Access Policy

For a plain-language summary of what each user type can do, see User Capabilities. This document covers the detailed per-action rules and state-change behavior.

User Roles

A user's role is determined by their current subscription state, evaluated at the time of each action.

User type	Role
`subscriber`	Paid
`free` (quota remaining)	Free with Premium Rides
`free` (quota exhausted)	Free — Essential only

All access policies below assume status: active. Users with status: onboarding cannot access any app features — they are routed to the onboarding flow until it is complete. Users with status: banned or status: banned_final can sign in but are routed to the Ban screen — they cannot reach the main app UI. Users with status: to_be_deleted are routed to a dedicated "Account Pending Deletion" screen and cannot access the app. From that screen they can cancel the deletion request (if within the 7-day grace period) or create a new account (if the account has already been deleted). After 7 days without cancellation, the account is permanently deleted. to_be_deleted users are hidden from all lists and searches immediately upon entering this state.

Ride Tiers

For the Premium vs Essential feature comparison, see Ride Tiers in the Subscription doc.

Location sharing is read at START: When a rider taps Start, the app reads their current location sharing preference from profile settings. This snapshot governs sharing for that segment of the ride. A rider can Start and Stop multiple times within a ride's window — each Start re-reads the current setting. For Essential rides, sharing is always forced on regardless of the profile setting — the profile setting itself is not changed. The map shows a visible indicator to notify the rider that their location is being shared. Subscription or setting changes that occur while a segment is already running have no effect until the next Start.

OS-level location permission takes immediate effect. If the rider revokes location permission from device settings during an active navigation segment, location sharing stops immediately and navigation ends — the app cannot override OS permissions. The rider must re-grant precise location permission and tap Start again to resume.

Ride Access Policy

Feature	Subscriber	Free (quota remaining)	Free (quota exhausted)
Create Ride	Allow	Deny	Deny
Join / RSVP Ride	Allow	Allow	Allow
Read Ride	Allow	Allow	Allow
Update Ride	Allow if owner/admin	Allow if owner	Allow if owner of a ride created during an active subscription; Deny otherwise
Delete Ride	Allow if owner and ride not started	Allow if owner and ride not started	Allow if owner and ride not started
Transfer-Out Ride ownership	Allow if owner and ride not started	Allow if owner and ride not started	Allow if owner and ride not started
Transfer-In Ride ownership	Allow if eligible	Allow if eligible	Deny
Become Admin	Allow if member	Deny	Deny
Ride tier at START	Premium	Premium (quota consumed)	Essential (no quota consumed)

Admin promotion has no timing restriction. A subscriber can be promoted to ride admin at any point — before the ride starts, during an active ride, or after it ends. The same applies to group admin promotion.

RSVP does not consume quota. Any user — regardless of subscription or quota state — can RSVP (YES or MAYBE) to unlimited rides. Quota is only consumed when the user taps Start.

Free ride quota: Free users have 4 lifetime Premium Ride starts. The counter is lifetime — it does not reset on subscription purchase or expiry, or on account deletion and recreation. Quota is tied to the Firebase UID; reusing the same Google or Apple account after deletion carries the consumed quota forward.

START validations: When any participant taps Start, two checks run in order:

Precise location permission — required for navigation. If not granted, Start is blocked with an error. The user must grant precise location access from device settings and retry.

Ride tier — determined by the rider's current account state at the moment of Start (not at RSVP time): Subscriber → Premium. Free user with quota remaining → Premium (quota consumed). Free user with no quota → Essential (no quota consumed).

Once both checks pass, the rider's navigation begins and their individual start is recorded.

Ride flagged as started: When the first participant successfully passes Start validations, the ride is flagged as started in the system. A started ride cannot be deleted or cancelled by anyone — including the owner.

Quota consumed at first START per ride: Quota is tracked at the user+ride level, not per device or per session. The first time a free user (with quota remaining) starts a given ride — on any authenticated device — one quota slot is permanently consumed. Starting, stopping, and restarting the same ride on any device never consumes additional quota. If the user never starts a ride, no quota is consumed, regardless of RSVP status.

MAYBE → YES required before START: A user with RSVP status MAYBE who taps Start is prompted to confirm changing their RSVP to YES. The user must accept before Start proceeds.

RSVP locked after START: Once a user starts a ride, their RSVP is locked to YES. They cannot change their RSVP for that ride.

Quota-exhausted free users: After all 4 quota slots are used, free users can still RSVP and start rides — but they receive Essential features. No quota is consumed for Essential starts.

Pending ride caps: Two independent caps govern ride creation. A subscriber can own at most 4 pending (upcoming or on-going) rides at one time, across all owned rides (group and standalone combined). A group can have at most 4 pending rides at any time, regardless of who created them. Both caps are enforced at creation. See Pending Ride Cap.

