Cookie Policy
The cookies and similar technologies used on the Pickup Charter website and apps, what each one does, which need your consent, and how to change your choices.
Updated 2 November 2026 · 10 min read
Version 3.0. Effective 2 November 2026.
In short
- The website sets no analytics or advertising cookies today. Our host, Vercel, logs each request.
- The app keeps you signed in and remembers the settings you choose. Sign in, booking and fraud protection do not work without the essential technologies, so they run without asking.
- Analytics in the app asks for your consent at first launch and runs only if you say yes. Saying no costs you nothing.
- We use no advertising cookies. We do not track you across other companies' websites or apps, build advertising profiles or sell this data. Marketing emails you agreed to may tell us they were opened.
- Every provider is named in the table in clause 8.
- Change your choices in the app at Profile > Privacy and your data > Tracking.
This summary is for convenience only. The numbered clauses below govern.
1. About this Policy
1.1 This Policy is issued by Pickup Technology Limited, RC 9548096, Lekki Phase 1, Lagos State, Nigeria, trading as Pickup Charter ("Pickup", "we", "us"). It covers the Pickup Charter website and mobile app (the "Platform").
1.2 It supplements our Privacy Policy and forms part of the Terms of Use. Where a technology collects personal data, the Privacy Policy applies to that data in full.
1.3 It is written to meet the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025 (GAID) and, for visitors in the United Kingdom and European Union, the Privacy and Electronic Communications Regulations 2003 and the ePrivacy Directive.
1.4 In this Policy we call cookies, local and session storage, pixels, tags, server logs and software development kits ("SDKs") together "Storage Technologies", because what matters is what they do. A Storage Technology is first party when we set it and third party when a provider we use sets it. Every third party is named in clause 8, and on our Sub-processors page.
2. Why we use these technologies
2.1 We use Storage Technologies to:
(a) keep you signed in to the app and keep your account secure; (b) let you search, book, pay and follow a trip; (c) detect and prevent fraud and misuse; (d) remember the currency and display settings you choose in the app; (e) understand, on pseudonymised data, how the app is used so we can fix faults and improve it, if you allow it.
2.2 We use no advertising, marketing measurement or attribution technologies, apart from the email pixel in clause 4.2. We do not use Storage Technologies to track you across other companies' websites or apps, to build interest profiles, for real time bidding or programmatic advertising, or to share data for anyone else's advertising.
3. Cookies
3.1 A cookie is a small text file a website places in your browser so it can recognise the browser on a later visit. Session cookies expire when you close the browser. Persistent cookies stay until their expiry date or until you delete them. Local storage and session storage in your browser work in a similar way, and we treat them in the same categories.
3.2 Our website. The website sets no cookies of its own and runs no analytics or advertising technology.
3.3 Payment pages. When you pay, Flutterwave's secure checkout opens as its own page. Flutterwave may set its own cookies there for payment integrity and fraud prevention, under its own privacy notice.
4. Pixels, tags and similar technologies
4.1 A pixel or tag is a small piece of code in a web page or an email that tells a server that the page or email was loaded. Our website pages have none.
4.2 Marketing emails you have agreed to receive may contain a pixel that tells us whether the email was opened and which link was used, so we can send fewer, more useful emails. Service emails about your account, Bookings, payments and safety are not used for this. You can stop email pixels by turning off automatic image loading in your email app, and you can stop marketing emails at any time (clause 4.4 of the Privacy Policy).
5. Server logs
5.1 When your browser or device connects to the Platform, our hosting providers (Vercel for the website, Supabase for the app) automatically record technical data such as your IP address, the date and time, the page or screen requested, and your browser or app version. We use these logs to run, secure and fix the Platform. They are strictly necessary. Website server logs are kept for up to 90 days, and app and system logs only as long as the Privacy Policy allows.
6. SDKs in the app
6.1 The app uses SDKs and device storage instead of browser cookies. An SDK is code from a provider built into an app to deliver a feature, such as maps, sign in, push notifications or error reporting. On first launch the app asks whether you allow analytics. You can change your answer in Profile > Privacy and your data > Tracking.
6.2 The app does not track you across other companies' apps or websites, does not read your device's advertising identifier, and contains no advertising or marketing attribution SDKs. For that reason the iOS app does not show the App Tracking Transparency prompt. If this ever changed, we would update this Policy first and ask your permission through App Tracking Transparency on iOS and the equivalent controls on Android. See clause 9.7 of the Privacy Policy.
6.3 Face ID and fingerprint unlock. If you use Face ID or a device biometric to unlock the app, the check happens on your device. The app stores only a setting that unlock is on. Pickup never receives your Face ID or fingerprint data.
