An Abortion Fund Volunteer Found 14 Months of Rides in an App

The spreadsheet

The volunteer was checking mileage reimbursements when she opened the route-planning app’s trip history. A filter was set to show the account’s full history, although she could not tell whether that meant records stored on her phone, records tied to the shared account, or both.

She downloaded a spreadsheet.

It had 62 rows covering 14 months. Each row represented a completed drive, with a date, starting point, destination, distance, and a label someone had entered while arranging the ride. Some destinations were clinics. Several starting points were residential addresses.

Others were meeting places that passengers had chosen because they did not want a driver coming to their homes.

The fund is a composite, assembled from recurring experiences rather than one identifiable organization. It operated in a U.S. metro area and helped people cover abortion-related expenses, including transportation.

Volunteer drivers used their own cars. A coordinator matched each passenger with a driver and passed along enough information to complete the trip.

The route app solved a real problem. Drivers could handle unfamiliar roads, estimate mileage, and report a reimbursement total without reconstructing the day from memory. Once a ride was over and the money had been recorded, the volunteer assumed the operational record had served its purpose.

The 62-row spreadsheet showed otherwise.

She had thought of the route as temporary information, comparable to spoken directions that stopped mattering after arrival. The app treated it as account history. That distinction had not come up when the group adopted the tool, partly because everyone was focused on whether rides would happen at all, and partly because the history screen sat outside the workflow they used each week.

Nothing on the spreadsheet established that a passenger had received an abortion. Clinics provide different services, and a destination alone does not prove what happened inside. Still, the records connected homes or meeting points with facilities associated with reproductive health care. They also identified volunteer movement patterns, including where some drivers regularly began or ended trips.

The risk did not require anyone to be watching the account in real time. The information remained useful to an abusive partner who gained access to a device, or to someone who took control of the shared login months later. A legal demand could create another path to stored information, although what a company could be required to provide would depend on the records it held and the law that applied. The fund did not try to settle that legal question itself.

Its immediate finding was narrower: data left in an account could expose passengers and drivers after the transportation work was finished.

What trip history changed

The volunteer first checked whether the spreadsheet was an isolated export. It was not. The trips remained visible from another device signed into the account, which suggested that deleting the downloaded file would remove only one copy. She could erase visible entries individually, but the app did not give her a clear account-level explanation of how long deleted records might remain in backups or other internal systems.

The group contacted the platform through its support inbox and asked about retention and deletion. The response described general account controls but did not give the volunteers a way to verify what remained behind the interface. That uncertainty mattered. A blank history screen could show that ordinary users no longer saw the trips, yet it could not demonstrate that every copy had disappeared from company systems.

This was the mechanism the group had missed. Access controls and data minimization address different problems. A password can limit who opens an account. Minimization reduces what the account has available to reveal if access fails, if a device is shared, or if stored records are later requested through a formal process.

The app was only one part of the record trail. Coordinators sometimes copied pickup details into messages, while drivers used calendar entries to remember a ride. Reimbursement notes could preserve a clinic name even when the route itself had been removed. Deleting one record did not reach those other copies, and the volunteer could not infer where information lived by looking at the route app alone.

The spreadsheet forced the group to define what it needed for a ride and for how long. Before that point, “needed” had meant useful to someone at some stage. That was broad enough to justify almost any record. Afterward, the volunteers separated information required to complete a trip from information required to document spending, because an exact street address helped a driver find a passenger but did not need to remain beside a reimbursement total for 14 months.

Their redesign was an operational response, not legal advice or a claim that the group had met every possible recordkeeping obligation. The legal environment around abortion, privacy, and compelled disclosure varies by jurisdiction and can change. The volunteers were deciding what their work required, while leaving legal conclusions to qualified counsel.

A system built to forget

The group stopped using a standing shared route account for every ride. A coordinator still needed the passenger’s chosen pickup point and destination, but that information was passed to the assigned driver closer to the trip rather than remaining available to the wider volunteer pool. If a passenger preferred a public meeting place, the system recorded that place without also preserving a home address.

They also changed the reimbursement record. The replacement sheet kept the month, miles driven, amount paid, and an internal description broad enough to support the fund’s bookkeeping. It did not keep the turn-by-turn route or the passenger’s pickup address. Exact trip details remained available during the short period when a coordinator might need to handle a cancellation or confirm that someone had arrived, then were removed from the working view under the group’s new practice.

That change created friction. A backup driver could no longer open an old route and reuse it, and coordinators had less historical information when estimating future transportation costs. The group accepted slower handoffs in some cases because convenience had been one reason the 62 rows accumulated without review.

They did not describe the new process as anonymous. A coordinator still knew who needed a ride. An assigned driver still learned where to go, and a passenger’s own phone or email account could preserve messages outside the fund’s control. The route-planning company might retain technical records that the volunteers could neither see nor verify.

Data minimization did not erase those facts. It narrowed the group’s own collection and shortened the period in which exact locations remained useful to its operations.

The volunteers reviewed permissions as well, but they avoided treating a settings change as the whole solution. Turning off an optional history feature could prevent some future records while leaving old entries untouched. Removing an app from a phone would not necessarily delete information connected to an online account. The important change was that the fund no longer assumed a completed ride had vanished merely because nobody was looking at it.

The effect on trust

The discovery altered relationships inside the group. Drivers had understood that coordinators would know about their trips, but some had not realized a platform could preserve their movements in a shared history. Passengers had offered addresses for a limited purpose. The spreadsheet showed that the technical system had extended that purpose without a separate decision by them.

The fund told active volunteers what it had found and described the limits of what it could confirm about deletion. It also contacted passengers whose information was identifiable in the working records. Some did not respond. One asked whether a meeting point had been stored alongside a home address, a distinction that had mattered during the original ride and mattered again months later.

A driver stopped volunteering after the review. The group could not say that the app had caused a concrete breach, and it found no evidence that an outsider had opened the history, but absence of a known breach did not restore her confidence in a system that had retained more than she expected.

The original spreadsheet remained restricted while the group resolved reimbursements and removed information from the accounts it controlled. The volunteer kept returning to the same detail: 62 rows were visible only because she had happened to change a history filter while checking mileage.

Questions people ask

Does deleting a trip from an app erase it everywhere?

The fund could remove trips from the history visible to ordinary account users, but it could not verify whether backup copies or other company records remained. It also found related details in messages and calendar entries, so deleting the route-app record addressed only one place where the trip had been stored.

Can a saved clinic destination prove someone had an abortion?

No. A destination can show that a device or planned route was associated with a location, but it does not establish who entered a building or what care a person received. In this story, the privacy concern came from linking a passenger’s pickup point with a reproductive health facility, even though the record could not prove an abortion occurred.

Is data minimization the same as legal compliance?

No. The group reduced the location information it retained as an operational privacy measure, not as a legal conclusion. Recordkeeping duties, disclosure rules, and privacy protections differ across jurisdictions, and this composite account does not provide legal advice about what another fund or volunteer must keep.

What did the fund continue to record after each ride?

Its revised reimbursement sheet kept the month, mileage, payment amount, and a broad bookkeeping description. Exact pickup points and clinic destinations were no longer attached to the long-term expense record, and the old 62-row spreadsheet was no longer the model for documenting a completed ride.