Privacy policy

MCGI Lift is a private, scheduled volunteer-ride coordination service for approved participants. This policy explains the information used by the service and the controls available to participants. The service does not support fares, tips, reimbursements, or payment processing.

Information we handle

• Google or Apple sign-in identity and the member identifier returned by the identity service.
• Registration details such as name, email, phone number, address, church membership or affiliation, baptism date, and local congregation; application answers, reviewer decisions, and required evidence. Driver applications also include licence and vehicle details for each submitted vehicle, with optional copies of the driver's licence and LTO Certificate of Registration (CR) and Official Receipt (OR). With separate consent, a driver may take a registration selfie for comparison with the licence by the assigned reviewer. No automated face recognition, biometric templates or liveness checks are performed. Copies and selfies are encrypted, restricted to the assigned review scope, and deleted under the application evidence retention policy. Accessibility needs can reveal disability or health information and are used for ride suitability.
• Ride requests, offers, confirmations, messages, boarding checks, and trip status.
• Exact meeting and destination details. Public ride discovery uses only general areas; exact details are limited to confirmed participants and authorized operations staff.
• Foreground location, shared automatically with device permission while a driver is online or a confirmed trip is active under the terms accepted at signup. On supported app versions, a driver may separately enable background location for an active confirmed trip, so booked passengers can continue following the trip when the driver opens another app. This requires additional device permission and shows the platform's location indicator or ongoing notification. Online availability alone never enables background location.
• If you enable device alerts, an installation identifier, a push delivery token, your device platform, and the registration expiry are linked to your member account. These credentials support notification delivery and are not used for advertising.
• Safety reports, blocks, private feedback, and the audit records needed to review them.
• Server security and reliability logs. Optional mobile app-launch and performance diagnostics are disabled in this release. Operational logs must not include message bodies, boarding PINs, identity documents, or exact locations.

For new Apple sign-ins, an encrypted provider refresh token is kept only to manage and revoke Apple authorization when the account is deleted. It is excluded from member exports and operational logs, then removed after revocation succeeds. Older accounts without a token have instructions for removing Apple authorization in Apple Account settings.

Why we use this information

Information is used to verify access, coordinate mutually confirmed rides, show the right trip details to the right participants, support safety review, prevent misuse, maintain service reliability, and meet accountable operational or legal obligations.

Disclosure and service providers

Information is disclosed only as needed to confirmed ride participants, authorized MCGI Lift reviewers and operations staff, and contracted infrastructure or notification providers acting for the service. Information is not sold and is not used for advertising. A valid legal request may require disclosure where applicable law requires it.

Google and Apple process sign-in requests. DigitalOcean hosts the web service and database; Expo provides app delivery and updates. Google Maps processes map views, place searches, coordinates, and route endpoints needed to display maps and coordinate rides. Names, membership records, messages, and boarding PINs are not sent in map requests. Google place IDs are retained with the ride; Google address details are resolved for display and are not stored in our permanent ride records. Google-derived coordinates are held in server memory for at most 24 hours. Device coordinates remain subject to the location retention rules below. Nearby vehicle displays use approximate, short-lived markers. Exact trip locations are limited to confirmed participants, authorized staff, and any trusted-contact link you explicitly create. A trusted-contact link can be revoked.

When you type in a residential address field, Google Maps receives the search text to suggest matching addresses. You can also enter your address manually. Google Maps use is governed by the Google Privacy Policy.

Optional device alerts use Expo with Apple notification services on iOS or Google's Firebase Cloud Messaging on supported Android versions. These providers receive the device delivery token and a generic activity message. Push payloads contain no member name, trip details, exact location, message content, or boarding PIN. Open the app and sign in to view the activity. Device alerts can be delayed and do not provide emergency monitoring.

Device alerts require a supported app version, enabled service configuration, your opt-in, and notification permission. Older Android versions support only the authenticated in-app inbox, which refreshes while open. The inbox remains available when device alerts are off.

Retention and deletion

Active account and ride information is retained while needed to provide the service. Members can request account deletion through the published account-deletion process. We complete deletion requests within 30 days and confirm completion. Security, safety, dispute, consent, and audit records may need to be retained after account deletion; the response to a deletion request will identify any information that cannot yet be deleted and the reason it must be retained.

Device alert registrations expire after 30 days without renewal. Turning alerts off or signing out removes the registration when the app can connect; offline removal is retried on a later launch or connection attempt. Approved account deletion also removes device registrations. An alert already handed to a provider may still arrive. To stop alerts on the device immediately, turn off MCGI Lift notifications in device settings.

Member choices

Location sharing during confirmed rides is included in the terms accepted at signup. Device permissions remain under your control. If permission is denied, the app explains how to restore it; manual pickup entry, trip details, cancellation, and safety help remain accessible. Foreground sharing stops when the ride ends or the app leaves the foreground. A driver's optional active-trip background sharing stops when it is turned off, the trip ends, the driver signs out, or the app process restarts. It is not automatically restored after a restart, and account credentials are not saved for background tracking. Passengers and drivers who are only online are not tracked in the background. Trusted-contact links require a separate action and can be revoked. Members may sign out, request profile corrections, or request account deletion.

Security and contact

MCGI Lift uses access controls, encrypted transport, restricted operations views, and audit records. No system can promise absolute security. For privacy questions or requests, email info@mcgi.org.au with “MCGI Lift privacy” in the subject line. Do not include identity documents or exact ride locations in ordinary email.

Adult-only pilot

The current pilot is for approved adult members. It is not intended for children and does not knowingly provide child accounts.