Privacy Policy

There's no rider account, no sign-up, and no login. When you tap a tag and choose to tip, your card or wallet details go directly to Stripe — we never see or store your card number. We do see the tip amount, the time, and which tag was tapped, plus basic device and browser information (the same kind any web page sees) that we use to catch fraud, like a script hammering the same tag with fake taps. If you type an optional note to the driver, we store that note and, if you provide one, a first name or initial.

We collect, directly from you at signup:

• Your name and phone number
• A photo, if you choose to add one — it's optional, and it exists so a rider can confirm they're tipping the right person, not for any other purpose
• Your address and vehicle description

For payouts, Stripe collects your bank account and identity details (things like a government ID or SSN, depending on Stripe's verification requirements) directly through its own hosted flow. We don't receive or store your full bank account number or government ID — Stripe passes us back only what we need to show you a confirmation, like the last four digits of your account. As you use the product, we also collect your tap and tip history, the tags you've activated, and your settings and preferences.

Stripe is a regulated financial institution, not just a vendor we plug in — it holds its own licenses and its own privacy obligations for the payment and bank data it processes. That data is governed by Stripe's own privacy policy, separate from this one. We only ever see the summary information Stripe passes back to us (status, last-4, whether a payout succeeded) — never the underlying card or account numbers.

• To pay drivers and confirm payouts arrived
• To meet the identity-verification rules that come with moving money electronically (Stripe requires this of us)
• To detect and stop fraud, like fake or repeated taps
• To show you your own activity — tips, tags, payouts — on your dashboard
• To respond when you email us for support

Stripe, because it's the only way to actually pay you. Law enforcement or regulators, only if we're legally required to respond. That's the whole list. We don't sell personal information, and we don't share it with anyone for advertising.

We keep your information while your account is active, and for as long after that as we're required to for tax and financial record-keeping — payment records typically need to be kept for several years under federal tax rules. Outside of that, if you close your account we delete what we're not obligated to retain.

In Settings, you control whether riders see your photo, your city, and any notes riders leave — those are on by default and you can turn each off independently. You also control whether we text or email you, separately from the account activity we need to notify you about either way (like a payout landing).

If you're a California resident, state privacy law (the CCPA/CPRA) gives you the right to know what we've collected about you, request deletion, and opt out of the sale of personal information. We don't sell personal information, so that last one is already true by default. Whether the CCPA formally applies to a company our size depends on revenue and user-count thresholds we may not meet yet — but we're extending the same access and deletion rights to everyone who asks, regardless of where you live or whether the law technically requires it of us yet. Email help@curbtip.com to make a request.

We rely on Stripe for anything touching a card number or bank account, which keeps the most sensitive data out of our systems entirely. What we do hold, we protect with standard safeguards like encryption in transit. No system is unbreakable, and we'll tell you directly if something happens that puts your information at risk.

Signing in. We never store a password. Sign-in uses a one-time code texted to your number (sent through Twilio, our SMS provider, which processes your number to deliver it), or a passkey. If you add a passkey, your face or fingerprint never leaves your device — we store only a public key and a name for it (like “iCloud Keychain”), which can verify you but can't impersonate you and is useless to a thief on its own. You can see and remove your passkeys in Settings any time.

Abuse prevention. We rate-limit sign-in attempts and monitor for automated or fraudulent traffic. That processing exists to protect your account and money, and it's limited to what that protection needs.

Curbtip isn't directed at anyone under 18. Drivers must be 18 or older to receive payouts under Stripe's own rules, and we don't knowingly collect information from children.

We'll update this page as the product changes and update the "Last updated" date above whenever we do. Like the Terms, this document has not yet been reviewed by a privacy lawyer — see the notice at the top of this page.