Busboy — Privacy Policy

Busboy shows live bus arrival predictions for AC Transit (Oakland) and the CTA (Chicago). It has no accounts, no sign-in and no advertising. This policy describes every category of data the app touches, where each one goes, and what you can do about it.

Two things are true of Busboy that are not true of most apps, and both shape everything below:

1. Location

What is collected

When you use the Nearby screen and choose "Use my location", Busboy asks Android for a single current position fix and uses it as the centre of that one search. It requests balanced-power accuracy at whichever granularity you granted — if you granted only approximate location, the app works normally and never asks for more.

Busboy requests one fix per search. It does not subscribe to location updates, does not track you in the background, and holds no location permission that works while the app is closed. If no fix arrives within 15 seconds the request is abandoned.

Where it goes

What is not done with it

• Your location is never written to storage. It exists in memory for the duration of a search and is discarded.
• Your coordinates are never sent to analytics. Analytics records only whether a search used your device or a point you tapped on the map, the search radius, and a bucketed distance to the stop you chose — never a position.
• Your coordinates are never sent in a crash report either. An earlier version of this policy said a failed location lookup could carry a position rounded to whole degrees; a review found that was wrong — the app has the machinery to record a rounded coordinate, but nothing in it ever calls that machinery, so no position of any precision reaches a report. The machinery is kept because it is what makes an exact coordinate impossible to record by accident: it is enforced by the app's own type system, not by policy alone.

Your control

Location is entirely optional. Deny or revoke the permission in Android's system settings and every screen keeps working: By stop, Saved stops, alerts and bus details never use it, and Nearby falls back to letting you pick a point on the map.

2. Stops you look up and save

Stop numbers you type or tap are sent to the transit agency in order to fetch arrival predictions — that is the app's entire purpose. They are also recorded in analytics and in crash reports as plain stop IDs. A stop ID identifies a piece of public street furniture, not a person, and it is the only thing that makes an agency's API failure reproducible.

Saved stops are stored only on your device, in a local database. Each row holds the stop number, which agency it belongs to, the stop's name, the stop's coordinates and the lines that serve it. This list is never uploaded to us or to any third party. Analytics records only how many stops you have saved, as a coarse bucket.

Note that a saved-stops list can be revealing — a home stop and a work stop describe a routine. That is why it stays on the device.

One exception you should know about: Busboy currently allows Android's Auto Backup, so your saved stops and settings may be copied to your own Google Drive account as part of your device backup, encrypted and counted against your Drive quota. Google's handling of that backup is governed by Google's Privacy Policy. You can turn device backup off in Android's system settings.

3. Settings

Your selected agency (AC Transit or CTA) and your theme preference (light, dark or follow system) are stored locally on the device. The selected agency is also sent to analytics and crash reporting as a property so that reports can be read per city.

4. Analytics

Android only. On iOS, the analytics component does nothing at all — no events are recorded and nothing is transmitted.

You can turn this off. Settings → Share usage data. It is on unless you turn it off.

Switching it off stops everything described in this section and the next — analytics, error reports and crash reports alike. It disables collection at the SDK, not merely the calls Busboy makes, so the events Firebase generates on its own (session starts, first opens) stop too. It also discards what is still on your device: the analytics identifier, so events already collected stop being linkable to your install, and any crash report queued but not yet uploaded.

Two honest limits. It cannot recall data already delivered to Google — nothing on your device can. And the choice takes effect immediately, but data already in flight at that moment may still arrive.

Busboy uses Google Firebase Analytics to understand which features are used and which ones fail. It records:

• Screens viewed — the name of each screen, such as by_stop or nearby.
• Actions taken — that a search was run, a stop saved or removed, an agency switched, a route filter opened, a prediction row tapped, directions requested, and so on.
• Outcomes — whether each of those operations succeeded, and on failure a short fixed error token. Never an error message, which could quote what you typed.
• Context about the result — the stop ID involved, the route number tapped, how many predictions came back, the search radius, bucketed timings and counts, and whether the agency's data was complete.
• Properties of the session — selected agency, theme, how many stops you have saved (as a bucket), the navigation layout your screen size produced, and whether the build is a debug or release build.

Busboy assigns you no user ID. The app has no accounts and never calls Firebase's user-identification API. Firebase itself generates a random per-installation identifier and collects standard technical information — device model, operating system version, app version, and a coarse location derived from your IP address. This is described in Google's documentation on Analytics data collection and governed by Google's Privacy Policy.

Advertising identifier. Busboy contains no advertising and shows no ads. The Firebase Analytics library brings the Android advertising ID permissions with it by default; Busboy removes them, so the app cannot read your advertising ID and none is transmitted. The same applies to the Android Privacy Sandbox advertising permissions, which are removed for the same reason.

5. Crash and error reporting

Android only, on the same terms as analytics — iOS sends nothing.

Busboy uses Google Firebase Crashlytics to record crashes and a defined set of non-fatal failures (an agency API rejecting a request, a location lookup failing unexpectedly, a response that no longer matches its documented shape). Reports carry the stack trace, standard device and OS information, and a bounded set of context keys: the agency, the stop ID or vehicle ID involved, the API endpoint, counts, and a random identifier for that run of the app, which is generated in memory and never persisted or linked across sessions.

Two deliberate limits:

• Exception messages are recorded as the exception's type name only — messages can quote the data that caused them.
• No coordinate is attached at all. The type system will not accept an unreduced one, and nothing calls the reduction either — see section 1.

All of this stops when you switch off Share usage data, including crashes. Crashlytics is disabled at the SDK, so the crash handler itself stops reporting — this is not Busboy declining to call it — and reports already queued on your device are deleted rather than uploaded on the next start.

6. Who your data goes to

Busboy sends requests directly from your device to:

Every one of these requests is made over HTTPS.

We do not sell your data, share it with data brokers, or use it for advertising or cross-app tracking. There is no Busboy server and no Busboy database; we hold nothing to sell.

7. What Busboy never collects

No name, email address, phone number, postal address or date of birth. No contacts, calendar, photos, files, microphone or camera. No health, financial or biometric data. No account of any kind. No browsing history. No SMS or call logs. No advertising ID and no advertising profile.

8. Retention

• On your device: saved stops and settings stay until you delete them in the app, clear the app's data, or uninstall Busboy. Uninstalling removes all of it.
• Analytics data: Google keeps event-level data for 2 months, after which it is deleted. Aggregated reporting figures — counts and totals with nothing tied to an individual install — are not subject to that window.
• Crash reports: Google keeps these for 90 days.

Both windows are Google's, not ours, and neither is affected by the usage-data switch: the switch stops new data being collected and discards the identifier linking past events to your install, but it cannot shorten a retention period on data already delivered.

9. Your choices

Depending on where you live you may have rights to access, correct or delete personal data held about you. Because Busboy keeps your data on your own device and operates no server, deleting the app's data or uninstalling it satisfies a deletion request in full. For the analytics and crash data held by Google, contact us at the address above and we will act on it in the Firebase console.

10. Children

Busboy is not directed at children and does not knowingly collect data from children. It has no accounts, no social features and no user-generated content.

11. Changes to this policy

Material changes to what Busboy collects will be reflected here. Effective date moves only when what we collect actually changes; last updated moves for any edit, including a correction to wording that was unclear or wrong. During the beta, please expect both to move.

12. Contact

Email [email protected] for anything in this policy — a question, a correction, or a request about data held about you.