Sanitized evidence only
The service accepts only a driver-confirmed, flattened PNG produced by the local crop and redaction workflow. It rejects unsupported content or unavailable encrypted storage before evidence is retained.
Screenshot privacy
A driver-selected image, not continuous monitoring
Driver Safe Screenshot Mode begins only when the driver deliberately selects or shares an image. It never requires a platform password and does not control the platform application.
Policy draft reviewed July 24, 2026
Lifecycle
What happens to a screenshot
- 1. Capture or selectThe driver starts a one-frame browser capture or chooses an operating-system screenshot. There is no recording or background monitoring.
- 2. Sanitize locallyThe original remains in browser memory while the driver crops to trip and cost information, covers private details with solid redactions, and creates a new metadata-free PNG.
- 3. InspectThe driver inspects the exact flattened image. Customer and driver names, faces, contact details, precise addresses, messages, access instructions, and account or order identifiers must not be visible.
- 4. Upload evidenceOnly the confirmed sanitized PNG is uploaded. The original is not uploaded. The sanitized derivative is encrypted as private account evidence.
- 5. Confirm fieldsThe driver enters and confirms the pay, tip certainty, generalized locations, mileage, time, item count, and costs used by deterministic scoring.
- 6. Retain or deleteSanitized evidence expires after 90 days. The driver can view, download, or delete it sooner from the authenticated account.
Never collected by design
Platform passwords, authentication codes, payment card data, private messages, continuous screen recordings, and unrelated application content are outside the offer-analysis purpose.
Training choice
Driver screenshots must not be used to train a model without a separate, optional, revocable consent. Product use and model-training consent are distinct choices.
Driver controls
The authenticated account shows evidence status and expiry and provides private view, download, and deletion actions. Account export and deletion remain separate controls.