Privacy policy

Last updated 18 October 2026

Who we are

Dhaka Metro Rail is an independent app for planning trips on the Dhaka Metro, made by Gazi Masud. It is not affiliated with Dhaka Mass Transit Company Limited (DMTCL) or the Government of Bangladesh. Contact: gazi@gazimasud.com.

What we collect

An account is optional. If you choose “Continue without account”, we don’t collect your email or any account data: everything you save stays on your device. (Our host still sees your IP address, as with any website; see Service providers.) If you create an account, we collect:

• Account details. Your email address and password. We use them to sign you in and to send account emails you ask for, such as a password reset. Passwords are stored hashed (scrambled) by our sign-in provider, Supabase, and are never stored in the app.
• Account ID. A random ID that Supabase gives your account.

What stays on your device

• Location, only when you ask. When you tap “Find nearest station”, your phone asks for permission and then uses your precise location on your device to find the closest station. Your location is not sent to us or anyone else, and it is not stored.
• Saved items and settings. Saved stations and trips, Home and Work/School, recent trips and searches, language and theme are stored on your device only.
• Sign-in token. If you have an account, a sign-in token is kept on your device so you stay signed in and can open the app offline.

What we do not do

We do not sell your data, share it with advertisers, show ads, or use analytics or advertising trackers.

Service providers

The app is hosted by Vercel (vercel.com). Accounts are handled by Supabase (supabase.com), whose servers for this app are in Mumbai, India. Like any website, Vercel receives your IP address and basic browser details when you use the app. Supabase receives them only when you sign up, sign in or use your account, and keeps them with your sign-in session while you stay signed in. Both keep them briefly in security logs. We do not use this to work out your location.

How long we keep data

If you have an account, we keep your email address and account until you delete it. When you delete it, your email address, password, account ID and sign-in sessions are removed immediately. Our providers’ security logs (sign-in events and request logs, which can include your email or IP address) are kept for a short time and deleted automatically, usually within a few days.

Deleting your account

You can delete your account at any time in the app (More → Account → Delete account) or on the web at /delete-account. Deletion is immediate and permanent. Saved items and settings on that device are cleared too. If you can’t sign in, email gazi@gazimasud.com from the address you signed up with and we will delete the account for you.

Security

All data is sent over encrypted connections (HTTPS).

Children

The app is not directed at children under 13.

Changes

If this policy changes, we will update this page and the date at the top.

Contact

Questions about privacy or your account: gazi@gazimasud.com.