Privacy policy

Last updated: 19 October 2026

Transport Book is fleet and transport management software published by R R Infotech (“we”, “us”). This policy covers the Transport Book desktop application for Windows and macOS, the web app at my.transportbook.app, the Transport Book mobile application, the Transport Book Driver application, the Transport Book server those apps work with, and this website. It explains what information the software handles, where it is kept, who else receives it, and the choices you have.

We do not sell your information, we do not share it with advertisers, and we do not use your business records to train models or build advertising profiles.

Where your business data is kept

The operational records your organisation creates — trips, parties, vehicles, employees, job cards, inventory, accounts, transactions, and the details of attached documents — form your organisation’s workspace. We host that workspace on the Transport Book server we operate. Each organisation’s records are kept in a database of its own, separate from every other organisation’s: with Turso, a managed database service, or, for some organisations not yet moved to it, a MongoDB database we operate. Sign-in accounts, organisation memberships, and a few indexes the server needs to find an organisation (the list of shared links, and which phone numbers belong to which organisation’s drivers) are kept in a separate administrative MongoDB database.

The desktop app is offline-first: it keeps a full copy of the workspace in a local database (SQLite) in your user profile on your own device, works without a connection, and synchronises with the workspace on our server when it can. If your organisation has instead entered a database of its own in the app’s sync settings, the desktop synchronises with that database directly, and those records do not pass through our server.

The web app works on the workspace held on our server. The browser keeps your sign-in for the open tab and a few preferences; it keeps no copy of your records between sessions.

The mobile app reads the workspace through our server and, for organisations whose workspace we host with Turso, records changes there too — for example a job card, a payment received, or a trip update. When you share a bilty, an invoice, or a statement from the phone, our server prepares the document, the phone turns it into a PDF, and it goes to whichever app you pick in the share sheet.

The Transport Book Driver app is for drivers of organisations whose workspace we host with Turso. It shows the driver their assigned trip, the truck’s document expiries, and their own account, and it sends our server the trip steps, photos (loading slips, bilty, PODs, receipts), expenses and advances, and vehicle problems the driver records. Money a driver reports waits for the office to approve it. Entries made without a connection are kept on the phone until they can be sent.

We use the records in a workspace only to provide Transport Book to that organisation: to store and synchronise them, to run the features its users open, and to help when the organisation asks us to. To investigate a problem, we may copy an organisation’s workspace into our own development environment.

Information we do receive

Account and sign-in

Signing in, refreshing your session, and managing users in your organisation contact the Transport Book server. This handles your user name, organisation, role and membership, and the resulting session tokens. We use it only to authenticate you and to apply the permissions your organisation has granted. Which sessions have been signed out or revoked is kept in Upstash, a hosted Redis service, which the server also uses for short-lived cached results (for example, recent vehicle-tracking data).

Driver sign-in

A driver signs in to the Transport Book Driver app with a mobile number that their organisation has entered and switched on. The one-time code is sent and checked by Firebase Authentication, a Google service, which therefore receives that phone number. The app then exchanges Firebase’s confirmation for its own session with our server and does not use Firebase again until the driver signs out. A number the organisation has not switched on cannot sign in, and switching it off ends the driver’s access.

Location

The Transport Book Driver app shares the phone’s location only when two things are both true: the organisation has switched on location tracking for that truck (it is off by default, and meant for a truck without a GPS unit), and the driver’s trip is between loading and delivery. It then records the location in the background, at most about once a minute, and sends it to our server in batches. Tracking stops at delivery, at sign-out, or as soon as the organisation switches it off. The server keeps the truck’s latest position and a compacted record of its route and stops with the organisation’s records. On Android the app explains this before the system asks for permission, and a driver who refuses can still use everything else.

The mobile app asks for your location only while it is open, to centre the live map and to place a geofence where you are standing.

Notifications

The phone apps register the phone for notifications with our server, which sends them through Expo’s push service (Expo passes them to Google’s or Apple’s notification service). A notification is a short message: for a driver, a trip assigned, a status the office changed, or the office’s decision on an expense; for office staff, approvals and a morning summary of what needs attention, such as the number of documents expiring. You can turn notifications off in your phone’s settings.

Diagnostics and crash reports

The apps and our server send crash reports and a sampled share of performance traces to Sentry, so we can find and fix defects. A report contains the error, the stack trace, the app version and build revision, whether the copy was installed from a store or downloaded directly, and basic operating-system and device information. Reports from the phone apps also carry the internal identifiers of the signed-in account and its organisation and the account’s role, so a fault can be traced to the right workspace; reports do not carry your name, phone number, or email address, or your trips, parties, financial records, or documents. Our server also sends its own logs, traces, and measurements to Grafana Cloud so we can operate it. The measurements — request counts, timings, error rates — never name your organisation, your account, or your records; the logs and traces describe the requests the server handled and can include the internal identifiers of the organisation and account involved.

Usage statistics

The desktop app, the web app, the two phone apps and this website collect usage statistics through Google Analytics. From the apps: which screens are opened, how often the app is launched and signed in to, the app version and the operating system, and, in the browser, how often the connection drops. The phone apps report through Firebase Analytics, which also records the phone model, how long the app is in use, when it was first opened or updated, and an approximate region worked out from the network address; advertising identifiers are never collected. From the website: page views, downloads and similar events, including when a shared statement is opened. Each install or browser is identified by a random number that is not derived from your device, your account or your organisation. An event names a screen or a page, never a record, a party, a file or anything you typed, and a shared statement’s link is never sent.

