Last updated: September 2026
Very little, and what we do keep for operational purposes (like server access logs) is minimal and short-lived.
If you tap "Nearby Stops", your browser shares your coordinates with this app to find bus stops near you. The app may also request your location automatically the first time you visit, or when you return with a saved stop, so it can suggest a nearby stop without you having to search.
Your coordinates are sent to StopBoard's own servers to find nearby stops, and are also kept in your browser's local storage so a repeat lookup within a few minutes doesn't need a new GPS fix. This stored location automatically expires and is deleted after 5 minutes, whether the app is reloaded or left open in the background.
If you open a map, the map area you're viewing (which may be centred on your location) is loaded from our map tile provider, CARTO — see Map tiles below.
Legal basis: consent (Article 6(1)(a) GDPR); location is only requested with your browser's permission, which you can deny or revoke at any time in your browser or device settings.
You can use the search bar instead — location is entirely optional. If a location is already available, search results are ordered by proximity, but searching itself never requests a new location fix.
To prevent abuse, we limit API requests per visitor. Your IP address is hashed and stored in Redis with a 1-minute expiry to count requests, with a brief in-memory fallback only if Redis is temporarily unreachable. The raw IP is never stored.
Legal basis: legitimate interest (Article 6(1)(f) GDPR): protecting the service from overload and abuse.
Our hosting infrastructure records the IP address, requested page, and timestamp of each request to our servers. This is standard technical logging necessary to operate the service, detect abuse, and maintain security. These logs are retained for 7 days and then automatically deleted.
This is separate from and unrelated to the anonymous, cookieless analytics described below (which never records IP addresses) and separate from the hashed IP used above for rate limiting, which is never stored.
Our application logs may also temporarily contain the URLs of requests made to our servers. Coordinates and credentials are redacted from these logs before they are written. Application logs are retained for 7 days.
Legal basis: legitimate interest (Article 6(1)(f) UK GDPR).
We use no cookies, no advertising, and no third-party trackers. We do not use Google Analytics, Facebook Pixel, or any similar service. We use Umami, a privacy-friendly, cookieless analytics tool hosted on our own server to count page views. No personal data is collected, no cookies are set, and all analytics data stays on our infrastructure.
We do use your browser's local storage (not cookies) to remember things like your saved stops, recently viewed stops, and theme preference. This stays on your device, and you can clear it any time via your browser's site settings.
We use local storage in your browser to count visit days and manage which tips you've seen, so we can show relevant prompts. This data stays in your browser and is never transmitted to our servers.
Map tiles are loaded from CARTO (a third-party provider). All other resources including fonts, icons, and scripts are served from our own domain.
Maps in StopBoard use map tiles from CARTO (basemaps.cartocdn.com), a
third-party provider. When you view a map, your browser loads these tiles directly from
CARTO, which receives your IP address and the approximate area of the map you're
viewing. CARTO's handling of this data is covered by its
privacy policy.
Real-time and schedule data comes from the Bus Open Data Service (BODS), published under the Open Government Licence v3.0, © Crown copyright.
All analysis (dwell times, travel times, predictions) is derived from this public data. No passenger or personal information is used.
If you use the Report Bug button, it shares a snapshot of the current page's data (such as the stop and live bus info you're viewing) plus any description you choose to add. We deliberately leave your precise location out of this by default. Please don't include personal information in the description field.
No account, cookie, or identifier is attached to a bug report. It's kept for up to 180 days and then automatically deleted.
The page address, stop, and any description you add are also forwarded to Telegram so the operator is notified of new reports.
Legal basis: legitimate interest (Article 6(1)(f) GDPR) — you take an explicit, informed action to send it.
The occasional review prompt lets you leave a star rating and optional comment. This is entirely anonymous — no account, cookie, or identifier is attached — and is shown at most once per browser.
Reviews are kept for up to 12 months to help us track feedback trends, then automatically deleted. Your rating and any comment are also forwarded to Telegram so the operator is notified of new reviews.
Legal basis: legitimate interest (Article 6(1)(f) GDPR).
The Support StopBoard link leads to Buy Me a Coffee, a third-party payment service with its own privacy policy.
Under GDPR you have the right to access, correct, or delete any personal data we hold about you. We store very little — server access logs (IP address, retained for 7 days), application logs (retained for 7 days), and any bug reports or reviews you choose to send — so there is typically nothing to retrieve, but you're welcome to ask.
Questions about privacy? Email hello@stopboard.uk.