---
title: "Driver App profile contract"
description: "Maintain the reviewed profile fields, photo, availability, schedule, session, logout, and deletion boundaries."
canonical: https://docs.ordering.co/docs/developers/driver-app/profile-contract/
---

# Use the reviewed profile contract

Driver App Profile composes current session user data, configurable validation fields, photo-library updates, availability, schedule, sessions, language, logout and account deletion. These are independent reads, mutations and provider handoffs, not one atomic profile transaction.

Profile data can be out of date, and photo, profile, availability, deletion, and session changes may have separate outcomes.

## Availability

Profile is an authenticated tab and can refresh current user information on a navigation-state event. Field editing for a Driver requires explicit update configuration. Availability is shown unless its configuration explicitly hides it. Deletion is configuration/role-dependent. Sessions, schedule, language and logout have separate contracts.

## Prerequisites

- Authenticated self scope and current validation-field configuration.
- Minimum PII access and explicit field/photo/delete authorization.
- Synthetic photo/provider tests; no camera assumption.
- Separate API receipts and late-result protection for each mutation.
- Session/account cleanup plan before deletion or logout.

## Responsibility boundaries

| Boundary                          | Responsibility                                                                       | Limit                                                  |
| --------------------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------ |
| Profile wrapper                   | Supply session user, focus refresh, config and navigation.                           | Refresh/navigation is not currentness.                 |
| Profile UI                        | Render configured fields, photo, availability and account entries.                   | Visibility is not mutation eligibility.                |
| Validation fields                 | Define visible/required/editable form fields.                                        | Client config is not server authorization.             |
| Photo library                     | Select a photo asset and return URI/base64 metadata.                                 | No reviewed camera path; selection is not persistence. |
| User controller/API               | Read/update fields/photo/availability/delete with self/manager rules and follow-ons. | Mutations can settle independently.                    |
| Session/storage                   | Replace local user or clear state after results.                                     | Local state is not server completion.                  |
| Schedule/sessions/language/logout | Separate account workflows.                                                          | Profile composition does not merge their contracts.    |

## Inputs and result

| Input/action                      | Client result                                               | Limit                                                                   |
| --------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------------- |
| Focus/current session             | User refresh/read mode.                                     | PII currentness unproven.                                               |
| Validation fields                 | Read/edit form and local validation.                        | Missing field does not authorize bypass.                                |
| Edit fields/password/phone        | Partial change request.                                     | Server validation/history/jobs/socket separate.                         |
| Avatar press                      | Photo library; selected asset can immediately request save. | Independent of Edit config; no preview confirmation.                    |
| Availability toggle               | User availability request/local state.                      | Order eligibility/broadcast/currentness separate.                       |
| Delete account                    | Confirmation then destructive request/local cleanup intent. | Server delete, session, storage, jobs/socket/provider cleanup separate. |
| Sessions/schedule/language/logout | Navigate or invoke dedicated workflow.                      | Each requires own acceptance.                                           |

## Security and privacy

- Never log or expose names, email, phone, password, photo/base64, schedule, session, availability or deletion payloads.
- Enforce self/manager/field/photo/delete authorization server-side.
- Require explicit preview/confirmation before photo upload and complete destructive confirmation before deletion.
- Bind late refresh/mutation/picker results to current account generation.

## Limits and failure states

| State                      | Meaning                                | Maintainer response                      |
| -------------------------- | -------------------------------------- | ---------------------------------------- |
| Profile loading/error      | User/validation read unsettled.        | No mutation.                             |
| Edit hidden                | Config does not admit field editing.   | Do not bypass.                           |
| Avatar still pressable     | Photo path independent of edit config. | Treat as authorization/confirmation gap. |
| Picker canceled/error      | Provider returned no usable asset.     | No retry/camera workaround.              |
| Availability result        | One mutation/local result.             | Order/broadcast/follow-ons unproven.     |
| Delete accepted locally    | Request/cleanup may be in progress.    | Destructive completion unproven.         |
| Session/profile divergence | Late result or partial cleanup.        | Stop and reconcile account ownership.    |

## Troubleshooting

Use synthetic fields/users/assets and intercepted API/session/storage/picker. Never enter real PII, toggle real availability, delete an account, inspect live sessions or open a real picker for diagnostics.

Re-review whenever profile refresh, validation fields, edit authorization, photo picker/save, availability, deletion, local session replacement or related account entry changes.

**Related guides:** [View profile](https://docs.ordering.co/docs/products/driver-app/account/profile/) · [Edit profile](https://docs.ordering.co/docs/products/driver-app/account/edit-profile/) · [Availability](https://docs.ordering.co/docs/products/driver-app/operate/availability/) · [Schedule](https://docs.ordering.co/docs/products/driver-app/account/schedule/) · [Sessions](https://docs.ordering.co/docs/products/driver-app/account/sessions/) · [Sign out](https://docs.ordering.co/docs/products/driver-app/account/sign-out/) · [Delete account](https://docs.ordering.co/docs/products/driver-app/account/delete-account/)