Privacy Policy
Effective Date: April 27, 2026
1. What We Collect
When you submit an incident:
- Submission content: city, state, category, incident title, description — published if the report passes moderation.
- Submitter email (optional): used only to send a submission confirmation. Not displayed publicly. Purged within 90 days.
- Evidence files (optional): stored in Supabase Storage. Not publicly searchable by filename. Accessible only via the specific report URL.
- IP address: used for spam prevention and upvote deduplication. Not stored persistently after the request.
- hCaptcha data: collected by hCaptcha (third party) to prevent automated abuse. Subject to hCaptcha's own privacy policy.
When you browse:
- Page views, device type, referrer (via analytics — aggregated only). No cookies except session/functional ones.
2. What We Do NOT Collect or Publish
We do not collect, store, or publish: driver phone numbers; rider phone numbers; home or pickup/drop addresses; full trip IDs; vehicle plate numbers (unless voluntarily included in a redacted screenshot). We strongly advise submitters to redact this data before uploading evidence.
3. How We Use Your Data
- Publish incidents on CabLoot (that's the whole point).
- Moderate submissions and respond to disputes.
- Generate aggregate stats ("47 cancellation complaints in Delhi this month").
- Comply with legal orders (court subpoenas, law enforcement with valid warrant).
4. Data Retention
- Submitter emails: purged within 90 days of submission.
- Published reports: retained while the report is active. Removed reports purged within 30 days.
- Evidence files: retained while the associated report is live. Deleted when the report is removed.
- Analytics: aggregated data only; individual IP logs purged after 30 days.
5. Your Rights
To request access to or deletion of personal data submitted to CabLoot (including your own report), email legal@cabloot.com. We process verified requests within 15 business days.
We cannot delete published incidents simply because you changed your mind. That is the point of a public record. Removal requires grounds under our Takedown Policy.
6. Cookies
We use: a Supabase session token (functional, not tracking); hCaptcha cookies (third-party, anti-abuse). We do not use advertising, behavioural tracking, or remarketing cookies.
7. Third-Party Services
CabLoot uses Supabase (database and storage) and hCaptcha. These services have their own privacy policies. We do not sell your data. We don't have investors to please.
8. Children
This site is not intended for users under 18. If you are under 18 and submitted content, email legal@cabloot.com for removal.