Privacy Policy

Effective October 7, 2026

Dorazim shares location only after the user explicitly starts sharing. Sharing continues for the selected duration while the phone is locked or the app is not on screen, and the user can stop it at any time.

Controller and contact

Dorazim is operated by Dan Drahy. Privacy questions and deletion requests can be sent to dorazim@dorazim.app.

Data processed

Dorazim processes precise device location, a current locality name derived on the phone from those coordinates, timestamps, optionally shared speed, bearing, accuracy and optional altitude; a selected destination, address, travel mode, planned route, distance and arrival estimate; optional pickup or drop-off places, manually entered names or nicknames, each stop's purpose, and its current progress status (waiting, approaching, delayed, picked up, dropped off or skipped); optional live-journey incident reports containing their type, optional clarification of involvement or weather condition, selected point or route segment, time, active or ended state and any manually entered note; reports of objectionable notes containing the note text, selected reason, time and review state without requiring the reporter's name or account; random tokens required to operate a sharing link; and ordinary connection and security log data such as IP address, browser and device type. For a private Find each other meeting, it also processes both participants' names or nicknames, selected travel modes, latest precise locations, the meeting point and short-lived invitation tokens. Dorazim does not require an account, phone number or access to contacts.

Purpose and disclosure

Data is used only to provide live journey sharing or a mutually confirmed private meeting, display the route, location and reported incidents to authorized recipients, calculate remaining time, and keep the service secure and reliable. It is not sold or used for advertising, profiling or user analytics. Anyone who receives a public journey link can view that journey, including its incident notes, and may forward its link. A private meeting has no public viewer: precise locations become visible only to the two app users who explicitly confirmed the connection. The short code or invitation alone never reveals a location, expires quickly and cannot be reused after joining.

For a specific pickup or drop-off, the sender may also send a view focused on that person. It is a version of the same public journey link: the recipient sees the same live map, complete route, destination and viewer controls as with the ordinary link, with that person highlighted in the overview. It is not a separate restricted or private view and may be forwarded by its recipient.

Shared-content rules

Before first starting sharing, the app asks the user to accept the separate sharing rules. A recipient can hide a custom incident note only in their browser or report it. Reported text is temporarily hidden from all link recipients pending review; it becomes available again if the report is dismissed and is removed if upheld. A browser's local hide preference remains in effect.

Service providers

Data is technically processed by the server hosting provider. The Android app uses Google Maps Platform for maps, place search and route calculation. The public web viewer and the in-app viewer of others’ journeys use Maps JavaScript API for a valid journey. Google may receive the IP address, device metadata, viewed map area and map-service usage information. Viewing requires no viewer location, and displaying the sender’s location does not send a new route-calculation request. The viewer also uses Leaflet and the unpkg CDN. If the Google map cannot load, it may use OpenStreetMap, Esri or OpenTopoMap for the selected map type; those providers then receive requests for the viewed area, the IP address and technical metadata needed to serve the map background.

Optional Google Play purchase

Dorazim offers an optional one-time Dorazim Supporter purchase. Google Play processes the payment and payment details directly under Google's terms and privacy policy. Dorazim does not receive or store a card number, bank account or other payment credential. The app checks the entitlement with Google Play and keeps only an active-supporter flag in the phone's private storage; it does not send a purchase token, order ID or payment history to the Dorazim server.

Location during active sharing

Dorazim normally requests precise location while the app is in use. After the user explicitly starts sharing, an Android foreground service with a persistent visible notification keeps collecting and transmitting location when the screen is off or locked or another app is visible. If a phone still suspends updates, Sharing reliability lets the user optionally allow location all the time and unrestricted battery use. “Allow all the time” is used only during a sharing session started by the user, never for hidden or automatic tracking. Collection stops when the selected time expires or the user stops sharing, and both optional settings can be revoked at any time in Android settings.

Importing a destination from Waze

When the user chooses to share a Waze journey with Dorazim, the temporary Waze link is sent to the Dorazim server and Waze only to retrieve its destination. Dorazim does not store the Waze link or token. The resulting destination may be stored with a Dorazim sharing session after the user starts sharing.

Optional detection of leaving the car

After enabling the separate option and granting physical activity permission, Dorazim uses Google Play services transitions between driving, walking and stillness together with GPS during active sharing. This changes the car symbol to a walker near a stop or destination. Sensor events are processed only in phone memory and are not sent to the server. The derived current walking flag is sent with public location to the server and is visible to link recipients. It is not sent while public location is paused. During a connection outage it may be temporarily stored with pending points on the phone; the server stores it only with the session's latest location, not as an activity history, until the session is deleted under the rules below. The option is off by default, can be disabled at any time and does not change manual place handling. It does not read health records, step counts or Health Connect.

Security, retention and deletion

Watched journeys in the app keeps up to 20 shared links and optional local labels in private on-device storage. These records are excluded from system backup and can be removed individually. Viewing a link fetches its current public data over HTTPS; it does not start sharing or the viewer's location. Removing a saved link does not change the other person's journey or a separate browser notification subscription.