6.4 Sign in. The app keeps a secure session token in your device's protected storage (the iOS Keychain or Android Keystore) so you stay signed in after you enter your email code or sign in with Apple or Google. Signing out or deleting your account removes it.
7. Device information
7.1 To deliver and secure the Platform we read basic information about your device: its type, operating system and version, language, time zone, app version, screen size and network type, and a push notification token if you allow notifications. Device location is used only as described in clause 6 of the Privacy Policy. We do not use device information to fingerprint you for advertising.
8. Third parties and every technology we use
This table is complete at the date above. If a technology is not listed, we do not use it. A new one is added here, and on the Sub-processors page, before it runs.
| Provider | Where | Category | Purpose | Lasts up to |
|---|---|---|---|---|
| Vercel | Website | Strictly necessary | Hosting, delivery and server logs | Not stored on your device |
| Pickup Charter (first party) | App | Strictly necessary | Session, booking flow and security tokens | Session to 12 months |
| Pickup Charter (first party) | App | Settings you choose | Currency, display settings and dismissed notices | Until you change them or remove the app |
| Supabase | App | Strictly necessary | Authentication and session management | Session to 12 months |
| Flutterwave | Payment pages | Strictly necessary | Payment session integrity, 3D Secure and fraud prevention at checkout | Session |
| Google Maps Platform | App | Strictly necessary | Maps and place search in the booking flow and live trip view | Session |
| Expo, Apple and Google push services | App | Strictly necessary, if you allow notifications | Push token for trip and account notifications | Until you sign out or turn notifications off |
| Sentry | App | Strictly necessary | Error monitoring, minimised at source | Session |
| PostHog (EU hosting) | App | Analytics, only with your consent | Product analytics on pseudonymised data | 26 months |
8.1 Google Maps is strictly necessary because a Booking cannot be made, and a trip cannot be followed, without it. It runs only inside the booking flow and trip view. Google's own terms and privacy policy also apply. See the Third Party Services Terms.
8.2 Cookie names. Providers sometimes change the names of the individual cookies they set when they update their software. The provider, category, purpose and maximum duration in this table do not change without an update to this Policy. You can see the names of the cookies on your device in your browser settings, and we will send you a current list on request.
9. The categories
| Category | What it does | Consent needed | Lasts up to |
|---|---|---|---|
| Strictly necessary | Sign in, session, booking flow, payment integrity, security, fraud protection, error monitoring, server logs | No. The Platform cannot work without it | Session, or 12 months for security and sign in tokens |
| Settings you choose | Currency, display settings, dismissed notices | No. They are stored because you set them | Kept in the app, until you change them or remove the app |
| Analytics | How the app is used, on pseudonymised data | Yes, asked at first launch | 26 months |
9.1 We use no marketing, advertising or attribution technologies, on the website or in the app. The only exception is the pixel in marketing emails you have agreed to receive (clause 4.2), sent through our email provider, Resend.
10. Your choices and how to change them
10.1 In the app. On first launch the app asks whether you allow analytics. Yes and No are equally prominent. PostHog runs only if you say yes.
10.2 On the website. The website has no banner, because nothing on it needs your consent today. If that changes, we will ask before anything optional runs.
10.3 Changing your mind. Use Profile > Privacy and your data > Tracking in the app. A withdrawal takes effect immediately. We delete, or let expire, anything set under it.
10.4 Your browser. You can block or delete cookies in your browser settings. If you block cookies on a payment page, the payment may not complete.
10.5 Your device. You can turn off notifications, location and other permissions in your device settings at any time. Some features, such as following a trip or confirming your pickup point by location, will then not work, but you can still book.
10.6 Global Privacy Control. Nothing on the website needs your consent today, so there is nothing for a Global Privacy Control signal to switch off. If we add something that does, we will treat that signal as a refusal. Older "Do Not Track" signals have no settled meaning.
10.7 Record of your choice. Your analytics choice in the app is recorded with your account, with the time you made it. Your website choice stays only in your browser, so we hold no record of it.
11. Changes
11.1 A new provider, category or purpose is added here, and on the Sub-processors page, before it goes live. Where it needs fresh consent, we ask again. Material changes follow the notice rules in clause 18 of the Privacy Policy. Routine changes that do not affect purpose, category or duration are reflected by updating the table and its date.
12. Contact
12.1 Questions: privacy@pickupltd.com, for the attention of our Data Protection Officer.
12.2 You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng at any time. UK and EU visitors may also complain to the authorities named in clause 13 of the Privacy Policy. Our Dispute Resolution page explains how we handle complaints.
Questions about this document?
Email legal@pickupltd.com or write to Pickup Technology Limited, Lekki Phase 1, Lagos State, Nigeria. For help with a booking, use Help in the app.
Contact legal