Khalasi Privacy Policy

Effective and last updated: September 24, 2026

This Privacy Policy explains how Khalasi handles information when drivers, khalasis, vehicle owners, and passengers use the Khalasi mobile application and related web pages.

The main privacy choice: A driver's live vehicle location and vehicle details become visible to passengers only after the driver chooses to start sharing. The driver can stop sharing at any time.

1. Information Khalasi handles

Anonymous account identifier

Khalasi uses Firebase Anonymous Authentication. Firebase creates a random identifier for the app installation or anonymous session. Khalasi does not require a name, phone number, email address, password, or social-media account to use the app.

Driver vehicle and route information

When a driver or khalasi enters vehicle information, Khalasi stores:

vehicle name, number, and type;
route starting point and destination, including their coordinates;
the anonymous driver identifier; and
the driver's consent record and update time.

The saved vehicle profile is retained so that the same details can appear the next time the driver opens the app. The driver may edit and overwrite these details.

Driver live location

After the driver explicitly starts sharing, Khalasi collects the vehicle's precise location and periodic update time. The active live record also includes the entered vehicle and route details. This information is used to place the vehicle on the passenger map and may be publicly readable through Khalasi's live-data service while sharing is active.

On supported Android devices, sharing may continue while the app is in the background or the phone is locked. Android displays an ongoing foreground-service notification while this happens. Khalasi does not request Android's separate background-location permission; the foreground service operates only after the driver starts it.

Passenger location

With permission, Khalasi uses a passenger's precise device location to find nearby vehicles, calculate straight-line distance, and estimate whether a selected vehicle is approaching. Khalasi does not save the passenger's precise location in Firebase. Map and device-location providers may process map tile requests, requested map areas, IP addresses, and other ordinary connection information needed to provide their services.

Searches and map services

Place-search text is sent to the Photon geocoding service to return matching locations. Khalasi temporarily caches search results in memory and does not save the search text in its Firebase database. Interactive map tiles are provided by OpenStreetMap, and the map interface loads the Leaflet library from a content-delivery network. These providers receive the network requests and normal technical information needed to respond.

Usage information

Khalasi stores privacy-limited operational counts, including:

the number of passenger map sessions;
the number of searches that return no live vehicles;
peak concurrent passenger sessions; and
peak active live vehicles.

A temporary anonymous presence record is used to calculate concurrent passenger use and is removed when the session ends or Firebase detects a disconnection. Khalasi does not store the passenger's search text or precise location with these metrics.

Google Analytics

Khalasi uses Google Analytics for Firebase to understand general app usage and improve reliability. Analytics may process app interactions, screen views, app-instance identifiers, device and app information, and general geographic information derived from network activity. Khalasi records privacy-limited events such as role selection, starting or stopping vehicle sharing, opening the passenger map, choosing a vehicle-type filter, using favorites, and sharing a vehicle link. Khalasi does not send precise GPS coordinates, route names, search text, vehicle names or numbers, Firebase user identifiers, or public vehicle identifiers to Analytics.

Crash and diagnostic information

Khalasi uses Firebase Crashlytics to identify crashes and improve app reliability. Crashlytics may process crash stack traces, crash time, app version, device and operating-system information, installation identifiers, and recent privacy-limited Analytics breadcrumbs. Khalasi does not intentionally attach precise GPS coordinates, route names, search text, vehicle names or numbers, Firebase user identifiers, or public vehicle identifiers to crash reports.

Information stored only on the device

Language choice, onboarding completion, and up to two passenger favorite vehicles are stored locally on the device. A favorite can contain a vehicle identifier, name, number, type, and route. Khalasi does not upload favorites to Firebase.

Support communications

If you contact support, Khalasi receives the email address, name, message, and any information you choose to provide. Do not send precise location or other sensitive information unless it is necessary to resolve your request.

2. How information is used

Khalasi uses information to:

show active vehicles and route details to passengers;
restore a driver's saved vehicle details;
find nearby vehicles and provide approximate distance and arrival information;
operate sharing, favorites, search, and user-requested link-sharing features;
measure basic service demand, reliability, and searches with no results;
prevent misuse, diagnose failures, and protect the service; and
respond to support, privacy, and deletion requests.

3. When information is visible or disclosed

Passengers and the public: While a driver is sharing, the live vehicle record—including its latest precise location, vehicle details, route, and update time—is available to passenger clients. A user may also share a vehicle link containing a random public vehicle ID. The link does not contain the driver's private Firebase Authentication UID.
Firebase services: Khalasi uses Google Firebase for anonymous authentication, Realtime Database hosting, privacy-limited usage analytics, and crash reporting. Google processes information to provide these services.
Map and place-search providers: Photon, OpenStreetMap, the Leaflet content-delivery network, and platform location services process requests needed for search, maps, or device location.
Legal and safety reasons: Information may be disclosed when reasonably necessary to comply with law, respond to a valid legal request, protect users, or address fraud and security issues.

Khalasi does not sell personal information, does not use personal information for targeted advertising, and does not include third-party advertising SDKs.

4. Retention and deletion

Live vehicle record: Khalasi requests deletion when the driver taps Stop Sharing. If the device is offline, forced closed, loses power, or cannot reach Firebase, deletion may be delayed until the service reconnects or Firebase detects the disconnection. Passenger clients also reject stale live records.
Saved driver profile: Vehicle and route details remain in Firebase for reuse until they are overwritten or deleted following a verified request. Uninstalling Khalasi does not necessarily delete this server-side profile.
Passenger presence: The temporary presence record is removed when the session closes or a disconnection is detected.
Aggregate usage metrics: Daily totals and peak counts may be retained as operational records. They do not contain passenger GPS coordinates or search text.
Local information: Favorites and preferences can be removed by clearing Khalasi's app data or uninstalling the app.
Support messages: Support correspondence is retained as needed to handle the request, maintain service records, and meet legal obligations.

Request deletion

To request deletion of a saved driver profile, anonymous account data, or support correspondence, email sevanstechlab@gmail.com with the subject Khalasi Data Deletion Request. Include the vehicle number and enough information to locate the record. Khalasi may request reasonable verification to avoid deleting another person's vehicle record.

5. Permissions and choices

You may decline location permission, but nearby-vehicle discovery and driver sharing will not work. You can change location and notification permissions in Android Settings. Drivers can stop live sharing from Khalasi or the Android foreground-service notification. Passengers can use the app without saving favorites.

6. Security

Khalasi uses HTTPS/TLS for network connections and Firebase access controls to restrict saved driver-profile access. Active live vehicle data is intentionally available to passenger clients so the service can function. No storage or transmission method is completely secure, and Khalasi cannot guarantee absolute security.

7. International processing

Service providers such as Firebase and map providers may process information on servers outside Nepal or the country where you use Khalasi. Their processing is governed by their own terms and privacy practices.

8. Children

Khalasi is a public-transport utility and is not directed to children under 13. Khalasi does not knowingly collect personal information from a child under 13. If you believe a child has provided personal information, contact support so the information can be reviewed and deleted where appropriate.

9. Changes to this policy

This policy may be updated when Khalasi's features, providers, or legal obligations change. The revised policy will display a new effective date. Material changes may also be announced in the app or through the app's store listing.

10. Contact and support

For privacy questions, support, or data requests:

Khalasi Support
Ganesh Sitaula
sevanstechlab@gmail.com