Ride ownership transfer: Transfer-In requires the recipient to be a current participant with yes or maybe RSVP status and eligible to hold the ride: a subscriber (always eligible) or a free user with at least 1 quota slot remaining. A quota-exhausted free user cannot receive a ride ownership transfer. At the sender side, attempting to transfer to an ineligible recipient is a plain deny. At the receiver side, if the recipient was eligible when the offer was sent but has since become ineligible (e.g. subscription lapsed), they see an upsell screen when they attempt to accept. If they dismiss the upsell without subscribing, the transfer offer is cancelled and the sender is notified. Transfer offers expire after 7 days. If the recipient loses eligibility before accepting, the offer is auto-cancelled and the sender is notified. Ride ownership does not require admin status — admin is a separate, subscriber-only role. After a transfer, the former owner becomes a ride admin only if they are still a subscriber; otherwise they become a regular participant.

Group Access Policy

Feature	Subscriber	Free (quota remaining)	Free (quota exhausted)
Create Group	Allow	Deny	Deny
Discover Groups	Allow	Allow	Allow
Read Group	Allow	Allow	Allow
Join Group	Allow	Allow	Allow
Leave Group	Allow if NOT owner	Allow if NOT owner	Allow if NOT owner
Update Group	Allow if owner/admin	Deny	Deny
Delete Group	Allow if owner	Allow if owner	Allow if owner
Become Admin	Allow if member	Deny	Deny
Approve/Reject Join Request	Allow if owner/admin	Deny	Deny
Remove Member	Owner: any; Admin: members only	Deny	Deny
Regenerate Invite Code	Allow if owner/admin	Deny	Deny
Transfer-Out Group ownership	Allow if owner	Allow if owner	Allow if owner
Transfer-In Group ownership	Allow if current admin	Deny	Deny
Create Ride in Group	Allow if Group allows	Upsell if Group allows; Deny otherwise	Upsell if Group allows; Deny otherwise
Read Ride in Group	Allow if Group member	Allow if Group member	Allow if Group member
Update Ride in Group	Allow if Ride owner/admin	Allow if Ride owner	Allow if owner of a ride created during an active subscription; Deny otherwise
Delete Ride in Group	Allow if Ride owner and ride not started	Allow if Ride owner and ride not started	Allow if Ride owner and ride not started
RSVP Ride in Group	Allow	Allow	Allow

Subscriber-only ownership and admin: Owning or administering a group requires an active subscription. A free user can never create a group, hold group ownership, receive an ownership transfer, or be promoted to admin. The only owner-level actions a free user can perform are on a group they already own — and only to wind it down: transfer ownership to a subscriber, manage admins (to appoint an eligible transfer recipient), or delete the group.

Group ownership transfer: Transfer-In requires the recipient to be a current group admin (all admins are subscribers by definition). A free user cannot receive group ownership. Transfer offers expire after 7 days. If the recipient loses eligibility before accepting, the offer is auto-cancelled and the sender is notified.

Access policy and account limits are checked in sequence. The table above covers policy only — it defines who is permitted. After policy allows an action, account limits are checked. Both must pass for the action to succeed.

Group type and settings add a third layer of rules. On top of role-based access and account limits, each group's type (public or private) and its configurable settings further restrict what members can do — for example, whether any member or only admins can create rides, and whether new members need approval to join. For the full definition of group types and available settings, see Group.

Buddy Access Policy

Feature	Subscriber	Free
Send Buddy Request	Allow	Allow
Accept Buddy Request	Allow	Allow
Decline Buddy Request	Allow	Allow
Cancel Sent Request	Allow	Allow
Remove Buddy	Allow	Allow

Buddy features are available to all user types regardless of subscription. Banned users and to_be_deleted users do not appear in buddy search results.

Favorites Access Policy

Feature	Subscriber	Free
Add Favorite	Allow	Allow
View Favorites	Allow	Allow
Remove Favorite	Allow	Allow

Favorites are available to any user with status: active. Favorites can be added during ride creation or from a ride's details page. They are only selectable as quick-pick options during ride creation — not during RSVP. If a favorited location's Google Maps place ID becomes invalid, it is excluded from the ride creation picker. If the user selects a stale favorite during ride creation, an error is shown and the favorite is silently marked stale. The user must delete stale favorites manually from their favorites list.

Feature	Subscriber	Free (quota remaining)	Free (quota exhausted)
Navigation	Premium	Premium	Essential
Traffic data	✓	✓	✗
See other riders	✓ (if sharing on)	✓ (if sharing on)	✗
Location sharing opt-out	✓	✓	✗ (always shared)

Precise location required to START: The user must grant precise location permission before tapping Start. The app requests this permission during onboarding.

One active navigation session per account: Only one device can run an active navigation session at a time. Starting navigation on a second device while the first is active auto-stops the first device's session server-side — the first device is silently returned to the home page when it next syncs. This works even if the first device is offline — the session is ended server-side immediately and the first device discovers this on reconnect. Switching devices mid-ride is allowed and supported. Quota and RSVP are unaffected: both are scoped to the user+ride, not to a device or session.

Intercom Access Policy

Feature	Subscriber	Free (quota remaining)	Free (quota exhausted)
Use Intercom	Allow	Allow	Fully blocked — no send, no receive

Intercom requires explicit join. Intercom is not passive — each rider must tap the join button to enter the intercom session. For Essential tier users (quota exhausted), the join button is disabled and shows a paid-feature indicator. Since they cannot join, they cannot send or receive any audio.