A public-link viewer can voluntarily enable web notifications and grant browser permission. To deliver them we store the browser-assigned subscription endpoint, its encryption keys, the followed journey reference, any person focus, the selected language and timezone for local times for at most 30 days. The viewer can disable that journey's subscription; it also ends when sharing ends or expires, or when the followed person becomes unavailable. Meaningful-event records last at most two days and pending messages at most six hours. The browser provider's push service (for example Google, Mozilla, Apple or Microsoft) processes the delivery endpoint and encrypted message. Displayed text contains shared place and passenger labels, their new states and changed times or stay durations so the update is understandable without opening the journey. Endpoint labels follow the sender’s public address settings; coordinates, movement trails and incident notes are excluded. Person-focused links omit other passengers’ details. Text may be visible on the lock screen. The browser locally keeps a secret for unsubscribing. Notifications do not require the viewer's location.

In-app watched-journey notifications are a separate voluntary subscription using Google Firebase Cloud Messaging. After explicit opt-in and Android notification permission, the app obtains a delivery token; our server stores that token, the app variant, the journey reference, any person focus, language and timezone for at most 30 days. Google processes the installation identifier and information needed for delivery. Notifications contain the same shared place and passenger labels, new states and changed times or stay durations as browser alerts above, with the same passenger-focus and public-address restrictions. Google also processes this delivery text, which may be visible on the lock screen; tapping one loads the current journey over HTTPS. Disable the subscription in the Journey menu independently of saving a link, your own sharing or browser notifications. The app immediately stops displaying that journey’s notifications and deletes the server subscription when a connection is available. Subscriptions also end after completion, expiry or removal of the followed person. When all native viewer and creator subscriptions have ended, the app disables automatic registration and requests deletion of its token and installation ID from Google. Native subscriptions and their local authorization credentials are excluded from system backup. We do not use Firebase Analytics; watching requires no viewer location.

Waiting reminders for a planned journey are another voluntary creator subscription using Firebase Cloud Messaging, enabled separately for each plan. We store the delivery token, app variant, language, timezone, plan reference, consent and last reminder time for at most 30 days without renewal. After the planned start, a link recipient may remind its creator at most once per 10 minutes for the entire link. We do not identify the waiting viewer. The message contains the planned date and time and may appear on the lock screen. Starting or deleting the plan ends availability; opting out immediately rejects local messages and deletes the server subscription when online. The token and installation ID are deleted after all native viewer and creator subscriptions end. Consent and private authorization credentials are excluded from backups. A reminder never starts or stops your own sharing.

Data is encrypted in transit using HTTPS. Write access is protected by a private random token stored in the app's private storage. Detailed sessions, route points, journey incidents and reports about objectionable notes are automatically deleted no later than 30 days after the session's last activity. Operational security logs are kept for no more than 30 days unless a security incident or legal obligation requires longer retention. Local hiding, the submitted-report state and the secret used to withdraw that report are stored only in the browser's local storage for the journey link. Hiding can be undone with “Show note”; local records can be cleared with the site's data.

A private meeting stores only each participant's latest location, not a movement trail. Its session, latest positions and nicknames are removed no later than 24 hours after ending or expiry and are not added to the phone's journey history.

Dorazim also keeps a private on-device history of up to 100 recent journeys, including selected route details, recorded map points and journey incident reports, so the user can reopen or repeat them. The standard free version displays the newest 50 entries; the supporter purchase makes up to 100 available. Each journey may be associated with its own sharing link. Deleting that history entry in the app invalidates the link and removes the corresponding session, location points and incident reports from the server.

The private on-device storage also keeps up to 100 most recently confirmed searched places so they can be selected again. The standard version displays the newest 50 and the supporter purchase makes up to 100 available. This history is not stored on Dorazim's server.

Android may include a safe copy of journey history without private control tokens and the place-search history in an encrypted Google system backup or a direct device-to-device transfer. This is used only for possible restoration after a new installation. Backup creation and restoration are controlled by Android, the user's backup settings and Google Account, so Dorazim cannot guarantee or force them. Active sharing, private control tokens, pending upload points and reminders are not backed up. Clearing app data or uninstalling removes the local copy; an earlier encrypted system backup may be restored during a later installation and can be managed in Google backup settings.

Earlier server deletion can be requested at dorazim@dorazim.app; the relevant sharing link may be needed to identify the session.

User choices and children

The user chooses whether to start sharing, who receives the ordinary or person-focused link or invitation, the duration, whether speed is included on the public link, whether viewers see exact start and destination addresses or street names without house numbers, and when to stop. A private meeting starts only after confirmation on both phones, and either participant can stop it immediately for both. After speed sharing is disabled, new speed values are not sent to the server and the public link identifies speed as hidden. When exact endpoint addresses are hidden, the server keeps them for the journey but removes their house and building numbers from the public journey data and link preview. Android permissions can be revoked at any time. Dorazim is not designed for children and must not be used for covert tracking of another person.

Third-party terms and changes

See the Google Privacy Policy, Google Play Terms, Google Maps Terms and OpenStreetMap Foundation Privacy Policy. Material changes to this policy will be reflected on this page with a new effective date and, where required, a new notice or consent.