Privacy

This is a reading version. The German privacy policy is the legally binding one. Where the two differ, the German text applies.

In short

There is no user account. A report consists of station, line, direction, the report type (construction work or ticket inspection, for instance), a detail for it (a full closure, for instance) and the time. Neither location coordinates nor free text, images or a user identifier are transmitted. None of these fields is a text field: direction, report type and detail are choices from fixed lists. Reports expire automatically. How quickly depends on what was reported: a ticket inspection is off the map after two hours at the latest and deleted after 24 hours, construction work stays for up to fourteen days and is deleted after thirty. The full table is further down.

Controller

Markus Sumin, see the legal notice.

Legal basis

Reports are processed on the basis of legitimate interests (Art. 6(1)(f) GDPR). The legitimate interest is shared information about the current situation in public transport. A report names no person, contains no free text and no image, is coarsened to station, line and direction, and expires after a short time. You may object to the processing under Art. 21 GDPR; the address for that is in the legal notice.

The retention period depends on the report type, and there is a reason for that. The short period for an inspection report is the balancing itself: such a report indirectly describes a person at work who can be identified through duty rosters, and the shorter it stands, the weaker that link. Construction work, a broken lift or a closed section describe the state of a facility instead; there is nobody there about whom anything is asserted. What stays the same for every report type is the handling of the hash value used for abuse prevention: it is removed from the record three hours after the report came in, including for a construction report that is stored for thirty days.

What data is processed

Reports

Station, line, direction, report type, detail, time. No coordinates, no text, no image. Every one of these fields is a choice from a fixed list; the server accepts nothing that does not appear there.

For how long

Counted from when the report came in, regardless of how often it is confirmed. A ticket inspection is off the map after 45 minutes without confirmation and after two hours at the latest with them; the server hands out nothing after that. The other report types have a fixed period that confirmations cannot extend:

• Emergency services: 1 hour on the map, deleted after 24 hours
• Ticket inspection: 2 hours on the map, deleted after 24 hours
• Disruption: 3 hours on the map, deleted after 24 hours
• Lift or escalator: 7 days on the map, deleted after 14 days
• Construction work: 14 days on the map, deleted after 30 days

Three hours after it came in, the shortened hash value used for abuse prevention is removed from the record for every report type, so that the link to the reporting connection disappears. Until 24 hours after it came in at the latest, the report then only feeds into an aggregate per station, line and report type (“how many reports there, most recently when”). If there was only a single report at a station in that period, that aggregate reflects its time. The aggregate can be switched off in operation; the deletion runs independently of that.

Location

Requested when you tap the location button, and repeatedly for as long as nearby alerts are switched on: the app then determines the position on its own, every two minutes, and every 30 seconds once a report is close to you. With no report on hand at all, the repeated positioning does not happen. The location stays on the device: it moves the map to your position and is compared with the reports that are already on the device anyway. It is not transmitted and not stored. In the iPhone app the app determines it itself and asks you for permission once (“While Using”); there is no background location.

Notifications

Only if you switch them on. While the app is open, everything stays on the device: the app checks the saved list itself and shows the notification locally. Nothing is transmitted and nothing is stored in the process.
So that a notification reaches you even when the app is closed, the iPhone app registers your device with Apple's delivery service (Apple Push Notification service). It receives a device identifier from there, and that identifier is stored here in order to be able to reach you. Stored alongside it are the day of registration, the day of your last app start, the number of failed delivery attempts and your chosen language – the last of these because the text of this notification is composed on the server, and every notification would otherwise be in German. The identifier says nothing about who you are, where you are or whether you have ever reported anything.
The recipient is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. To deliver the notification, the device identifier and the text are transferred to Apple in the United States. The basis for the transfer is your consent under Art. 49(1)(a) GDPR; Apple is additionally certified under the EU-US Data Privacy Framework.
The legal basis for storing it is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in the settings, and the identifier is then deleted. Otherwise it is deleted 30 days after the last start of the app.
The text of such a notification states only how many reports are open, and names no station and no line. The reason is the same as everywhere else: your saved list does not leave the device, so the server does not know it and cannot write anything about it. Put the other way round: while the app is closed you receive a note about new reports in the network, not only about your saved list – your selection takes effect once you open the app.
In the browser, notifications can also arrive when the app is closed. For that your browser creates an address with the delivery service of your device manufacturer (Apple, Google or Mozilla, depending on the browser), and that address is stored here in order to be able to reach you. It is a persistent identifier for your browser and is used exclusively for this. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in the settings, and the address is then deleted immediately. Otherwise it is deleted 30 days after the last start of the app. The content of the notification contains line and station, no information about you. The delivery service learns that a message is going to your device; which report it refers to it does not learn at all: the server sends no content along, it only wakes the browser, which then assembles the text itself from the reports it fetches.

