none, and the ones on record are deleted after 45 days.
Messages between a passenger and a driver about a specific journey — where to stand, how long someone will be. We store them so that both sides see the same thread and so a dispute can be read in context.
Only while the app is open. The app does not have permission to read your location in the background, and it therefore cannot: Android simply will not give it to us. Close the app, or lock the screen, and the reading stops.
Five things happen with it, and the difference matters:
What SOS does. We text each of your emergency contacts their own link, through the SMS company we use in your country. Their page shows your first name, where your phone was and when, the car and its plate, the driver's first name, the route and how many people are on the trip — no photographs and no phone numbers. If we cannot text one of them, your own messaging app opens with that message and you press send. We also text our safety team's duty phone. Our staff see the full details in our admin panel: the names, phone numbers and verified photographs of everybody on the trip, so they can act.
An SOS stays on until it is closed. You close it with your safety PIN, or our staff close it after they have spoken to you. A clock never closes it. It does not call the police for you: the SOS screen offers 999 in Bangladesh or 112 in India, and you press the call button.
Names, phone numbers and the relationship, for up to three people you choose. We store only what you type. We do not read your address book — the app has no permission to.
These are other people's details. Tell them you have added them, because if you press SOS they will get a text from us. When you press SOS we copy their name and number onto that alert, so our staff can see who was texted; the copy is erased 90 days after the SOS is closed, or when you close your account.
Your safety PIN is stored only as a scrambled one-way code (a hash). Nobody at Return Trip can read it. Three wrong tries lock it for 30 minutes.
Device identifier, model, operating system and version, app version, and the IP address of your last connection.
This is for one purpose and it is worth being blunt about it: stopping one person from running many accounts. A marketplace where the penalty for cancelling on someone can be escaped by signing up again is a marketplace with no penalty at all.
A push token from Google Firebase Cloud Messaging, so we can tell you that a seat was booked or a journey cancelled. It is tied to the installation, not to you personally, and it is released when you sign out or close your account.
Android only. The app shows one advertisement, above search results, supplied by Google AdMob. To do that, the Google Mobile Ads SDK reads your device's advertising ID and may use it to choose what to show you. Google's handling of it is governed by their own policies, not ours.
You can reset or delete that ID at any time in Android Settings → Google → Ads. The app keeps working; the advertisement simply becomes less targeted. iOS builds request no advertising ID and show no network advertisement.
We also show advertisements the operator has loaded directly, and promoted journeys from drivers who paid for placement. Neither of those involves any third party or any identifier.
Drivers may buy a subscription pass or boost a journey. Those payments are taken by regulated gateways — ShurjoPay, bKash, Nagad in Bangladesh and Razorpay in India. You enter your payment details with them, not with us. We keep the transaction reference, the amount and whether it succeeded.
We never see, and never store, your card or wallet credentials.
Passengers pay us nothing. The fare is settled directly with the driver, in the vehicle. We take no commission on it, so there is no fare for us to process and no payment record of your journey to keep.
The app contains a safety feature that records audio inside the vehicle during a journey, so that an accusation made afterwards can be checked against what was said.
It does not run. It is disabled in both of our markets, and the released app does not even ask for microphone permission — so it cannot listen, whatever any setting says.
We are describing it anyway, because it is in the software and you are entitled to know what you are carrying. If we ever switch it on in your market, this is what it would do, and we will update this policy and ask for your consent in the app before it does anything:
You would be asked to agree before any recording, your agreement would be recorded with its date, and you could withdraw it.
We do not sell your personal information, and we do not rent or trade it.
| Who | What they get | Why |
|---|---|---|
| The other party in your journey | Your name, whether you are verified, your phone number; and from a driver, the vehicle and its plate | You cannot share a car with a stranger neither of you can identify |
| Someone you share your journey with | The driver's first name, whether they are verified, the car and its plate, the route, the departure time and how many others are booked — no photo, no phone number | You chose to send it |
| Your emergency contacts, if you press SOS | Your first name, where your phone was and when, the car and its plate, the driver's first name, the route | You chose them, and you pressed SOS |
| Our SMS company | The phone number and the text of the message: a sign-in code, or an SOS link | To deliver it |
| Google (Firebase) | Your push token | Notifications |
| Google (AdMob) | Your advertising ID, Android only | The one advertisement |
| Supabase | Everything, as our hosting provider | They run our database and file storage |
| Payment gateways | What the payment needs | Driver subscriptions and boosts |
| Police, or a court | What is lawfully demanded | When we are legally obliged, or when somebody's safety needs it |
Data location. Our database and files are hosted by Supabase, outside Bangladesh. Using the app means your information is stored and processed outside your country.
| What | How long |
|---|---|
| Your account and journey history | While your account is open |
| Where a journey started and ended | With the journey history |
| Proposal selfies (historical) | 45 days |
| In-cabin audio, if ever enabled | 45 days |
| Emergency (SOS) records | Kept — they are a safety record |
| Your contacts' names and numbers copied onto an SOS | 90 days after the SOS is closed |
| Journey share links | Stop working within 24 hours; deleted 30 days after that |
| Payment records | Kept, as financial records |
In the app: Profile → Delete account. It asks you once, offers to deactivate the account instead, and then asks for the code we send to your phone. After that it is immediate. There is no waiting period and no undoing it.
Deactivating instead deletes nothing. It takes down your trips and car requests and signs you out on every phone, so nobody can find you or book with you. Sign in again and the account is back.
Be clear on what it does. It does not erase every row that mentions you, and no honest policy can promise that it does. Other people's records are built on top of yours: passengers who booked your journeys, the money a driver was paid, the ratings you gave other people. Deleting those would quietly rewrite other people's histories and destroy records a business is required to be able to produce.
What is removed: your name, phone number, gender, date of birth, profile photograph, National ID number, every identity and licence document and photograph, your liveness video, your driver profile and vehicle record, your emergency contacts (and the copies of their names and numbers on any SOS you raised), your safety PIN, your devices, and every signed-in session. Journeys you had posted that nobody had booked are withdrawn, and any journey link you shared stops working at once.
What stays, with your name gone from it: completed journeys as they appear on the other person's record; bookings other people made; the record of money a driver was paid; reviews you wrote about other people; payment transactions; emergency records; and your side of a chat conversation, because scrubbing it would mutilate the other person's half.
Your phone number is released, so the same number can start a brand-new account later with nothing carried over.
When it is refused. Closing is refused while your account is suspended, while you owe a penalty, while you have a journey booked, or while you are driving a journey someone else has booked. Each one is temporary — settle it, travel it, or contact us. We do not let an account be deleted as a way of walking out on a commitment somebody else is standing on.
Honestly, and without overstating it:
What we are not claiming. No system is secure against everything, and we would rather say so here than imply otherwise. If we discover a breach affecting your information, we will tell you and the relevant authority.
Return Trip is for adults. It is not meant for anyone under 18, and we do not knowingly collect information from children. Date of birth is optional on an account, so we cannot claim to enforce this by checking — if you tell us an account belongs to a child, we will close it.
If we change this policy we will update the date at the top and, where the change actually affects you — a new category of information, a new recipient, the audio feature being switched on — tell you in the app before it takes effect.
If you are in India, the grievance officer for the purposes of the Information Technology Rules is hello@returntrip.app.