Staying safe

Thuma Express Holdings, Inc.

Two strangers meet on a street, at night, over somebody's money or somebody's parcel. Everything below is what the app does about that, and all of it is shipping — there is nothing on this page we are planning.

If you are in danger right now

Call the emergency services first. The app does not replace them and never asks you to wait for us: when ThumaRescue opens it asks whether anyone is injured before it says a word about price, and if the answer is yes it tells you to call an ambulance and not to move anybody. A recovery vehicle still comes, and it comes as urgent.

SOS, on the trip screen

One press, while a trip is running. It raises an alarm with our team, sends where you are, and tells the trusted contacts you have saved.

• It never gets covered. Chat, sheets and cards all sit under it. A button you have to hunt for is not a safety feature.
• The driver is not told. Nothing on their screen changes. If the person you are frightened of is the person driving, an alarm that announces itself is worse than no alarm.
• It counts, rather than promises. The screen says how many of your contacts were actually reached out of how many were tried, so you know whether anybody heard — and it says plainly when none of them could be, or when you have saved none.
• Our team watches the trip from the moment the alarm is raised, and the screen says so rather than leaving you guessing.
• Standing down does not close it. If you press to say you are safe, your contacts are told — and our team keeps the trip open and checks on it anyway.
• If we cannot be reached at all, the screen says the alarm did not send and tells you to call the emergency number directly, instead of pretending it worked.

Somebody else knows where you are

• Share the trip. The person waiting for you opens a link and watches the whole journey. They do not have to install anything — that is deliberate, and it is why the tracking address is a plain web page rather than something that tries to open the app.
• Sharing stops by itself, either after the minutes you chose or when the driver reaches you, so a link shared once does not follow you around for a week.
• The check-in. When a trip stops looking like it should — stopped too long, off the route, running late — we ask whether everything is all right. "Something's wrong" opens help immediately, and if you have no signal your answer is saved and sent the moment you do.
• You can tell it to stop asking on this trip. SOS and sharing your location are unchanged by that — turning off a question does not turn off the alarm.

Which call carries your number, and which does not

There are two ways to reach the person on the other end, and the app tells you the difference before you pick one rather than after.

• A free call goes through Thuma, and your number is not shared. Messages are the same: your driver sees a name.
• A regular call uses your own line, so your number travels with it. It is offered because it works with no data at all, on any handset, which matters when somebody is standing on a kerb — and the app says so in those words before you place it.
• Whether a driver can ring you is a switch you set. You can always call them; that is a separate question from them calling you.

Your voice is encrypted between your phone and our call service, so nobody on the network in between can listen. The call screen says which protection is in force on that particular call rather than making one claim for all of them. We keep a record that the call happened, who was on it and how long it lasted — not what was said.

If a phone number or a payment detail is typed into the chat it is removed and both people are told why — what was agreed has to stay somewhere it can be read back when there is a dispute.

Report anybody. Block anybody.

Press and hold anything the other person sent you and you can report it. Any person can be blocked outright, including mid-trip — and the app says plainly what blocking will and will not stop while a driver is on the way to you.

Reporting a message freezes what was said. The conversation around it is written into evidence in the same movement that files the report, so nothing can be edited or deleted out from under it afterwards. A report gets a reference and a person reads it; where an automated check closed something without a human looking, it says so and offers a reply that a person will read.

The safety centre in the app carries your cases from received, through under review, to closed, with the outcome written out. Nothing about a report goes in a push notification: a lock screen is often read by somebody else.

Trip audio

A trip can be recorded, and both people are told when it starts. Nobody on the trip can play it back, and we do not listen to recordings as a matter of course: opening one takes a specific staff permission and is logged against an investigation, so there is a record of who listened and why.

A recording nobody complains about is deleted after 72 hours. It is kept longer only when a report names that trip, because then it has stopped being a recording and started being evidence.

Who is driving

Before anybody carries a passenger or a parcel we check a driving licence against the register and its expiry date, a government ID matching the name on the account, the vehicle registration, a photograph of the number plate, and a photo ID check against the person. Which documents a market requires is set per market rather than assumed, and a document that runs out takes the driver off the road until it is replaced.

Proof at the door

Every delivery ends with the Handshake — a code or a photograph recorded against the order. It is there so that "it never arrived" is a question with an answer rather than an argument.

Young people

Nobody under 13 can hold an account; sign-up refuses the date of birth outright. Between 13 and 17 an account exists only as a supervised member of a Circle that an adult creates — the guardian gives the date of birth, sets a monthly limit and a per-trip threshold, and anything over that threshold waits for their yes. A teenager cannot open one of these themselves.

What we do not claim

• ThumaShield is cover we pay for, rather than insurance we underwrite. We are not an insurer. The terms say what is covered and the windows for claiming.
• We do not promise a response time here. The only response commitment this company has published is five business days for accessibility feedback, in the accessibility statement. A second, different number invented for this page would be a promise nobody made.
• The app is not an emergency service. It raises an alarm with us and with the people you chose. It does not dispatch an ambulance.

If something has already gone wrong

Start at Support, which says where to report a problem with a trip, a parcel or a payment and carries the one rule worth memorising: nobody from Thuma will ever ask you for your PIN or your one-time code. The privacy notice says what we hold and for how long, and status.thumaexpress.com says whether the problem is ours.