Subscription State Changes

When a free user exhausts their 4-ride quota

RSVP and Start Ride remain available. The user starts rides at Essential tier — no intercom, no traffic data, and location sharing cannot be opted out. The Intercom button is visible but disabled with a paid-feature indicator. Creating a ride remains blocked (as it was before quota exhaustion).

When a subscription expires (not renewed)

Access is recalculated immediately. The following rules apply:

Rides the user owns — continue normally for other participants. The 4-pending-ride cap limits exposure to at most 4 rides in flight.
Active navigation segment at expiry — the running segment continues uninterrupted. Tier is not changed mid-segment. The next Start — in that ride or any other — is evaluated at Essential.
All new Start taps after expiry — tier is determined by remaining free quota. If quota slots remain, the user gets Premium (quota consumed). If all slots were consumed before or during the subscription, the user gets Essential.
Creating new rides — blocked until the user re-subscribes.
Groups the user owns — each enters a 30-day freeze (see below).
Admin roles the user holds — revoked immediately in every group and ride. Admin roles are not automatically restored when the user re-subscribes; a group or ride owner must re-grant admin manually.

Asset handoff window on subscription lapse: When a subscriber's subscription expires, the owner has 7 days to transfer each owned group and ride to an eligible recipient.

On the day of lapse: owner and admins are notified.
During the 7-day window: groups and rides continue operating normally for members and participants. The owner can transfer ownership to an eligible recipient, manage group admins (to appoint a transfer recipient), or delete the asset.
Free quota exception: Rides for which the owner still has free Premium ride quota available are excluded from the mandatory transfer. Those rides continue operating normally.
Existing invite codes remain valid during the window — a user with a link can still join a group via invite code.
Rides already started at the time of lapse continue to completion normally. Current participants are unaffected for the duration of those rides.
Rides not yet started that are not covered by the free quota exception and are not transferred within 7 days are frozen along with the group. All RSVPed participants are notified.
If the owner re-subscribes within 7 days: frozen assets unfreeze and return to their previous state. Admins who still hold an active subscription retain their roles automatically. Admins whose own subscriptions lapsed separately must be re-granted admin manually by the owner.
After 7 days without action: untransferred groups and rides are frozen and become unavailable to all members and participants. The owner can still transfer or delete frozen assets to restore access. Re-subscribing unfreezes all frozen assets immediately.
Day 30: frozen assets that have not been transferred, deleted, or unfrozen by re-subscribing are permanently deleted. No recovery path exists — the owner must create new groups or rides.

The user is notified at expiry to transfer group and ride ownership within the 7-day window to avoid the freeze.

Access is recalculated immediately. The user gains unlimited Premium Rides at START.

Rides RSVPed while free — if the ride has not yet started, the user's tier for that ride upgrades to Premium automatically at START because they are now a subscriber.
Any remaining free quota has no effect while subscribed — Premium access is unlimited. Remaining quota is preserved and becomes available again if the subscription later lapses.
Frozen groups and rides the user owns — unfreeze immediately on re-subscribe and return to active state. Admins who still hold an active subscription retain their admin roles automatically. Admins whose own subscriptions lapsed separately had their roles revoked at that time and must be re-granted admin manually by the owner.
Admin roles held by the re-subscribing owner — not automatically restored in any ride or group where the owner previously held admin. Must be re-granted manually.
On expiry after re-subscribing — consumed quota is not restored. Any quota slots that were unused at subscription time are still available. A user who exhausted all 4 slots before subscribing is treated as quota-exhausted on expiry.

When a free user or expired subscriber taps a paid feature

The app shows an upsell screen with the option to subscribe. Paid features that trigger this upsell include: Create Ride, accepting a ride ownership transfer, becoming a ride admin, becoming a group admin, and Create Ride in Group (when the group's settings permit that user's role to create rides). The screen can be dismissed with Skip — no data is changed and the user is returned to where they were.

In-ride Premium features (Intercom, traffic data, seeing other riders) are not upsell-triggered during a ride. The Intercom button is visible but disabled with a paid-feature indicator. Traffic data and rider positions are simply absent — no prompt is shown.

Subscription notifications

95octane shows a one-time in-app notice 30 days before the subscription expires. The notice is displayed the next time the user opens the app after the 30-day mark and is shown once only. 95octane does not send push notifications or emails for subscription events. Apple and Google handle store-side renewal notifications through their own systems.

Admin roles and subscription expiry

Admin is a subscriber-only role in both rides and groups. When a subscriber's subscription expires, all admin roles they hold — in rides and groups — are revoked immediately. They become a normal member of each ride or group they were administering. For any user actively in a ride at the moment of expiry — whether navigating or not — the role change takes effect naturally when they next open the app after the ride. The app does not re-check status mid-ride, so the revocation is not disruptive to a live session.

When an admin loses their role due to subscription expiry, both the owner of each affected ride or group and the demoted user receive a notification. When an owner's groups freeze due to expiry, the owner is notified with instructions to transfer ownership or re-subscribe.