Privacy Policy
This policy explains what the Public Transport app collects, why, and what you can do about it. It describes the app as it actually works today. If we change what we collect, we change this page and the date above.
The short version. You can use the app without an account, and most of it works without one. We do not sell your data and we show no advertising. We keep no history of your location. Coordinates you send appear in our server request logs, which we keep for a limited time, usually 7 days, and which are normally not linked to your account (see Technical records). We do keep a per-installation device identifier, and we record which screens and actions are used so we can tell what is broken.
Who we are
The app and the servers behind it are operated by the Public Transport team. Contact: info@publictransport.com.ua.
What we collect
Account information — only if you sign in
The app works signed out. If you choose to create an account we store your email address, and whatever you optionally add to your profile: a display name, a date of birth and an avatar image.
There are no passwords in this product. You sign in with a one-time code sent to your email, or with a passkey. For a passkey we store the public key and its credential identifier — the private key never leaves your device.
Device identifier
Every installation generates an identifier that is stable for that install. On Android it is a salted hash of the system-provided device id; on iOS it is a random value kept in the Keychain; on the web it is a random value kept in your browser's local storage. It is not your advertising id, and we do not use an advertising id at all.
We use it to apply request limits, to enforce bans on abusive installs, and — in a hashed form described below — to count usage.
Usage analytics
The app records a fixed list of named events so we can see which parts are used and which fail: screen views, opening a route, stop or vehicle, running a search, planning a journey, changing city, language or theme, favouriting a route, posting a comment or photo, sending feedback, completing sign-in, toggling notifications, opening a push notification, and failures such as a journey that could not be planned.
Each event carries the event name, a timestamp, a random session identifier, the platform, the app version, your interface language and the selected city. Events are attributed to a keyed hash of the device identifier, not to the identifier itself and not to your account.
In usage analytics, these are never recorded: latitude or longitude in any form, the text you type into search, and the start and end points of a journey you plan. A search records only how many characters you typed, not what they were.
Location
If you grant location permission, your position is used on your device to centre the map and to offer your current position as a starting point. Location is not used in the background.
When you ask for a journey from one place to another, the start and end coordinates you chose are sent to our routing server to compute the route. They are not stored against you or your account, and we keep no history of them.
Our server request logs (see Technical records) do hold places: the start and end of a journey you plan, rounded to about 1.1 km, and a point you pick on the map or centre it on and the point around which we look for nearby vehicles, rounded to about 110 m. In the rare case that our proxy cannot complete a request that carries coordinates, its error line, described there, holds them without rounding. These logs are normally not linked to your account. How long they are kept, and the rare cases in which a line can be linked to your account, are described there.
Notifications
If you turn notifications on, we store a push token issued by Google or Apple together with your selected city, so that city's announcements reach you. Turning notifications off in the app removes the token from our servers and unsubscribes the device.
Things you submit
Vehicle photos, with the name and email you optionally attach; comments on news items; feedback (a rating, an optional comment, an optional name and email, and up to three screenshots or videos you choose to attach); and vehicle position reports. A vehicle position report may carry up to three screenshots or videos you choose to attach. These attachments are never published: they are visible to administrators only and are deleted after 90 days; deleting your account does not remove them sooner. Photos and comments are reviewed before they appear publicly. Uploaded images are re-encoded on our server, which removes embedded metadata — including any GPS coordinates your phone may have stamped into the file. Videos are rewritten on our server to keep only the picture: the sound track, location, device details and recording time are removed, and a file we cannot clean this way is refused. Our Android and iOS apps remove the sound on your phone before a video is sent. A video sent from our website arrives with its sound, which our server removes in the same rewrite; the file as it arrived is deleted once processed, and an unfinished upload within three hours.
Feedback is stored with the app version, platform, interface language, selected city and the IP address it was sent from. If you are signed in, the feedback form does not ask for contact details; it sends your account email address with the feedback instead (right after you sign in with a passkey the form can still show the contact fields until the app next starts, and feedback sent with them left empty carries no email address). The text of your feedback is kept indefinitely. Deleting your account removes your email address, name and IP address from your feedback, and anything else you want deleted we delete on request (see below).