Shared links

When someone in your organisation shares a statement as a link, a snapshot of that statement is stored on our server and shown to anyone who opens the link — after the password, if one was set, which we store only as a one-way hash. The snapshot does not change when your records do. A link stops working when it expires or is revoked, and the snapshot is deleted 30 days after that.

Services used only when your organisation turns them on

Several features connect to outside services. Each is optional, each is off until your organisation configures it, and each sends only what that feature needs to do its job. Credentials for these connections are encrypted before they are stored and are kept with your organisation’s workspace, so its desktops, the web app, and the phones can use them; our server decrypts them only to carry out the feature on your behalf. When a feature is in use, that provider’s own privacy policy also applies to the data it receives.

• Document storage — attachments are stored in the Google Drive, Microsoft OneDrive, Amazon S3 or S3-compatible storage your organisation connects. Our server reads a document from there to show it in the web app, and lets a phone upload a photo straight to it. We do not keep our own copy.
• Documents without cloud storage — an organisation that connects no storage keeps its documents on its own desktops, and a phone, a browser, or another computer receives them directly from one of those desktops. Our server only introduces the two devices. When they cannot connect directly, the encrypted transfer is relayed through Cloudflare’s relay (TURN) service, which cannot read it.
• Maps, geocoding and routing — Google Maps and OpenStreetMap services receive the place names and coordinates needed to show a map, resolve an address, or draw a route.
• Vehicle tracking — our server fetches GPS positions from the tracking provider your organisation uses (iAlert, WheelsEye or Geomatics), to show vehicles on the live map and follow trips.
• Fuel cards — BPCL or Reliance (RIL) fuel-card services, for balances, card limits, and transaction history on the cards you register. Our server makes these requests, or the desktop does where a provider does not accept them from the server.
• Email — an invoice, statement, or payment reminder sent by email goes through our server’s email service. It is sent in your firm’s name through Transport Book, replies go to your firm’s address, and the message carries the recipient’s address, the text, and any attached PDF.
• WhatsApp — messages are sent from your organisation’s own WhatsApp Business account through Meta’s WhatsApp Cloud API, using the message templates your account has had approved. Meta receives the recipient’s number, the party and firm names, the document name and amount, and any attached PDF.

AI assistant

The desktop and web apps include an assistant that answers questions about your organisation’s records and drafts work such as a trip or a payment follow-up for someone to check and save. When it is used, the question and the records it looks up to answer it are sent from our server to an AI provider. The app names the provider in use; we use only providers whose terms keep what is sent out of model training. The assistant sees only what the person asking is allowed to see, and it never saves anything on its own. Our server counts how many requests each organisation makes each day; it does not keep the conversations, which stay in the open window and end when it closes. An administrator can switch the assistant off for the organisation in Settings.

Support access

If you allow support access in Settings, each visit by Transport Book support while it is active is recorded.

Permissions the apps ask for

The desktop app needs local file access to keep its database and your attached documents, and network access for the features above. The mobile app asks for camera and photo access when you photograph or attach a document, location access while it is open as described above, and permission to show notifications. The Transport Book Driver app asks for camera and photo access for trip photos and receipts, background location for trip tracking, and permission to show notifications. You can decline these and continue using the rest of the app.

Updates

Copies installed from the Microsoft Store are updated by the Store, under the settings you control there. Desktop copies downloaded from this website check our release feed for a newer version; that request carries the current version and platform, nothing more. The web app is updated when the page is reloaded. The phone apps download updates from Expo’s update service, or are updated through the store or the package you installed them from.

Website

We process the technical information needed to serve and secure this website; its usage statistics are described above. If you submit a demo request, the details you enter are emailed to us through Brevo, an email delivery service, so we can reply; the website does not store them in a database. The site is hosted on Cloudflare Pages, and the demo form uses Firebase App Check, with Google reCAPTCHA, to block automated abuse. Installers and their release information are downloaded from Google Cloud Storage, through Firebase.

If you start a free trial, we keep the details you enter — your business name, GSTIN if you give one, city and state, approximate fleet size, your name, email and mobile number — with your organisation’s account on our server, so we can run your trial, contact you about it, and allow one free trial per business. Your mobile number is verified with a one-time SMS code sent by Firebase Authentication, which uses Google reCAPTCHA to block automated sign-ups. The username and password you choose become your sign-in; the password is stored only as a salted hash.

How long information is kept

Your organisation’s records are kept for as long as your organisation keeps them in Transport Book; deleting a record in the app removes it from the workspace. If your organisation stops using Transport Book, write to us about exporting or deleting its workspace. Shared-link snapshots are deleted 30 days after the link expires or is revoked. Diagnostic reports are deleted automatically by our error-reporting provider after its retention period. Demo-request emails are kept while we are in contact with you and deleted when they are no longer needed. Free-trial registration details are kept with your organisation’s account, and deleted with it.

Security

Connections to our server and to third-party services use encrypted transport. Credentials for the connections listed above are encrypted before they are stored. Sign-in sessions expire and are renewed, and a renewal token presented a second time ends the whole session, so a copied token stops working. No system is perfectly secure, so keep your devices, your accounts, and any database or storage your organisation connects protected.

Children

Transport Book is business software. It is not directed at children and we do not knowingly collect information from anyone under 16.

Your rights

You may ask us what information we hold about you, ask for a copy, ask for it to be corrected, or ask us to delete it. Your organisation’s records are its own, so requests about them are usually handled by your organisation, directly in the app; write to us and we will help. We respond within 30 days.

Changes to this policy

If we change how the software handles information, we will update this page and move the date shown above. Continuing to use Transport Book after a change means the updated policy applies.

Contact

R R Infotech — [email protected]. Please put “Privacy” in the subject line so it reaches the right person.