Privacy policy

Last updated: 22 October 2026

1. Controller

Arvyn Media, owner Armin Razavi, Dwight-D.-Eisenhower-Straße 1, 65197 Wiesbaden, Germany
Email: info@comrido.com

2. Visiting this website

This website sets no cookies and uses no social-media plugins, no advertising and no external fonts. When you visit, the web server processes technically necessary connection data (IP address, date and time, requested file, amount of data, browser information) in server logs. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). The logs are limited to 30 MB per service and continuously overwritten, so older entries are deleted automatically. They are not analysed or combined with other data.

Visitor statistics. To see how many people visit the website and which pages they read, we use Umami. Umami runs on our own server (stats.arvynmedia.de, the same server in Leipzig as above); no data goes to other providers. We use our own small script for this, which reads nothing on your device and stores nothing there (no cookies, no screen size, no language). It reports only the page visited and the website you came from. Browser, operating system and country follow from the request itself. Your IP address is not stored; only an identifier is formed from it and the browser details, with a key that changes regularly, so we cannot recognise you or build profiles. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the website). We keep the aggregated figures for as long as we run the website. If you switch on "Do Not Track" in your browser, the script sends nothing. You can also block it.

Your light or dark theme choice and, for the explainer film, your caption setting and where you paused it are stored only locally in your browser (local storage). They are not sent to us.

The explainer film loads entirely from our server; no data goes to video platforms. The narrator voices in the film are generated with artificial intelligence (Microsoft Azure AI Speech); the music is licensed.

3. Beta request

If you use the form, we process your name, email address and, if provided, company, role and commute destination to invite you to the beta and to communicate with you. The details are sent to us by email and/or stored on our server in Germany. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, e.g. by email to info@comrido.com. We delete the data at the latest six months after the beta phase ends, or sooner if you withdraw consent or the request is declined.

4. Contact by email

If you write to us, we process your message and sender details to answer your enquiry (Art. 6(1)(f) or (b) GDPR). We delete them once the matter is closed and no retention duties apply.

5. Hosting, domain and email

The website and the app run on a server of dogado GmbH in Leipzig (Germany). The info@comrido.com mailbox is on our own mail server on that server. App emails (for example sign-in links and notifications) are sent through Brevo (Sendinblue SAS, Paris, France); this processes the recipient address and the content of the email. Brevo stores the data in France and Belgium; group companies in the USA and India and providers such as Cloudflare (USA) may access it for support and operations, safeguarded by EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The domain is managed by InterNetX GmbH (INWX, Germany). These providers process data on our behalf (Art. 28 GDPR).

Alert e-mails. If you switch on "E-mail when someone answers" in Settings, we use your work e-mail address from your Microsoft sign-in to send you a short message when someone answers your ride request and your device gets no push message, and, if you switched this on separately, when someone new fits your route (see 6.5). The message does not name anyone and shows no times or places. We send at most one per hour about answers, at most one a day about new people, and none at night. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching the setting off; we then delete the stored address. We send these e-mails through Brevo (Sendinblue SAS, Paris, France), our e-mail service provider, under a data processing agreement. The address is also deleted when you delete your account.

6. The Comrido app

6.1 Sign-in and proof of employer

You sign in with your Microsoft work account. From Microsoft we keep permanently only two technical identifiers: your organisation's id and your account id. We never receive your password. Microsoft passes your work e-mail address at sign-in; we keep it with your sign-in session only for as long as the session lasts, so that you can switch on alert e-mails without typing the address. It is deleted when you sign out, and finished sessions are cleared out daily. We use it only if you switch on alert e-mails. We use the identifiers to check that you work at a participating company, and repeat this check regularly. Legal basis: Art. 6(1)(b) GDPR (use of the app).

6.2 What you enter in the app

• Profile: display name (first name or nickname), optionally full name and job title.
• Commute: workplace and approximate starting point (postcode, street, or an approximate map point). If you wish, you can also give your exact address with house number so drive times and meeting points are more precise. This is optional. We use the exact address only for your own routes; other members never see more than your area (postcode and district). You can remove it at any time. We do not track your location.
• Weekly routine: office days, time windows, whether you drive or ride, offered seats, vehicle details.
• Rides: requests, confirmations, cancellations with reason, return-trip status.
• Messages to other members, preferred partners, groups, blocks.
• Feedback after a ride (e.g. on time yes/no) and safety reports. Others only ever see the note “Usually on time” once at least 5 rated rides show 80 % or more, never a number; only you see your own rate.
• Settings such as language and visibility.

Legal basis: Art. 6(1)(b) GDPR. Other members only see what a ride needs: your display name, approximate meeting points and times, and — if you allow it — your employer as a trust signal. Colleagues at your company also see how many people at their workplace use Comrido: only that one number, and only from 5 people up. You are counted only if others can find you and you show your workplace. Those who see you in their suggestions also see whether your commute for tomorrow is confirmed. A usual office day confirms itself, unless your times were only assumed or you changed that day one-off; you can undo the confirmation at any time.

6.3 What your employer sees

Your employer receives no information about you personally: no rides, no routes, no messages. Numbers are only shown in aggregate, and only from five people upwards. If your company wishes, we can send it a monthly summary. It contains only totals for the whole company or one workplace: how many people took part, how many shared rides took place, how many seats were filled, how many people rode with the same colleague more than once, and how many asked their company for support. Any figure below 5 is not shown. It never contains names, routes, times, places or messages. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing companies whether Comrido is used). Every view and export of a summary is logged by us.