Reviews you write on Google Play
This is not the in-app feedback form described above. If you review Public Transport on Google Play, Google makes the review available to us and our server copies it into the admin panel. That is so even if you write the review in the Google Play window the app opens for you: the app never sees what you type there, and the review reaches us only from Google Play. We store the name Google Play shows beside your review, your star rating, the text and the time you wrote or last edited it, Google Play's identifier for the review, and what Google Play attaches itself: your interface language, the app version, your Android version (API level) and your device (its code name, manufacturer and model), each only when Google Play supplies it. Google Play sends further technical details about the device and the review, which we do not store. Nothing else about you is stored with it, including the email address of your Google account, and the review is not linked to your account in the app.
We use it to read what people write about the app and to answer reviews from the admin panel. Only administrators can see our copy, and we publish it nowhere. An answer is posted publicly on Google Play, under your review, as a reply from the developer, and a copy of the answer is kept with the review. We keep our copy indefinitely: deleting your review on Google Play, or your account in the app, does not remove it. On request we delete our copy and it is not copied again; write to info@publictransport.com.ua. To keep the review from being copied again we remember, indefinitely, only Google Play's identifier for the review and the date of the deletion, which hold none of the review's content, and the record that an administrator deleted it stays among the records of administrator actions, without the review's content. To remove the review itself, delete it on Google Play.
Technical records
Our servers log each request: the time, the response status, the method and the web address requested, with its query parameters. Before a line is written, push tokens and device identifiers in it are replaced by a one-way fingerprint, the text of a search is removed, coordinates are rounded to about 110 m (three decimal places), the start and end of a journey to about 1.1 km (two decimal places), and credentials such as tokens and passwords are removed. These lines hold no IP address and no user agent.
Three other kinds of log line hold more. Of these, only the proxy's error lines hold your whole IP address:
- When the app integrity check is refused or cannot be verified, the line records the network the request came from (the first three numbers of an IPv4 address, or the first 48 bits of an IPv6 address, never the whole address), the user agent shortened to at most 80 plain characters, and a one-way fingerprint of the device identifier.
- If the store that counts request limits is unavailable, including when you send feedback or a photo, and if a request arrives with a forwarding header our server cannot use or reaches our server without passing through our proxy, the warning we log records the network the request came from (the first three numbers of an IPv4 address, or the first 48 bits of an IPv6 address, never the whole address). For a signed-in account, the general request limit warning names a one-way fingerprint of the account instead.
- If the proxy in front of our servers cannot complete a request, for example while the server restarts or when the connection drops, its error line holds your full IP address, the user agent and the web address requested, without any of the masking above.
Our logs are normally not linked to your account, with two rare exceptions. Both concern a request from a signed-in account, and in both a warning shares a request identifier with that request's own log line, so the approximate coordinates in that line can then be linked to your account:
- When the store that counts request limits is unavailable, the warning carries the one-way fingerprint of the account mentioned above.
- When our account database cannot be reached, the warning carries the same one-way fingerprint of the account. We write at most about one such warning a minute.
The fingerprints in our logs are made without a secret key. We can match the fingerprints of device identifiers and push tokens against the device identifiers and push tokens we store for an account; those lines hold no coordinates. We can recompute an account's fingerprint from the account, which is why both exceptions above still link the line to your account.
We keep server logs to investigate faults and abuse. Our searchable log store keeps each line for 7 days. The server itself also keeps each service's most recent output, up to about 30 MB per service, until newer output overwrites it or the service is replaced. For the proxy, which we rarely replace, that can be longer than 7 days.
To apply request limits we also keep your IP address in short-lived counters: for about three minutes after your last request for the general limit, for up to an hour for sign-in codes, feedback and photos, and for up to a day for screenshot and video uploads. A session issued to an app that is not signed in carries the IP address that requested it for the session's 12 hours.
We also record the version of the terms you accepted, with the time, IP address and user agent of that acceptance.
Why we use it
- To run the service — show routes, stops, vehicles and journeys.
- To keep an account signed in and to protect it.
- To detect and stop abuse: request flooding, tampered app builds, banned installs.
- To find what is broken and what nobody can find, and fix it.
- To send the notifications you asked for.
- To read reviews of the app on Google Play and answer them.
