OpaBus

Privacy policy

Effective from 1 October 2026. Covers the OpaBus mobile app (Android and iOS) and the opabus.com website.

1. Who is responsible for your data

The data controller is Michał Cizio, the creator of OpaBus. Contact for all data matters: kontakt@opabus.com.

2. The OpaBus app

  • No accounts. You don’t create an account or give us your name or email to use the app.
  • Location. Only with your permission. Your location is used on your phone to find the nearest stops and plan journeys. We don’t send it to our servers or keep a location history – except when you choose to send a stop position fix using GPS (see below). Without permission you can pick stops by hand.
  • Data on your phone. Favourite stops, “My stay”, settings and downloaded regions are stored only on your phone. Deleting the app deletes this data.
  • Map. The app doesn’t use Google Maps. The map is built from OpenStreetMap data (© OpenStreetMap contributors), and you download the region’s base map from the opabus.com server together with the timetables – after that it works offline. If you choose to open a stop or route in the Google Maps app, Google’s privacy policy applies there.
  • Stop position fixes. When you send a fix yourself (“Fix stop location”), the app sends the opabus.com server: the region and stop, the new coordinates, how you set them (a Google Maps link, GPS with its accuracy, or a point on the map), the pasted link, your comment (if you add one), the app version, language and time of the report. We don’t send a device identifier or anything else about you, and the report doesn’t store your IP address. Please don’t put personal data in the comment. If you paste a short Google Maps link, the app contacts Google’s server to read the coordinates from it. We review reports by hand, and an approved stop position goes into OpaBus timetables for everyone. We keep reports for up to 2 years after review (Art. 6(1)(f) GDPR – accurate stop data).
  • Timetable updates. The app downloads current timetables from the opabus.com server. The server briefly keeps technical connection data (IP address, time, file requested) for operation and security.
  • Partner QR codes. If you open the app from a QR code or install it from a partner’s QR code (Android – information from Google Play), the app sends us the partner code and the type of event once. Nothing that identifies you is sent.
  • Analytics and crash reports. Apart from QR code counters, we don’t collect them at the moment. If we add them, we will update this policy first.
  • Ads and OpaBus Plus (in the future). Before any ads appear, we will ask for your consent to personalisation. Subscription payments are handled by Google Play or the App Store – we never see your card details.

3. The opabus.com website

  • Hosting. The site is hosted by Netlify, Inc. (USA), which keeps technical server logs. Transfers to the USA rely on the EU Standard Contractual Clauses.
  • No tracking. We don’t use tracking cookies or analytics tools. Fonts are served from our own server.
  • Newsletter. We collect your email, language, whether you want to test the app and your phone type, based on your consent (Art. 6(1)(a) GDPR). We keep it until you unsubscribe – via the link in every email or by writing to us. The newsletter is for people aged 16 and over.
  • QR codes and statistics. When someone scans an OpaBus QR code or clicks a store link on this site, we record only the partner code, the date and the type of event. We don’t store IP addresses, cookies or device identifiers – these are anonymous counters.
  • Partner programme (QR code posters). From properties that create a poster we collect the property name, email and optionally a phone number to run the partnership and possibly feature partners (Art. 6(1)(b) GDPR). The property name is shown publicly only with consent. We keep this data for the duration of the partnership and up to 2 years after it ends.
  • Partner form and reports. We collect what you enter and any attached file to reply and correct timetables (Art. 6(1)(b) and (f) GDPR), and keep it for up to 2 years after our last contact. Timetables sent by operators are published only with their consent.

4. Who we share data with

Only providers that help us run the service: Netlify (hosting, forms, QR code counters, stop position fixes) and Google (email). When we choose a newsletter sending tool, we will add it here. We never sell data.

5. Your rights

You have the right to access, correct, delete, restrict, port and object to the processing of your data, and to withdraw consent at any time. Write to kontakt@opabus.com. You can also complain to a supervisory authority – in Greece the Hellenic Data Protection Authority (dpa.gr).

6. Changes

If we change how we use data, we will update this page and the date at the top.