Our privacy policy
Only what's necessary
We don’t force you to create an account. We ask for what we need and nothing more. Like your location to show nearby transit lines. Or credit card info when you buy a fare. We never collect data in the background when you're not using the app.
Disconnecting the dots
Some things are better left alone. For example: we store your location history separate from personal data like your email and user profile. Because honestly? We don't need to know.
Personal data is never for sale
We don't do business with advertising companies or data brokers. Instead, we help cities and academics improve transit service by looking at anonymized app usage patterns. Your personal data? It's not part of the equation.
Our privacy vision
We process personal data only for the purpose of delivering our Services. For example, we collect your location data with your express consent for the purposes of finding the nearest transit routes. Similarly, we process your credit card information only to allow you to make a purchase, using a PCI DSS certified partner which securely processes your payment (we never even see your credit card number).
We don’t use your personal data for secondary purposes without your consent. Instead, we aggregate and de-identify data so that we can protect your privacy (we refer to this data as “aggregated data” throughout this Privacy Policy). We use aggregated data for various purposes, such as improving our services, or to identify usage patterns that help transit agencies improve and plan their transport services. This Privacy Policy provides an exhaustive list of the possible uses of personal data, and only some examples of what we can do with aggregated data, since aggregated data does not contain any personal data.
Purpose
This Privacy Policy provides you with more information on how we process your personal data, and information about how you can exercise your rights.
This Privacy Policy applies to our Services, which means that it does not apply in these situations:
How to contact us
Why we collect personal data from you
Our main goal is to help you navigate public transit and connecting multimodal options, so we collect your personal data to provide our Services, such as to:
Locate and track public transit, bikeshare, scooters, on-demand transit, ridehail, carshare, and other modes of transport
Plan journeys using these modes of transport
Purchase transit fare value, tickets, and passes
Book carshare vehicles
Purchase, reserve, and unlock bikeshare services
Provide directions to destinations using our Search feature, including to addresses you select from entries in your mobile phone’s contact list or calendar
Help improve the quality of the app by sharing debugging and programming problems with our team of developers
Use the “contact us” form on our website
Subscribe to our newsletter or marketing emails
Purpose of the processing
Data concerned
Legal basis of the processing under the EU + UK GDPR
Account creation and management
Email address, first name, last name
We create your account based on your explicit consent as you have no obligation to use this functionality, and we manage it based on our service agreement with you
Purchase of ticketing or bikeshare services
Email address, first name, last name, payment card number, billing and shipping address, phone number, birth date, transaction history
We obtain your explicit consent to ascertain legal use of services
Usage of ticketing, bikeshare, or ridehail and on-demand transit services
Email address, latitude and longitude
We process this information based on our service agreement with you
Regular usage of the application, such as planning journeys or anonymous contribution to crowdsourced efforts that improve real-time information about transit service
Latitude and longitude, data from the device’s motion sensors
We are not subject to an applicable legal basis because this data is anonymized at collection
Saving favourite placemarks in the app to make it easier to plan journeys
Latitude, longitude, address and name of favourite places (home, work, etc.)
We obtain your explicit consent as you have no obligation to use this functionality
Help improve the quality of the App by sharing information to debug issues
Email address, device model details and OS version, latitude and longitude, previous trip planner request origin and destination
We obtain your explicit consent when you send an email to us with debug information
Receiving push notifications for service alerts, promotional offers, or when a new region is available in Transit
Unique push notification device identifier
We anonymize this data
Getting notified by email when a new region is available in Transit
Email address
We obtain your explicit consent as you have no obligation to use this functionality
Newsletter management, using a “contact us” form on our website, or when signing up for a new account
Email address
We obtain your explicit consent. You can unsubscribe at any time using the unsubscribe functionality in the newsletter, or by reaching out to us.
How we use anonymized and/or aggregated data
We use anonymized and/or aggregated data, which cannot allow us to directly identify you. We use these data to:
Provide crowdsourced data in the app with information on transit vehicles, location, crowding, estimated time of arrival, and other traffic-based information which can help our users plan reliable trips;
Conduct research on transportation patterns and get more information on how our App users navigate public transit and other modes; and
Measure the usage of our Services, including their performance.
How we collect data from you
We collect information as described above in two ways:
Because you provided us with your personal data directly, such as:
Registering for a Transit account (which can include email address, first name, last name, payment card number, billing and shipping address, phone number, birth date, etc.)
Sending feedback through the “Email us” feature in the Settings menu (email address and other information you may provide). When using this option, an identifier is included in the subject of the email that allows us to access contextual information about your app usage (such as your most recent locations, device type, OS version, and recent trip plans) that helps us address issues you may be reporting.
Instructing us to process or collect data, such as through your setting preferences, including when you authorize the collection of location data and motion activity when using the “GO” functionality (including settings you control on your device which determine whether or not the App will collect data in the background while the “GO” functionality is in use).
Through automatic collection as a result of your use of the Services, such as:
Interacting with our App (taps, screens viewed, transit modes enabled, trips planned, searches made, etc.) from which performance data can be generated
General device location (region and country)
Device type, OS version, and other information about your device
Where we store and process your personal data
Data such as app preferences, pinned lines, and favourite locations are hosted on servers located in Canada. Personal data such as birthdate, billing addresses, phone numbers, and payment data are stored encrypted in Canada. For backup purposes we transfer data between Canada and the European Union.
When and how we share your data
To deliver our Services, we use service providers to host and process your data. We also share personal data with partners, if you request that we do so. For example, if you want to use a bikeshare or a fare payment service, you may ask that we share your personal data with them in order to create an account.
