OneBusAway Project Privacy Policy

We value your privacy, so we want to be explicit about what kind of personal information is involved when you interact with OneBusAway.

This page is for the OneBusAway project as a whole. The project as such doesn’t collect any personally identifying information from users.  However, instances of OneBusAway that serve a particular region may save log and other information, some of which is personally identifiable. Each instance should have its own privacy policy, linked from its home page.

OneBusAway Apps

There are five native apps for OneBusAway – apps that have been developed by OneBusAway team members or their close collaborators. Some of these apps have a facility for generating a unique ID for that app instance, which is included in API requests to a OneBusAway server. These are used in generating usage statistics about the number of unique users per day or per week of the corresponding instance of OneBusAway. These IDs are generated in such a way that it is not possible to determine the identity of the device from the ID. We do not collect or send any personally identifiable data from your device.

The exact mechanisms for generating the ID are as follows:

• iPhone – The app instance generates a random ID — not based on the phone’s Unique Device Identifier (UDID). This ID also resets if you re-install the OneBusAway app.
• Android (including Amazon Fire Phone) – OneBusAway uses the manufacturer identifier of your device (also known as the “IMEI” or “MEID”) to generate the ID. It is read once on first install and anonymized (“hashed”).  The anonymized ID is what is sent to the OneBusAway server.
• Windows Phone – Currently the Windows Phone app doesn’t generate an ID at all.
• Windows 8 – Currently the Windows 8 app doesn’t generate an ID at all.
• Alexa – The OneBusAway Alexa skill saves an anonymous unique identifier for the user who made the request (generated by Amazon’s Alexa infrastructure) so we can save information required to get your bus information. This allows us to save your city and stop ID when you initially set up the skill so we don’t have to ask for it every time you start the skill.  The length of this identifier can vary, but is never more than 255 characters. The user ID is automatically generated when a user enables the OneBusAway skill in the Alexa app. Note that disabling and re-enabling a skill generates a new identifier.  We also store a timestamp that represents the last date and time when arrival information was retrieved so we have an idea of how often users are using the skill.

In the future this ID may also be used for analytical tools to help us improve them by gathering information on such things as the number of installations, the model of device that it is installed on, etc.

The iPhone and Android apps include Google Analytics so aggregate, anonymous data about how often different app features are used can be collected.  For example, we could tell that the most used feature of OneBusAway apps is the favorites screen, and only 1/3 of users regularly use the maps screen (these statistics are made up for example purposes).   This data helps us better understand where to focus future improvements.  We do not collect data on individual usage of the app.  For example, we don’t know how many times User X viewed their person bookmarks, or names of those bookmarks.

In the “Help” section of the apps, the iPhone and Android apps allow users to send a feedback email to the regional email address – the user can also add additional recipients to this email, including the app-specific email addresses (e.g., [email protected], [email protected]).  The following information is automatically added to the body of the email to help us troubleshoot issues that users encounter, with the message “The following information is provided for troubleshooting purposes. If you are uncomfortable sharing any of the following information you may remove it, however it may affect our ability to assist you.”  The user can erase this information from the email before it is sent if the user desires not to share this information with the regional OneBusAway administrators or the app maintainers:

• OneBusAway App version – So we know what known bugs do and do not exist in your currently-installed version of the app
• Device make and model (e.g., iPhone 7.2, Samsung Galaxy S5) – Helps us troubleshoot device-specific problems
• OS version (e.g., Android 6.0, iOS 9.3.1) – Helps us troubleshoot operating system version-specific problems
• Set Region Automatically (YES or NO, depending on the user’s settings) – This information helps troubleshoot when a user may accidentally be connected to the incorrect OneBusAway Server that does not serve their city.
• Selected Region (e.g., Puget Sound, depending on the user’s settings) – This information helps troubleshoot when a user may accidentally be connected to the incorrect OneBusAway Server that does not serve their city.
• Custom OneBusAway Server API being used (if the user has entered one in Settings) – This information helps troubleshoot when a user may accidentally be connected to the incorrect OneBusAway Server that does not serve their city.
• The last known location of the user in latitute and longitude, and a timestamp (X,Y at 10:49am) – This information helps troubleshoot when a user may accidentally be connected to the incorrect OneBusAway Server that does not serve their city.

The four native mobile OneBusAway apps currently use the respective built-in Maps APIs to show the user their real-time location and location of bus stops. These Maps APIs have fairly broad data collection abilities, and this data goes back to the respective platform vendor (Google, Apple, Microsoft). The OneBusAway project doesn’t receive this data however.

The OneBusAway Alexa skill is available on any device that supports the Alexa Voice Service, such as the Amazon Echo.  Please refer to your device’s privacy policy, as well Amazon’s privacy policy for Alexa, to better understand what information those devices and services may be collecting when any skill is used (OneBusAway Alexa does not have access to any information collected by these parties).

We want to be completely transparent about what data is collected in the apps, and if you’re interested in digging through the source code, it’s available on GitHub:

• iPhone
• Android
• Windows Phone
• Windows 8
• Alexa

Other Apps Using OneBusAway Services

The OneBusAway servers in different regions often provide data for other transit applications in addition to the official OneBusAway ones. Those apps should include their own privacy policies if they collect personal data.

Beta Test Program for Apps

Project members will periodically release updated versions of the apps, or create new apps. We will often recruit volunteers to help beta test these apps before releasing them. The privacy policy for beta test
participants will be included in the invitation (For iPhone we are using TestFlight to distribute beta versions – here is the TestFlight Privacy policy).

Specific Research Projects

OneBusAway is also a research project, in addition to being a service. We may therefore invite some OneBusAway users to participate in specific research projects in which we gather more detailed information. However, participation in any such study will be voluntary and we will always ask
your permission before enrolling you. We will follow all the standard Human Subjects protocols for such a study, including requesting your informed consent. Any other research projects will only use non-personally identifiable data already collected by the project as a whole or a particular installation, in accordance with this policy and the policy for the particular installation.

Sample Regional Privacy Policy

For organizations or individuals contemplating running a new installation of OneBusAway, here is a  sample privacy policy, which you should feel free to adapt if it seems appropriate for your
situation. (This was the privacy policy for the original Puget Sound deployment during the time it was operated by the University of Washington. It thus includes information about both OneBusAway as a
service and as a research project.)

Please consult other current regional policies for additional examples. (The different regional sites are all linked from the OneBusAway Deployments page).