Ask my company. If you tap “Ask my company to support Comrido”, we store your company, you, the date, where you tapped and your workplace. You can do this at most once in 90 days, and you can withdraw the request at any time. Your company never learns who asked, at most the total in the monthly summary, from 5 requests up. We delete the request after 12 months or with your account. Legal basis: Art. 6(1)(b) GDPR.

6.4 Safety and moderation

We review reports about other members and may warn, restrict or suspend accounts. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the safety of all members). So that a measure can't be avoided by deleting and signing up again, we keep a non-reversible, keyed fingerprint (HMAC) of your Microsoft identifiers while a restriction or suspension is active or planned (see 7).

When we propose, take or lift a measure against you, and when we have decided on a report you made, we send you a message from Comrido in the app with the reasons. We store these messages with your account, along with when you read them. Legal basis: Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065 (DSA).

6.5 Notifications

If you turn on push notifications (consent, Art. 6(1)(a) GDPR), we store your browser's delivery address. Messages are delivered through the push service of your browser or device maker (e.g. Google, Apple, Mozilla). You can turn them off at any time in the settings or in your browser.

Alert when someone new fits your route. When someone joins or changes their commute so that they now fit your route and times, we send you one short message: “A new colleague fits your commute. Open Comrido to see who.” For this our server only compares the details already used for suggestions (workplace, approximate starting point, days, times, role), by the same rules as the suggestions in the app; no new data is collected and no routing service is asked. The message names nobody and shows no places or times. It comes as a push message if you turned on push notifications, otherwise as an e-mail if you turned on “E-mail when a new colleague fits my route” (a consent of its own, separate from e-mails about answers); at most one a day and none between 22:00 and 06:00. We store whom we told you about and when, so you are never told about the same person twice and they are marked “New” in your suggestions for a week. We delete these records after 12 months or with your account. Legal basis: Art. 6(1)(b) GDPR (use of the app), and for the channel your consent to push messages or alert e-mails. You can switch the alert off at any time in Settings under Notifications.

6.6 Maps

For map views the app loads images from the OpenStreetMap Foundation (United Kingdom). Your IP address is sent to that provider. Legal basis: Art. 6(1)(f) GDPR (showing the route). The United Kingdom has an EU adequacy decision.

6.7 Address search and drive times

When address suggestions and drive times with live traffic are switched on, our server sends the places you enter (while typing, the text entered so far; for drive times, start and destination) to TomTom International B.V. (Netherlands). Your IP address and name are not sent, only the places. Legal basis: Art. 6(1)(b) GDPR (use of the app). TomTom processes these details on our behalf (Art. 28 GDPR).

6.8 Weather

For the weather forecast for your commute, our server sends only the name of your area to a geocoding service (Open-Meteo or, when switched on, TomTom, see 6.7) and then coordinates rounded to about 10 km to the Open-Meteo weather API of APIs GmbH (Switzerland). Your name, IP address and exact address are not sent; one forecast serves everyone in the same area and is kept for one hour. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in useful commute planning). Switzerland has an EU adequacy decision.

6.9 Local storage

The app keeps settings and a copy of your data in your browser (local storage) so it is fast and works briefly without a connection. For sign-in we set a strictly necessary cookie. It expires after 30 days without use, and after 90 days at the latest.

6.10 Download your data or delete your account

Under Settings → “Your account” you can download everything we store about you as a file and delete your account yourself.

6.11 Accepting the terms of use

When you accept the terms of use, we store which version you accepted and when, and that you confirmed you are at least 18. This lets us show which terms apply to you. Legal basis: Art. 6(1)(b) and (f) GDPR (proof of the contract).

7. How long the app keeps data

• While your account exists, we keep your details, including messages and past rides. There is currently no automatic deletion after a fixed period for these. You can delete your account yourself at any time (see 6.10).
• Open ride requests expire after 48 hours.
• When you delete your account, we delete straight away: profile, workplace, starting point, weekly routine, messages (including your conversation partner's copy), preferred partners, group memberships, blocks, notification devices, messages from Comrido to you, sign-in data and all sessions. Open and confirmed rides are cancelled and your ride partners are told.
• Past rides and feedback stay in other members' history without your name.
• Safety reports and restrictions concerning your deleted account, and the record of your acceptance of the terms of use, are deleted two years after the account was deleted.
• If a restriction or suspension is active or planned, after deletion we keep only the fingerprint from 6.4 — until the restriction or suspension ends, at most two years. It is then deleted automatically.
• If your company has not set up Comrido yet and you tap "Notify me", we keep your work e-mail address until we have told you, at most 12 months. It is then deleted automatically.
• Whom we told you about with a “new colleague fits your commute” alert, and when: 12 months, then deleted automatically.
• “Ask my company” requests: 12 months, then deleted automatically.
• The automatic deletions run once a day.
• Server error logs contain no content of your messages or details and are continuously overwritten like the logs in section 2.

8. Recipients and third-country transfers

Beyond the providers named above, Microsoft (sign-in), the map provider and your browser's push service, we do not share data with third parties. For sign-in this is Microsoft Ireland Operations Limited (Ireland). The push services of Google, Apple or Mozilla may transfer data to the USA; Google and Apple are certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Push notifications are optional and only active with your consent.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.