Privacy Policy

BusHop ("we", "our", or "us") operates the website and mobile app at bushop.co.uk. This privacy policy explains what data we collect, why we collect it, and what rights you have over it.

We keep this plain. No legalese walls. If anything is unclear, email us at bushop@polsia.app.

1. What we collect

Location data (Near Me feature)

When you use the Near Me feature, your device shares its location with us to find nearby bus stops. This data is used only for that session — we do not store, log, or retain location data after the session ends. It is never shared with third parties.

Email address

When you create an account, you provide your email address. It's used to manage your subscription and to send service-related communications (journey reminders, subscription confirmations, support replies). We don't send marketing emails unless you opt in.

IP address (analytics)

We record page views and feature usage for product analytics. To protect your privacy, IP addresses are hashed with SHA-256 before storage. The raw IP is never stored — only the one-way hash, which cannot be reverse-engineered back to your IP.

Stored journey data

Your saved favourite stops and routes are stored in your account so they sync across devices. You can delete them at any time.

Subscription token

After purchase, a Stripe-generated token is stored in your browser's local storage to confirm your subscription status. This is a non-sensitive reference token — it cannot be used to make charges.

2. How we store and use your data

Data is stored on secure servers operated by our hosting provider (Render, using Neon PostgreSQL). We implement standard access controls, encryption in transit (HTTPS/TLS), and AES-256-GCM encryption for payment tokens.

We use your data to:

• Provide the Near Me feature (location, session only)
• Manage subscriptions and process payments via Stripe
• Display your saved favourite stops and routes
• Understand product usage to improve BusHop (hashed IP analytics)

3. Third-party services

We use third parties to make BusHop work:

• Stripe — processes your subscription payment. Stripe handles card details; we never see or store your card number. Stripe Privacy Policy
• bustimes.org — provides the timetable data we display. Their privacy approach is to share open transport data under the UK Open Government Licence.
• Photon / OpenStreetMap — provides geocoding (converting place names to coordinates). OSM Foundation Privacy Policy
• DataFeeds / BODS — the Bus Open Data Service, operated by the Department for Transport, provides national timetable data under open licence.

4. Cookies and local storage

We use browser local storage for:

• Saved favourite stops and routes — stored locally so you can access them across sessions without logging in
• Subscription token — a non-sensitive Stripe reference that confirms your subscription status
• Session analytics ID — a randomly generated UUID stored locally to distinguish sessions in our analytics

We do not use advertising cookies, tracking pixels, or third-party analytics that share data with ad networks.

5. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — request your data in a machine-readable format
• Object — object to our use of hashed analytics data

To exercise any of these rights, email bushop@polsia.app. We'll respond within 30 days.

6. Data retention

Location data: not stored (session only). Analytics hashes: retained for 12 months. Account data: retained until you delete your account. Subscription records: retained for 7 years for accounting obligations.

7. Children's privacy

BusHop is not directed at children under 16. We do not knowingly collect data from anyone under 16.

8. GDPR compliance (UK users)

For users in the United Kingdom, we process your data under UK GDPR. Our legal basis is:

• Contract performance — processing your account and subscription to provide the service
• Legitimate interests — hashed analytics to improve the product, where your interests do not override ours
• Consent — optional marketing communications (you can withdraw at any time)

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data properly.

9. Changes to this policy

If we change what we collect or how we use it, we'll update this page and change the "Last updated" date. For significant changes, we'll notify you by email if you have an account.

10. Contact us

Questions about this privacy policy or your data?
Email: bushop@polsia.app