Privacy Policy
Effective from 29 September 2026
OjeTimor is a motorbike taxi, car, food delivery and shopping service in Dili, Timor-Leste. This page explains what data we collect, why, where it goes, and what you can do about it. Written plainly: where we do not yet delete something automatically, we say so.
1. What we collect
It depends on your role in the app.
Everyone
| Name, phone number, email | To create your account, and so drivers and sellers can reach you while an order is running. |
|---|---|
| Profile photo | Optional. Shown to the driver or seller on your order. |
| Device identity | The device name and a marker the app generates, so one account stays active on one device and a device you have verified is recognised. |
Passengers and buyers
| Location | Read once when you open the map or place an order. Pickup and destination are stored on the order. The passenger app does NOT track you continuously and does not read your location while it is closed. |
|---|---|
| Order contents, notes and chat | To run the order and settle complaints. |
| OjePay balance and its transaction history; top-up transfer receipts | Paying from the balance and topping it up, only while OjeTimor has the OjePay service open. Receipts are kept in private storage. |
| Location when you send a safety report | Only if you send one during a trip: the report goes to the OjeTimor team with your position so they can follow up. It is not an emergency service; in an emergency call the police (112), an ambulance (110) or the fire service (115). |
Drivers
| Precise location, including while the app is minimised or the screen is off | Only while you are ONLINE. It is what lets a passenger watch you move on the map and what sends orders to the nearest driver. Your phone shows that location is in use the whole time it is running, and it all stops when you go offline. |
|---|---|
| Location trail during a trip | Recorded every 10 seconds while a trip is running, to settle disputes about it. Only an administrator can read it. |
| Identity card (KTP/BI), driving licence (SIM) with its number and expiry date, vehicle inspection certificate (KIR) and vehicle registration (STNK) with their numbers and expiry dates, a vehicle photo, electoral card number, family card photo and a portrait | To verify you are fit to drive. Required by the nature of the service. |
| Bank name, account holder, account number | Shown to buyers who pay you directly by transfer, and used to pay out your OjePay balance when there is one. |
| Plate number and vehicle details | So a passenger recognises the vehicle picking them up. |
Sellers
| Name, phone, shop and product photos, receiving account | To show your shop, and to show the shop account to the driver who pays you for the goods directly. |
|---|
2. What we do NOT do
- We do not sell your data to anyone.
- We add no advertising, analytics, attribution or crash-reporting SDK of our own: no Google Analytics, Firebase Analytics, Crashlytics, Sentry, AdMob or Facebook SDK. The Google components in the app are Google Maps, Google Sign-In and, on Android only, the Google ML Kit QR scanner; what each of them receives is listed in section 3.
- We do not share your data for advertising, and we add no analytics of our own. The only usage, performance and crash data that leaves the app goes to Google, from the Google components listed in section 3, to run them.
- The passenger app does not record location in the background.
3. Where the data goes
| Google Maps Platform | Address search text and coordinates are sent to find places, turn coordinates into addresses and compute routes. The Google Maps SDK inside the app also sends Google a device identifier and usage, performance and crash data, which Google uses to run and improve its maps under its own privacy policy. Your name, phone number and email are not sent to Google Maps. |
|---|---|
| Google Sign-In | If you choose to sign in with Google. Google gives us your name, email and profile photo. |
| Sign in with Apple | If you choose to sign in with Apple. Apple gives us an identifier for your Apple Account that does not change, which we use only to sign you in; an email address; and, the first time you sign in, your name. The name and email become your account name and email, as if you had typed them yourself. You may choose to hide your real email behind an Apple relay address that forwards our emails to you. We never receive your Apple Account password. |
| QR scanner: Google ML Kit on Android, Apple Vision on iPhone | On Android, Google's ML Kit library reads the code on your phone and sends technical device data and performance metrics to Google while the scanner is in use; nothing in it identifies you. On iPhone, the scanner uses Apple's Vision framework, which reads the code on the phone itself and involves no Google service. |
| Email delivery service | Sign-up, sign-in, new-device and password codes are sent to your email address through an email delivery (SMTP) provider, which receives your address and the message it carries. |
| Share Trip link | If you share a trip link, anyone holding that link can see your name, the driver's name and photo, the driver's position, the pickup and the destination until the trip ends or the link expires (6 hours at most). |
| OjeTimor's own server | Apart from what this list names, everything is stored on our own server, not on a third-party service. |
Every service named in this section receives only what it needs for the purpose written beside it, and any third party that receives user data from us must give it the same or equal protection as this policy.
How we protect it: Everything between the app and our server travels encrypted (HTTPS, TLS 1.2 or newer). Your data is stored on our own server, passwords are kept only as one-way hashes, identity documents and payment proofs sit in private storage with no public address, and the database itself checks every request against the account that makes it.
Data is also seen by the people who need it to run the order: a driver sees your name, pickup and destination; a seller sees the order and delivery address; an OjeTimor administrator can see order data to handle complaints and fraud. An order chat is opened by an administrator only to review a block between the two people in it, or a report one of them made about that conversation, and every opening is recorded.
Worth knowing: an online driver's position is visible to signed-in passengers while they book, because the map has to show nearby drivers. Only the position and the driver's name are visible.
4. How long we keep it
Order data, transactions and financial records are kept for as long as bookkeeping and dispute resolution need them.
Where we fall short: trip location trails and chat history have no automatic deletion yet, so they stay until the order they belong to is removed. We are setting a retention limit for both. Until it applies, you can still ask us to delete them at the address in section 8.
5. Deleting your account
You can delete your own account from inside the app: Account → Account Security → Delete Account. Open the Delete Account page
What is erased: your name, phone number, profile photo and email address; the name, number and photo on your order history; the text of your support reports; recognised devices; your block list. The account is locked and cannot be used again. A driver's last position is deleted.
What is kept: completed order and transaction records, without your name, number or photo, order chat messages, and the records of support reports and safety reports. We keep these for bookkeeping obligations and because drivers' earnings are tied to them. An old profile photo file may stay reachable at its old link until it is cleaned up.
Immediate self-deletion is refused while an order is still running, a balance is not zero, or a top-up or withdrawal is unfinished. Finish the order first; for money you cannot move yourself, send a deletion request from the same screen and we will settle it and close the account.
Driver and seller accounts are tied to payment records that have to be checked first, so they are closed on request: tap Delete Account in the app to send the request. We close the account within 30 days, after any outstanding earnings and settlements are handled, and confirm by email.
6. Permissions the app asks for
| Location | To set the pickup point, and to show a driver's position to passengers. |
|---|---|
| Location while minimised (drivers) | Only while a driver is online, so a trip keeps being tracked with the screen off. |
| Camera | To scan payment QR codes and, only if you choose to, to take photos: your profile photo, driver documents and vehicle, store and product photos, and a transfer receipt where the app asks for one. The camera is on only while the scanner or the photo screen is open. |
| Notifications | To announce an incoming order, and to tell a passenger their driver has arrived. |
| Vibration | Accompanies the order and driver-arrived notifications. |
| Saving to the gallery | To save a payment QR image so your bank app can open it. |
7. Children
OjeTimor is only for adults aged 18 and over. The app performs no age verification, and we do not knowingly collect data from anyone under 18. If you know that has happened, tell us and we will delete it.
8. Contacting us
Questions, a copy of your data, or a deletion request: noreply@ojetimor.com
If this policy changes, we update the date above and announce anything important inside the app.