We host and process your data with our service providers:
Google Cloud Platform (hosting of web services and backups of user preferences)
Amazon Web Services (hosting of web services and personal data)
GloboTech (hosting of web services)
Amplitude (product analysis for application usage)
Google Analytics (product analysis for website usage)
Sentry (application crashes and issues analysis)
Firebase (storage of user preferences and favourite locations, and sending push notifications)
Spreedly (payment services)
We share your personal data with our integration partners if you request that we do so, for example to make a purchase or sign up for a service:
Masabi (to offer fare payment for various transit authorities)
Token Transit (to offer fare payment for various transit authorities)
Bytemark (to offer fare payment for various transit authorities)
BCycle (to offer bikeshare services)
Lyft (to offer bikeshare services)
Communauto (to offer carshare services)
In case you request assistance with the use of our App, we might share your request and personal data, including your contact information, with third parties as necessary to address your request, such as with transit agencies and shared mobility providers directly involved in the issue.
In case a business transaction is completed, you agree that any information may be transferred to the corporation that owns Transit or the relevant part of it in order to carry its business. A “business transaction” includes, but is not limited to, a reorganization, merger, purchase, sale or other acquisition or disposition of a corporation or any of its assets. This Privacy Policy will continue to apply after a business transaction.
If we receive a request from law enforcement or if we are otherwise required to comply with a legal obligation, we may have to disclose your personal data. We take the time to verify that the request is lawful, and we share no more than we are required to.
When you purchase or access services from a transit agency or a shared mobility provider through our App, such as in cases of suspected credit card fraud, we will share the information required to ascertain your lawful use of those services (including your payment information, relevant personal data, and any relevant location data).
Security of personal data
We’ve taken steps to protect your privacy by implementing technical and administrative security features to prevent unauthorized access to or release of your personal data. While we do our best to secure our Services, we cannot guarantee the confidentiality or accuracy of any material transmitted over the Internet and you remain responsible for the security of information that you communicate over the Internet.
Retention of personal data
We retain your personal data until you request its deletion. You can delete your personal data by using the “delete account” functionality in the App’s settings menu.
Personal data about children
We do not knowingly process personal data from children under the age of 13. If you have reason to believe that a child under the age of 13 has provided information to us, please contact us. If we learn that we have collected information of a child under 13, we will take steps to delete such information within a reasonable time.
Cookies
Transit does not track users with cookies on its website and does not use cookies from third parties.
Third parties do not collect information about your online activities over time and across different websites when you use Transit.
Your rights
The law provides you with rights regarding your personal data. These rights may change depending on the jurisdiction in which you are located, reside, or are a citizen, and they may not apply to all types of personal data. Most individuals using Transit have the right to access their personal data, and the right to request corrections to their personal data under certain circumstances, such as if the personal data is inaccurate or outdated.
Depending on the circumstances, the following rights may be available to you:
Right to be informed
Your right to be informed is primarily met with this Privacy Policy. From time to time we may provide additional information through email communications or our websites.
Right of access
Your personal data is always encrypted. Transit utilizes a segregation of duties to make sure no single Transit employee can ever decrypt your personal information. If you have any questions about access to your data, please contact us.
Right to rectification
If you believe that the personal data we hold about you is misleading, inaccurate, or incorrect, please let us know and we will do our best to make the necessary corrections.
Right to erasure
Please use the “delete account” functionality in the App’s settings menu to erase your personal data.
Right to restrict processing
The app is designed to give you control of which services you use and what information you provide. Please contact us if you have any questions.
Right to data portability
Please contact us if you wish to receive a copy of your data.
Right to object
Transit allows you selective control over data processing, as well as the ability to request deletion of your personal data. For example, you can choose whether or not to enable our GO step-by-step navigation assistant, whether or not to enable location services, and whether or not to contact us through the app if you come across a problem.
Rights related to automated decision-making including profiling
We do not perform automated decision making.
If you want to exercise your rights, or if you have a question or complaint about how we collect, use, or disclose your personal data, you can communicate with us by email at privacy@transitapp.com or send us a letter at the address indicated above.
Generally, we will address your inquiry within 30 days unless we request an extension because of the nature of your request. Different laws have rules on how to respond to your requests regarding your personal data, and we may change how we respond to your request to comply with these laws. For instance, if we must respond in 15 days to your request, we will respond within 15 days even if the Privacy Policy says within 30 days. The information that we provide in this Privacy Policy is to help you understand generally how you can work with us to exercise your rights.
We will try our best to respond to your request without charging you any fees, but if your request involves significant costs for us (such as processingprinting or transcript costs), then we may invoice you these fees after you have approved them. We may also need you to share personal data to enable us to confirm your identity prior to responding to your inquiry.
If we cannot respond to your inquiry or if we must reject your request, we will notify you via email and explain our decision. If you do not agree with how we handled your inquiry or request, please let us know. Otherwise, you can also contact your local data protection authority or privacy and data protection regulator, such as the Office of the Privacy Commissioner of Canada if you are located in Canada:
Office of the Privacy Commissioner
30 Victoria Street
Gatineau, QC Canada, K1A 1H3
www.priv.gc.ca
+1 800-282-1376
Updates to this Privacy Policy
We will update this Privacy Policy for various reasons, such as to reflect changes to how we process your personal data, or if there are new laws requiring additional or different disclosures than those provided herein. If these changes are material and adverse, we will notify you on our Services or otherwise on our website. You can see below the last date at which we updated our Privacy Policy.
This Privacy Policy was last updated on February 28, 2022.