Privacy policy

01Who we are

UK Buses (the website at ukbuses.app and the UK Buses app for iPhone) is run by Rouic Ltd, a company registered in England and Wales (number 09953644), whose registered office is Sigma House, Oak View Close, Edginswell Park, Torquay TQ2 7FF. We are the controller of the personal data described here, under the UK General Data Protection Regulation and the Data Protection Act 2018. Rouic Ltd is registered with the Information Commissioner's Office (ICO) as a data controller, number ZA261106.

Questions about your data, or requests to use your rights, go to [email protected].

02In short

• You don't need an account. The app works without one, and to show bus times we only need the part of the map you're looking at, which we don't keep.
• Your town or city, and your live events, belong to a random ID the app makes for itself, not to your name, your number, your email address or your Apple Account.
• An account holds your email address, a name if you give one, your password (scrambled, so nobody can read it) and the stops and lines you track.
• No advertising, no tracking across other apps or sites, no selling or sharing of your data for marketing. The app has no analytics; the website records visits only if you say yes.
• You're in control: delete your account at any time, on the web or in the app, and write to us for anything else.

03Using UK Buses

The part of the map you're looking at. To show buses and stops, the website and the app send us the area of the map on your screen (the coordinates of its corners), or the stop or line you've chosen. We use it to answer the request and don't store it or link it to you. For some places our server asks a bus operator's own information service for the stops or buses in that area; that request comes from our server, with nothing about you in it.

Searching. What you type to find a stop or a line is sent to our server to search, and isn't kept.

Your location, only if you allow it. In the app, while you're using it, your iPhone's location finds your town or city, the stops nearest you and your place on the map. To find nearby stops the app asks us for the stops in a box one to two kilometres across, drawn on a fixed grid around you, so your exact position doesn't reach us. On the website, the location button shows your position on the map in your browser; the map then asks for the buses around it, as above. We never store your location.

Logs. Like any website, our hosting and Cloudflare, which delivers the site and the app's requests, process your IP address, the kind of browser or app you use and the addresses requested, to deliver the service and keep it secure. These logs are kept for a short time (normally no more than 30 days) and aren't used to build a picture of you. Our own database keeps no IP addresses or browser details.

04Your town or city

When you choose your town or city in the app, or let it find it from your location, the app tells our server which area you chose, with the app's random install ID, so that we know which areas are in use and keep their timetables and live buses up to date. The area is a whole town or city, not your position: no precise location is stored for this. The app tells us again about once a week while you use it, and if it hasn't for 90 days we delete it.

If you are the first to choose a place, our server gets it ready from the Bus Open Data Service, which usually takes a few minutes. Nothing about you goes to the Bus Open Data Service.

05Live events

A live event is a stop, the lines you take from it, the days you travel and a time window, with a name you give it. So that your iPhone can show it on the Lock Screen by itself, our server keeps:

• a random ID the app makes when it's installed (not your iPhone's own identifiers, and not linked to an account);
• the token Apple gives the app for starting Live Activities, and whether the app is a test build;
• each live event: its name, stop, lines, days, start and end times, and whether it is switched on;
• for each day an event runs: when its Live Activity started and ended, the token Apple gives that Live Activity for updates, the buses it last showed, and any error delivering it.

During an event's window our server sends the Live Activity its updates (the next buses and their times, the stop's name and the event's name) through Apple's Push Notification service, which delivers them to your iPhone.

The name you give an event is shown on your Lock Screen and kept on our server, so don't put anything in it you'd rather we didn't have.

Deleting a live event in the app deletes it from our server the next time the app is in touch. Each day's record of an event is deleted after 30 days. A token Apple tells us no longer works is deleted at once, and once the app hasn't been in touch for 90 days, an install with no live events, or whose token Apple has said no longer works, is deleted with its events.

06If you make an account

An account is optional. It keeps the stops and lines you track the same on the website and in the app. You must be 13 or over to make one.

Signing in sets a cookie (see Cookies) that keeps you signed in for 30 days after you last use it. The iPhone app keeps the same sign-in in its own storage and your iPhone's Keychain.

When you track a stop or a line, our server also collects its buses' arrivals and delays for everyone's statistics. That is information about the buses, not about you, and it stays if you delete your account.

07If you write to us

When you write to [email protected] or [email protected], we keep your email address and message to answer you, and only for as long as we need them to help you.

08Why we're allowed to

09Cookies and similar

The website uses only the cookies it needs to work, which the law allows without asking. They are set only if you sign in:

The web app also remembers your choices in your browser's local storage (the town or city you picked, light or dark, the lines and stops you've picked, the planner's settings). They stay in your browser; we don't keep them.

Recording visits, only if you allow it. The website asks whether we may record how it is used, with Webrec, a session recording and analytics tool that Rouic Ltd makes and runs itself, on its own servers in the UK. Nothing of Webrec's is loaded, and nothing is stored, unless you say yes; a browser that sends Do Not Track or Global Privacy Control has already said no, and isn't asked. If you allow it, Webrec records the pages you look at, what you click and how far you scroll, the size of your window, errors the page runs into, and the kind of browser and device you use. Anything typed is masked before it leaves your browser, your email address is left out of the recording, and the requests the page makes (which can include the part of the map you're looking at) are not recorded. Webrec keeps a random ID and the state of the current visit in your browser's local and session storage, under names beginning wr_, and the site remembers your answer under ukb-consent. "Cookie settings" at the foot of every page brings the question back; saying no stops the recording and removes what Webrec kept. Recordings are kept for as long as Webrec's retention for the site allows, then deleted. The app records nothing like this.

10Who else is involved

We don't sell or share your data. These organisations handle some of it for us, or (where marked) only because of something you choose to use:

Bus times and positions come from the Bus Open Data Service (Department for Transport), with timetables from operators’ published data and road and weather conditions from TomTom and Open-Meteo for the places we cover. None of them receives anything about you.

Where data goes outside the UK (to Cloudflare, Apple, Google, or the map services your browser uses), it is protected by the UK's adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or by the UK International Data Transfer Addendum.

11How long we keep it

12Your rights

You can ask to see the personal data we hold about you, have it corrected, have it deleted, restrict or object to how we use it, and receive it in a form you can take elsewhere. Where we rely on your consent you can withdraw it at any time.

You can delete your account yourself, straight away: on the website, Account → Delete account, or from the account settings in the app. It deletes the account and everything in it. For anything else, write to [email protected], from your account's email address if it is about your account. We answer within one month.

Live events and your chosen area aren't linked to your name, so we can't look them up by it. Delete them in the app, or tell us the names and stops of your live events and we'll find them and delete them, with the app's install ID and its tokens.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

13Keeping it safe

Everything travels over HTTPS. Passwords are stored only as bcrypt hashes, and a sign-in is a signed token that can't be forged. Access to our servers and database is limited to the people who run UK Buses. If something ever went wrong in a way that put you at risk, we would tell you and the ICO as the law requires.

14Children

Bus times are for everyone, and using them involves no personal data beyond what's described here. Accounts are for people aged 13 and over. There is no profiling or advertising anywhere in UK Buses.

15Changes

If we change how we use your data, we'll update this page and its date, and for anything significant we'll say so on the website and in the app before it takes effect.