Privacy Policy

Last updated: 8 September 2026

1. Who we are

MobilityPulse is a mobility-research programme operated by United Arab Emirates University (UAEU), Al Ain, United Arab Emirates ("UAEU", "we", "us"). UAEU is the controller of the personal data described in this policy.

For any privacy question, to exercise any of the rights described in section 14, or for help using the app, contact us at support@mobilitypulse.ae.

2. What this policy covers

This policy covers the MobilityPulse mobile apps for iOS and Android, the MobilityPulse web dashboard, and the research platform behind them. It explains what we collect, why we collect it, who can see it, how long we keep it, and what you can control.

We have written it to be read, not merely to be filed. Where the app does something that affects your privacy — background location, for example — this policy says so plainly.

3. Your participation is voluntary

MobilityPulse is a research study. Taking part is entirely voluntary, and the data you contribute is given with your consent. You may stop at any time: disable trip detection, sign out, deactivate your account, or ask us to delete your data. Choosing not to take part, or withdrawing after you have started, carries no penalty of any kind.

4. What we collect

Account and profile

• Email address and password (the password is stored only as a salted hash by our authentication provider; we never see it).
• Name, and optionally a phone number, profile photo and short bio.
• Email-verification status, account status, and the preferences you set in the app.

Demographic and household information, collected once through the "Tell us about yourself" questionnaire, because travel behaviour cannot be interpreted without it:

• Age group and gender.
• Nationality group and residence type.
• Employment status and, where applicable, employment sector.
• Whether you hold a driving licence, and the number of cars in your household.
• Household size and the number of children under 18 in the household.
• Household income band.
• Remote-working days and typical working hours.
• How often you shop online.

Several questions include a "prefer not to say" option. You are not required to answer any question you would rather not.

Trips. For each detected or manually recorded journey: start and end time, duration, distance, average and maximum speed, transport mode and mode detail, start and end coordinates, and — where you choose to provide them — trip purpose, notes, who travelled with you and how many, the cost in AED, and which of your registered vehicles you used together with its fuel type and efficiency.

Location. While a trip is being detected or recorded, the app collects a sequence of location samples: latitude, longitude, timestamp, accuracy, and where the device reports them, altitude, speed and heading. Together these form the route of the trip. Location sampling adapts to your movement and relaxes when you are stationary.

Background collection. So that journeys can be captured without you having to press anything, the app requests permission to access your location in the background — "Allow all the time" on Android, "Always" on iOS. On Android a persistent notification is shown while tracking is running, as the platform requires. The app collects location for trip detection and recording only. It does not collect location to profile you for advertising, and it does not sell location data.

Motion and activity. The app reads your device's motion sensors and the platform's activity-recognition service (for example: still, walking, cycling, in a vehicle) to decide when a trip begins and ends and to classify how you travelled. On iOS it also reads step counts from the device's pedometer. This is what allows detection to work without leaving satellite positioning running continuously — it is better for both accuracy and battery life.

Vehicles. If you register a vehicle: type, make, model, fuel type, fuel efficiency, and optionally a nickname, colour and number plate. The number plate is optional and is used only so you can tell your own vehicles apart; you may leave it blank, and you may delete a vehicle at any time.

Device and technical information. A device identifier, device model, platform, app version, and the timestamps of your records. We also store which device most recently claimed your account, so that a single account is used on one device at a time (see section 12).

App activity. A log of significant actions in your account — for example a trip saved or deleted, a vehicle added, a profile change, a sign-in — with a short description and timestamp. This log powers the activity view in your profile and lets us investigate support requests and security incidents.

Rewards. If reward campaigns are running: your sign-in counts and streaks, which rewards you have claimed, and whether a voucher email was successfully delivered to you.

What we do not collect. We do not collect your contacts, your photos, your messages, your calendar, your browsing activity, or your health records. The app contains no advertising SDKs and no third-party analytics or tracking SDKs. We do not buy personal data about you from data brokers, and we never sell your data.

5. What stays only on your phone

Some information never leaves your device:

• Your home location and its detection radius. If you use home-location masking, the coordinates you designate as home, and the radius you choose (10–500 m), are stored on the device only. They are not uploaded to our servers.
• Unfinished questionnaire drafts, until you submit them.
• Trips not yet synced, which are held in the app's local database until a connection is available.
• App preferences such as theme, units and map style.

6. Home-location masking

Home-location masking exists because the most sensitive point in any travel dataset is where you sleep. When you set a home location and enable the feature, automatic trip detection pauses while you are inside the radius you chose, so journeys are not recorded in that zone. You can set it, change the radius, or clear it at any time in Settings → Home Location. Using it is entirely your choice, and it can be turned on or off at will.

7. Why we collect this data

• To detect and record your trips — the core function of the app.
• To give you your own insight — trip history, maps, carbon estimates, cost and time analysis, and the analytics report you can export.
• To conduct the research — building transport models and studying travel behaviour, mode choice, demand patterns and emissions across the UAE, using pooled, de-identified data.
• To operate and secure the service — sync, authentication, abuse prevention, diagnosing faults and answering your support requests.
• To administer reward campaigns, where these are running.
• To communicate with you about your account, verification, password resets, service changes and — where applicable — vouchers.
• To send you study participation emails — reminders when no trips have been recorded for a while, summaries of your own travel and its impact, milestone and encouragement messages, prompts to complete missing trip details, and news about the research programme. These are optional: you choose which kinds you receive, or stop them altogether, using the link at the bottom of any of them, and doing so affects neither your participation nor any reward you have already earned.

