Privacy

This is a reading version. The German privacy policy is the legally binding one. Where the two differ, the German text applies.

In short

There is no user account. A report consists of station, line, direction and time. Neither location coordinates nor free text, images or a user identifier are transmitted. The direction is not a text field but a choice from the destinations of the given line. Reports expire automatically: after two hours at the latest a report disappears from the map, after 24 hours at the latest its record is deleted.

Controller

Markus Sumin, see the legal notice.

Legal basis

Reports are processed on the basis of legitimate interests (Art. 6(1)(f) GDPR). The legitimate interest is shared information about the current situation in public transport. A report names no person, contains no free text and no image, is coarsened to station, line and direction, and expires after a short time. You may object to the processing under Art. 21 GDPR; the address for that is in the legal notice.

What data is processed

Reports

Station, line, direction, time. No coordinates, no text, no image. Station, line and direction are choices from the network; the server accepts nothing that does not appear there.

For how long

Counted from when the report came in, regardless of how often it is confirmed. Without confirmation it is off the map after 45 minutes at the latest, with confirmations after two hours at the latest; the server hands out nothing after that. Three hours after it came in, the shortened hash value used for abuse prevention is additionally removed from the record, so that the link to the reporting connection disappears as well. Until 24 hours after it came in at the latest, the report then only feeds into an aggregate per station and line (“how many reports there, most recently when”); after that it is deleted. If there was only a single report at a station in that period, that aggregate reflects its time. The aggregate can be switched off in operation; the deletion after 24 hours runs independently of that.

Location

Only requested when you tap the location button or switch on nearby alerts. It stays on the device: it moves the map to your position and is compared with the reports that are already on the device anyway. It is not transmitted and not stored. In the iPhone app the app determines it itself and asks you for permission once (“While Using”); there is no background location.

Notifications

Only if you switch them on. In the iPhone app everything stays on the device: the app checks the saved list itself and shows the notification locally while it is open. Nothing is transmitted and nothing is stored.
In the browser, notifications can also arrive when the app is closed. For that your browser creates an address with the delivery service of your device manufacturer (Apple, Google or Mozilla, depending on the browser), and that address is stored here in order to be able to reach you. It is a persistent identifier for your browser and is used exclusively for this. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in the settings, and the address is then deleted immediately. Otherwise it is deleted 30 days after the last start of the app. The content of the notification contains line and station, no information about you. The delivery service learns that a message is going to your device; which report it refers to is encrypted as far as it is concerned.

Stored on the device

Your one-time confirmation at the start, your settings including the saved list, the neighbourhood of your saved stations (see below), the time of your last report (for the cooldown), the identifiers of your own reports with their times (so the app does not notify you about your own report), the reports you have flagged (so they stay hidden for you) and a copy of the most recently loaded reports, so the map can show something without a connection. Added to that are the map sections you have looked at: the app keeps the loaded map parts so the map shows something underground too. This information does not leave the device and can be deleted below with one tap.

Neighbourhood of your saved stations

A notification should also arrive when an inspection is reported not exactly at your saved station but a few stations before it. For that the app works out once which stops can be reached from your saved stations within a short travel time, and stores that list on the device. It consists of stop identifiers and travel times in minutes. It contains no coordinates, no timestamps and nothing about where you were or when. It is not transmitted and changes only when you change your saved list.

Abuse prevention

When reporting, confirming and flagging, a shortened hash value is derived from the IP address and a daily changing secret. With IPv6 only the connection part of the address goes into it, not the device. The value cannot be converted back into the IP address, is valid for one day only and serves exclusively to limit the number of reports per connection and to prevent flooding with false reports (Art. 6(1)(f) GDPR). The IP address itself is not stored. Three hours after a report comes in, the hash value is removed from its record.

Hosting

The interface runs as a Worker at Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. The database (Cloudflare D1) is pinned to the Europe region; reports are stored there and not moved beyond it. For access from the United States the transfer relies on the adequacy decision for the EU-US Data Privacy Framework together with the standard contractual clauses.

Server logs

To deliver the service and defend against attacks, Cloudflare processes technical connection data including the IP address. Beyond that, this app keeps no access logs of its own and stores no IP address in its database, see “Abuse prevention”.

No tracking

This app embeds no analytics services, no advertising networks and no external fonts or map servers. All content is delivered from the project's own server. There is no access to device information beyond what is necessary for operation (§ 25(2) TDDDG).

About reported persons

A report names no person. It contains no name, no description, no image and no identifying mark, only line, station and time. The details are coarsely grouped and expire after a short time. Anyone who wishes to object to the processing (Art. 21 GDPR) can contact the address given in the legal notice.

Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR) as well as the right to lodge a complaint with a supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information.

Deletion

All locally stored information can be removed with one tap in the settings of this app.

Item

Kontrollpunkt Hamburg · public transport situation map

Drawn by

cl3verdesign · Markus Sumin

Map data

OpenStreetMap contributors (ODbL) · Hamburger Verkehrsverbund GmbH (dl-de/by-2-0)