1. Controller
The controller of personal data processed through the BusDot passenger app (“the App”) is the BusDot operator, reachable at fastracklogisticsmx@gmail.com.
This notice is issued under Mexico’s Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.
2. Scope
This policy covers only the BusDot passenger app on:
- Android, application id
org.busdot.app - iOS, bundle id
com.busdot.app
It does not cover BusDotDriver, the admin console, or driver / fleet-owner / admin accounts.
You may use the App as a guest without creating an account. In that case we do not create a passenger profile or Auth user. If you grant permission, we still process location and technical data needed for radar, maps, and (on Android) ads.
3. Data we collect
We do not collect CURP, home address, card numbers, biometrics, or a persistent trip history for passengers. Passenger GPS is not stored as a location history in the profile table.
3.1 Data you provide
| Data | When | Where it is stored |
|---|---|---|
| Email address | Email/password sign-up or sign-in, or Google Sign-In | Supabase Auth (auth.users). Also stored encrypted on-device while the session is active. |
| Password | Email/password registration or sign-in | Sent to Supabase Auth. Not stored in plaintext on the device or in passenger_profiles. Supabase stores a hash. |
Display name (display_name / full_name) |
Sign-up; editable in Profile. With Google, may come from the Google account name. | Auth user metadata and table passenger_profiles (user_id, display_name, preferences, created_at, updated_at) |
| Profile preferences JSON | When the passenger profile is created (initially empty) | passenger_profiles.preferences. Not used to store location. |
3.2 Data collected automatically or via OS permission
| Data | Permission / source | How the App uses it |
|---|---|---|
| Approximate and precise location (latitude, longitude) | Android: ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION. iOS: when-in-use location. |
Radar only: center the map and query nearby units.
Sent to the server on each RPC nearby_bus_positions as
p_lat, p_lng, radius p_radius_m = 1,500 meters,
and p_route_id for the selected route.
Repeated while radar is open (snapshot every 45 seconds).
Also used on-device to join Realtime channels for geohash cells (precision 6) around you.
Not written to passenger_profiles.
|
| Session identifiers (access token, refresh token, user id, expiry) | After a successful sign-in | Android: AES-256 EncryptedSharedPreferences. iOS: Keychain (expiry in NSUserDefaults). Cleared on sign-out. |
| Onboarding completed flag | After the welcome screen | Local device storage. Kept after sign-out. |
| Temporary occupancy unlock | After a rewarded ad on Android | On-device only: expiry timestamp and whether the first unlock was granted (8 minutes first time, then 5). Not sent to BusDot servers. |
| Premium subscription status | Google Play Billing product busdot_premium_monthly (Android only; iOS purchases are not available yet) |
Google Play processes payment. The App checks locally whether Premium is active to hide ads. We do not send card numbers to our servers. |
| Advertising ID and ad-tech data | Android: AD_ID permission and Google Mobile Ads (AdMob). Formats: banner, app-open, rewarded (occupancy unlock). |
AdMob may collect advertising ID, IP, device type, language, and sometimes coarse location. The current iOS app does not include AdMob. |
| Map data | Mapbox SDK (Android and iOS) | To render the map and your marker. Mapbox receives tile requests and may process technical data (IP, visible map region) under its policy. |
| Google Sign-In data | If you choose Continue with Google | The App receives an id_token and nonce and sends them to Supabase Auth. Google may process email, name, and account id under its policy. We do not request contacts or Drive. |
| Email confirmation | Email sign-up | Supabase sends a confirmation link. Completing it calls Edge Function email-confirmed. |
3.3 Data the App reads that is not about you
Radar reads the public route catalog (id, short_name, name)
and unit positions reported by drivers (bus_id, route_id, coordinates,
recorded_at, occupancy, destinations). Those records belong to vehicle operations, not
the passenger. Only fresh positions are shown (120-second freshness threshold).
The passenger app does not write driver tables, vehicle requests, incidents, fleets, or admin records.
3.4 What we do not do today
- The passenger app code does not include Firebase Crashlytics or Google Analytics.
- There is no in-app account deletion; deletion is handled by emailing codexia.labs.admon@gmail.com (section 7).
- We do not track passengers in the background: iOS is when-in-use; Android does not declare background location.
4. Purposes
4.1 Primary (required for the service)
- Create and maintain a passenger account if you register.
- Show buses on the selected route within 1.5 km of you.
- Update the map via snapshots and Supabase Realtime.
- Let you edit the display name.
- Restore session on the same device.
4.2 Secondary
- Advertising (Android, non-Premium): banner, app-open, and rewarded ads to unlock occupancy.
- Premium (Android): remove ads via Google Play.
To avoid ad-related secondary purposes you can use iOS (no AdMob in the current build), subscribe to Premium on Android, or limit the advertising ID in system settings. Location for radar remains a primary purpose if you use that feature.
5. Processors and third parties
| Provider | Role | Data | Policy |
|---|---|---|---|
| Supabase | Backend: Postgres, Auth, Realtime, Edge Functions (losmvkzqeqhiofbhzqgt.supabase.co) |
Account, profile, radar queries with coordinates, route catalog, unit positions | supabase.com/privacy |
| Sign-In, Play Billing, AdMob, Play location services | Google token, purchases, advertising ID, device location | policies.google.com/privacy | |
| Mapbox | Maps | Tile requests and SDK technical data | mapbox.com/legal/privacy |
| Firebase Hosting | Hosts this privacy site | Typical web logs (e.g. IP, time, requested resource) | firebase.google.com/support/privacy |
| Apple | iOS, App Store distribution | System and store data as described by Apple | apple.com/legal/privacy |
We do not sell your email list or passenger location to data brokers. AdMob may personalize ads under Google’s practices when you use Android with ads enabled.
6. Retention
- Account and profile: while the account exists, then as needed to complete deletion and legal duties.
- Radar queries: coordinates travel with the request to filter units; they are not stored as passenger profile GPS history. Infrastructure logs follow the host’s retention.
- Local session: until sign-out or uninstall.
- Occupancy unlock: 5 or 8 minutes on-device.
- Purchases: retained by Google Play under its relationship with you.
7. ARCO rights and requests
You may access, rectify, cancel, or object to processing of your data, and revoke consent, as provided by the LFPDPPP.
In the App you can:
- Rectify your name in Profile.
- Sign out (the App continues as guest; this does not delete the server account).
- Revoke location permission in system settings (nearby buses will not work).
- Limit ads in Google / Android settings.
- Cancel Premium in Google Play.
To delete the account or request access/erasure of server data, email codexia.labs.admon@gmail.com from the account address, stating that the request is for BusDot (passengers), the account email, and whether you seek access, rectification, cancellation, objection, or restriction.
We may ask you to verify identity. If you believe your data-protection rights were violated, you may contact INAI: home.inai.org.mx.
8. Children
BusDot is a general public-transport tool. We do not target children under 18 or intentionally collect their data. A parent or guardian may request deletion at codexia.labs.admon@gmail.com.
9. Security
- HTTPS / WSS to the backend.
- Encrypted session tokens on Android; iOS Keychain for secrets.
- Passenger profile APIs use the user’s access token, not a service-role key in the App.
- No background location permission.
- Passwords are not stored in the public profile table.
10. Changes
The current version is published on this site. The “last updated” date is the effective date. Material changes (new data categories or purposes) will be reflected here and, where required, we will seek new consent.