We do not use your data to make automated decisions that produce legal or similarly significant effects about you. We do not use it for advertising or profiling for marketing.

Study participation emails are selected using your own activity in the app — for example how recently a trip was recorded, or whether your profile is complete. That is used only to decide whether, and what, to write to you about the study. It does not build a marketing profile, it is never shared with advertisers, and no automated decision about you follows from it.

8. The basis on which we process your data

We process your personal data on the basis of the consent you give when you create an account and agree to take part, and for the purposes of scientific research conducted in the public interest under UAEU's research-governance framework. Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, or another applicable data protection law, gives you rights in relation to that processing, we honour them (see section 14). You may withdraw your consent at any time; withdrawal does not affect processing already carried out, and does not affect data already de-identified and incorporated into research results.

9. Who can see your data

Access is enforced in the database itself through row-level security policies, not only in the interface. In practice:

• You can see and manage your own records — your profile, your trips, your routes, your vehicles and your analytics — and nobody else's.
• Researchers and ordinary administrators work with aggregated, platform-level insights. They cannot browse participant accounts or raw routes.
• A small number of designated super-administrator data custodians can access identifiable account, demographic, vehicle, trip and precise-location records where it is necessary for approved research operations, security, participant support or data-quality work. These accounts are individually appointed and their actions are logged.

10. Who we share it with

We do not sell your personal data, and we do not share it for advertising.

We share limited data with service providers who process it on our instructions, under contract, and only to run the platform:

• Supabase — cloud database, authentication and file storage, which hosts the platform.
• Google Play services — location and activity-recognition APIs, and Google Maps for rendering maps in the app.
• Apple — platform location, motion and map services on iOS devices.
• Resend — delivery of our email: account and verification messages, password resets, voucher notifications, and study participation emails. Resend receives your email address and the content of the message being sent, and reports back whether each message was delivered, could not be delivered, or was reported as spam. We record that so we stop writing to an address that is failing or whose owner has objected.

We may also disclose data where we are legally required to do so, or where it is necessary to protect the rights, safety or security of participants, the University or the public.

Research outputs. Findings are published in aggregate or de-identified form. Where a de-identified dataset is shared with academic collaborators or a research repository, it is shared under a data-sharing agreement that prohibits re-identification.

11. Where your data is held

The platform is hosted on managed cloud infrastructure, and our service providers may process data on servers outside the United Arab Emirates. Where data is transferred outside the UAE, we rely on providers who offer an appropriate level of protection and contractual safeguards covering security, confidentiality and permitted use.

12. Security

• All traffic between the app and our servers is encrypted in transit using TLS, and data is encrypted at rest by our infrastructure provider.
• Access rules are enforced at the database level (row-level security), so a flaw in an interface cannot expose another participant's records.
• The dashboard is role-gated; elevated access is limited to designated custodians.
• An account is used on one active device at a time. Signing in on a new device claims the account and signs the previous device out, which limits the damage a shared or stolen credential can do.
• On Android the app is excluded from device backup, so your local trip cache is not copied into a cloud backup outside our control.
• Passwords are subject to strength requirements and are never stored in readable form.

No system can be guaranteed absolutely secure. If a breach affecting your personal data occurs, we will act on it in line with our obligations and notify you and the relevant authority where the law requires it.

13. How long we keep your data

• While you participate, we keep your account, trips and related records so the app can show you your history.
• If you deactivate your account, records are retained but the account is disabled and tracking stops.
• If you ask us to delete your data, we delete your account and the personal data associated with it: your profile, trips, routes, vehicles, activity log and reward records.
• De-identified data already incorporated into research analyses or published results cannot be withdrawn, because it can no longer be linked to you and because research integrity requires that published findings remain reproducible.
• We may retain limited records for longer where security, audit, or a legal obligation requires it.

Research datasets are retained for the duration of the research programme and for the archival period required by the University's research-governance framework.

14. Your rights and your controls

In the app, at any time, you can:

• Turn home-location masking on or off, and change its radius.
• Correct the detected mode of a trip, edit its details, or delete individual trips.
• Add, edit or delete your vehicles.
• Export your trips as a file, and export your analytics as a PDF report.
• Manage notifications and quiet mode, units and theme.
• Change your password.
• Deactivate your account.
• Revoke location, motion or notification permissions in your device settings — the app will keep working, but automatic trip detection will stop.

Every study participation email carries a link to your email preferences, where you can choose which kinds you receive or stop all of them, without signing in. Essential messages about your account — verification, password resets, and vouchers you have claimed — are not part of that and continue regardless.

By writing to support@mobilitypulse.ae, you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your account and your personal data.
• Restrict or object to particular processing.
• Withdraw your consent and your participation in the study.
• Change or stop your study participation emails, if you no longer have a link.

We respond to these requests within a reasonable period, and in any event within the time limit set by applicable law. We may need to verify your identity first. If you are not satisfied with our response, you may complain to the competent data protection authority in the United Arab Emirates.

15. Children

MobilityPulse is intended for participants aged 16 and over. We do not knowingly collect data from anyone below that age without the consent of a parent or legal guardian. If you believe a child has enrolled without appropriate consent, contact support@mobilitypulse.ae and we will delete the account and its data.

16. Changes to this policy

We may update this policy as the research programme develops. The "last updated" date at the top always reflects the current version, and material changes will be brought to your attention in the app or by email before they take effect. Continuing to use MobilityPulse after a change means you accept the updated policy.

17. Contact us

App support, privacy and research questions: support@mobilitypulse.ae

Post: MobilityPulse Research Team, United Arab Emirates University, Al Ain, United Arab Emirates.

Questions? Email support@mobilitypulse.ae