Stored on the device

Your one-time confirmation at the start, your settings including the saved list, the neighbourhood of your saved stations (see below), the time of your last report (for the cooldown), the identifiers of your own reports with their times (so the app does not notify you about your own report), the reports you have flagged (so they stay hidden for you) and a copy of the most recently loaded reports, so the map can show something without a connection. Added to that are the map sections you have looked at: the app keeps the loaded map parts so the map shows something underground too. This information does not leave the device and can be deleted below with one tap.

Neighbourhood of your saved stations

A notification should also arrive when an inspection is reported not exactly at your saved station but a few stations before it. For that the app works out once which stops can be reached from your saved stations within a short travel time, and stores that list on the device. It consists of stop identifiers and travel times in minutes. It contains no coordinates, no timestamps and nothing about where you were or when. It is not transmitted and changes only when you change your saved list.

Abuse prevention

When reporting, confirming, flagging and switching on notifications, a shortened hash value is derived from the IP address and a daily changing secret. With IPv6 only the connection part of the address goes into it, not the device. The value cannot be converted back into the IP address, is valid for one day only and serves exclusively to limit the number of reports per connection and to prevent flooding with false reports (Art. 6(1)(f) GDPR). The IP address itself is not stored. Three hours after a report comes in, the hash value is removed from its record.
If false reports are sent repeatedly from one connection, the operator can put that same hash value on a block list; the server then stops accepting reports from it. Such an entry consists of the hash value, an expiry time and a note that it came from moderation. It lasts no longer than 24 hours and is deleted automatically after that. It is only ever created by a decision of the operator, never on its own.

Hosting

The interface runs as a Worker at Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. The database (Cloudflare D1) is pinned to the Europe region; reports are stored there and not moved beyond it. For access from the United States the transfer relies on the adequacy decision for the EU-US Data Privacy Framework together with the standard contractual clauses.

Server logs

To deliver the service and defend against attacks, Cloudflare processes technical connection data including the IP address. Beyond that, this app keeps no access logs of its own and stores no IP address in its database, see “Abuse prevention”.

Caching

The list of current reports is held for ten seconds in the cache of the data centre answering the request. It is the same for every device and contains nothing specific to one. Requests concerning a single device are not cached.

No tracking

This app embeds no analytics services, no advertising networks and no external fonts or map servers. All displayed content is delivered from the project's own server. There is no access to device information beyond what is necessary for operation (§ 25(2) TDDDG).

There is one exception, and it is switched on: if you allow notifications, your device token is passed to Apple's delivery service so the wake-up call can reach you. Without notifications this does not happen. See “Notifications”.

About reported persons

A report names no person. It contains no name, no description, no image and no identifying mark, only line, station and time. It is limited to those three and expires after a short time.

From a report the app estimates where an inspection might be right now and shades a stretch of the line accordingly. That estimate is made on the device, reaches at most 20 timetable minutes beyond the reported station and disappears with the report. Nothing is combined over time: there is no record of individual sightings, only the summary per station and line described under “How long” above.

Reported persons cannot be notified, because a report carries neither a name nor an identifier. Information under Art. 14 GDPR is therefore provided through this public statement (Art. 14 (5) (b) GDPR). For access, erasure and objection (Art. 15, 17 and 21 GDPR) contact the address given in the legal notice; please state line, station and period so the record can be found while it still exists.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR) as well as the right to lodge a complaint with a supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information.

Deletion

All locally stored information can be removed with one tap in the settings of this app.

Item

Kontrollpunkt Hamburg · public transport situation map

Drawn by

cl3verdesign · Markus Sumin

Map data

OpenStreetMap contributors (ODbL) · Hamburger Verkehrsverbund GmbH (dl-de/by-2-0)