Privacy policy
Data controller
GironaGo is a free, unofficial app for Girona's city buses, maintained by snackva. Contact: gironago@snackva.dev.
GironaGo is not affiliated with Transports Municipals de Girona (TMG), Ajuntament de Girona or any other public body.
In short
- No accounts or sign-up.
- No ads, trackers or third-party SDKs. Only first-party anonymous usage statistics, using a random identifier (see below).
- Your location stays on your device. The Map screen only asks the server for the buses inside the area on screen, and that is not stored.
- The server only sees the technical data of a web request (see below), in shortened form and for a short time.
What stays on your device
Location: only if you allow it and only while you use the app, to show the nearest stops and centre the map. It is processed on the device; requests to the server never contain your position. The one exception is the Map screen: to show the buses in view, the app sends the boundaries of the visible map area, which covers where you are only if you have centred the map on yourself. You can revoke the permission at any time in iOS Settings.
Saved stops, language, appearance, the last tab or line viewed and cached line shapes. They are stored only on your iPhone and are removed when you uninstall the app.
What the server receives
Each time the app asks for data (lines, stops, arrivals), the server receives the usual technical data of any web request: the IP address, the time, the requested path and the app name and version with the operating system. To answer, the server also reads what you are looking at (stop and line numbers, and on the Map the visible area). These details are used for the response and are not written to the logs.
It is used only to provide the service, prevent abuse (rate limiting) and detect and fix faults. The IP address is used in memory for rate limiting and is stored in logs only in shortened form (the last part is removed), so it does not identify anyone. Rare technical error entries of the web server can contain the full address. Logs are deleted automatically after 14 days at most.
Legal basis: legitimate interest in operating and securing the service (GDPR art. 6.1.f). This data is not sold or shared, no profiles are built and it is not combined with other sources.
Usage statistics
To know how many people use the app and size the service, the app creates a random identifier (a UUID) on first use and sends it with every request, together with an app key that only serves to tell the app apart from outside scripts. The identifier is not derived from the device, phone number, advertising ID or any account, and cannot be linked to a person.
The server immediately turns it into an irreversible code (a hash with a secret of its own) and keeps only that code, the date of first and last activity, the app version, the system (iOS/Android) and the number of requests that day. Only totals are published (how many distinct installs there were in an hour, day or month, how many are new, how many per version, how many requests they make). They are not combined with the IP address, location or what you are looking at. An install's data is deleted automatically after 90 days without activity.
Legal basis: legitimate interest in operating and sizing the service (GDPR art. 6.1.f). If you uninstall the app the identifier disappears from the device; reinstalling creates a new one.
Third parties
The app's map is Apple Maps (MapKit). Your device talks directly to Apple to load it, under Apple's privacy policy. The app is distributed through Apple's App Store and TestFlight.
The server is self-operated; no external analytics, advertising, crash-reporting or user-data storage services are used.
Schedules and arrivals come from the Girona city bus information system (TMG / Ajuntament de Girona). That source has its own policies; the app sends it no data about you.
Children
The app is not directed at children and does not collect personal data from them or anyone else.
Your rights
You can exercise your rights of access, rectification, erasure, restriction, objection and portability (GDPR) by writing to gironago@snackva.dev. Because there are no accounts, logs are shortened and the statistics identifier is random and irreversible, it is usually not possible to identify any data about you, but that will be confirmed to you.
If you think your data is handled improperly, you can complain to the Spanish Data Protection Agency (aepd.es).
Security
All communication is encrypted (HTTPS). The app contains no third-party code that collects data. Only the minimum necessary is kept, for the minimum time.
Changes
If this policy changes, the new version will be published at this address and the date updated.