Your name is not one secret. It is two.

When you book a ride, you give us your name. Most companies write that down and keep it. Here is what we do instead, and how you can tell whether we are actually doing it.

Why splitting it works

A surname on its own belongs to millions of people and points at none of them. Chen. Alvarez. Okafor. It is only when a family name is joined to a first name, a phone number, and the address where you will not be home on Tuesday, that it becomes you. So the two halves are encrypted separately, under two different keys, and the keys are never held together. Somebody who steals one vault is holding a list of surnames.

Your driver still knows who to meet

They are told your first name and nothing else. That is one vault opened on its own. The half that identifies a household stays shut for an ordinary ride.

Looking you up leaves a mark

To see a whole name, the owner has to sign in and write down why. That is not a formality:

• The reason is recorded, with the time and who asked.
• An alert goes out when it happens.
• Each record is locked to the one before it, so a record cannot be quietly changed or removed later without the break showing.

What we are not claiming

We are not saying nobody can ever see your name. The owner can, under a recorded reason, because a car service that cannot look up a booking cannot run. We are not saying nobody will try to break in. What we can say is that if they do, what they get is half a name, and that every time somebody looks, it leaves a mark that cannot be rubbed out.

The full privacy policy covers everything else we hold and why.