Who else sees it
We do not sell personal data and we do not share it for advertising. Data reaches these parties only as far as the feature needs:
- Google — map rendering (Maps SDK and Maps JavaScript API), push delivery (Firebase Cloud Messaging), crash reporting (Firebase Crashlytics — a stack trace, device model and OS version, app version and a Firebase installation id at the moment of a crash; on Android and iOS also a short report when the app integrity check fails, or when our server refuses it or cannot verify it, with an error code or a one-word outcome and nothing else about the check; every report is labelled with a short one-way fingerprint of the device identifier, 12 characters, never the identifier itself; no name, e-mail, location or content; kept by Google for 90 days), and app integrity checks (Play Integrity) on Android.
- Apple — push delivery and app integrity checks (App Attest) on iOS.
- Our email provider — delivery of one-time sign-in codes and account email.
Journey planning and address search run on servers we operate ourselves; the places you search for are not sent to a third-party geocoder.
How long we keep it
| What | How long |
|---|---|
| Account record | Until you delete the account |
| Analytics events | 180 days |
| Push tokens | Removed when you turn notifications off; otherwise up to 180 days after last use |
| Vehicle position reports | 90 days |
| Screenshots and videos attached to feedback or reports | 90 days |
| Feedback: comment, rating, app version, platform, language and city | Indefinitely; deleted on request at info@publictransport.com.ua |
| Contact data on feedback: email, name and IP address | Until you delete your account, which removes them from your feedback; otherwise indefinitely |
| Google Play reviews: name, rating, text, device, app version and language, and our replies | Indefinitely; deleted on request at info@publictransport.com.ua |
| Identifier and date of a deleted Google Play review, so it is not copied again | Indefinitely |
| Historical vehicle positions | 30 days |
| Photos and comments you published | Until removed by you or by moderation |
| Server request logs | 7 days in our log store; each service's most recent output (up to about 30 MB) until it is overwritten or the service is replaced; for fault and abuse investigation |
Deleting your account
You can delete your account from inside the app: More → Account → Delete account. You can also request deletion at app.publictransport.com.ua/delete-account or by writing to info@publictransport.com.ua.
Deletion is immediate and irreversible. Concretely, it:
- removes your email address, display name, date of birth and avatar from the account record, and deletes the avatar image file;
- deletes your passkeys and your list of known devices;
- signs out every device and refuses any session that was already open;
- detaches your name and email from photos you submitted;
- removes your email address, name and IP address from the feedback you sent.
Photos and comments that were published stay published, without your name or email attached, so that other people's screens do not change. Say so in your request if you want a specific submission taken down as well, and we will remove it.
The text of feedback stays. The words of your feedback are kept indefinitely, without your email address, name or IP address. We match feedback to you by email address, ignoring capitals, so this includes feedback you typed your address into by hand while your account held it. Feedback sent without an email address, or typed in before your account existed (that cannot be told apart from an earlier owner's), cannot be matched to you: quote its text and the approximate date. The same goes for feedback sent under your old email address after an administrator changed your account's address and before your app learned the new one: it is dated after the change, so it cannot be told apart from a later owner of that address, and it stays too. Anything else you want deleted, including the feedback itself, we delete on request: write to info@publictransport.com.ua.
Records of administrator actions stay. When an administrator acted on your account (a ban, an edit, a deletion), the record of that action stays as an audit trail, with the personal details in it, such as your email address, name or date of birth, removed.
Accounts deleted before 1 October 2026. From the feedback of accounts deleted earlier we removed the email address, name and IP address wherever our records still showed which address the account had used, and since when. Where they do not, for example an account you deleted yourself that no administrator ever edited, or an address an administrator moved an account to before our records began to note the exact moment such a change takes effect (this applies to accounts deleted later as well), those details stay on your feedback until you ask: write to info@publictransport.com.ua, quote the text and the approximate date, and we will remove them.
Your choices
- Use the app signed out. Almost everything works without an account.
- Location. Refuse or revoke the permission in your device settings; the map then opens on the city instead of on you.
- Notifications. Turn them off in the app; the token is deleted from our servers.
- Analytics. There is currently no per-device switch for analytics in the app. The events are pseudonymous and expire after 180 days. If you want the events recorded for your installation removed sooner, write to us.
- Access, correction, deletion. Write to info@publictransport.com.ua and we will act on your request.
Children
This app is not directed at children and is listed for an adult audience. We do not knowingly collect data from children.
Security
Traffic between the app and our servers is encrypted in transit. Requests from the app are cryptographically signed, and each installation proves it is a genuine app build before it is issued a session.
Changes
If this policy changes we update this page and the effective date at the top. Material changes are also announced in the app.