SubwayStatus

Privacy Policy for SubwayStatus

Effective Date: 2026-09-16
Last Updated: 2026-09-16

Faiz Prasla (“we,” “our,” or “us”) built SubwayStatus as a free iOS app with an optional one-time Pro purchase. This policy explains, in plain language, exactly what the app touches and what our server keeps.

The short version: SubwayStatus has no accounts and no sign-in. It shows no ads and does not track you: there is no analytics or crash-reporting SDK in the app at all, and the ad SDK bundled for a possible future version is never started in this one. Your location never leaves your device. The only things our server stores about your device are an Apple push token (registered on every launch, so we can wake the app when an alert changes) and an App Attest key record — neither of which identifies you.

1. What stays on your device

Settings and cache. Your favourited lines, notification choices, display options, saved routes and a cache of route/alert data are stored on your device with Apple’s UserDefaults and ordinary local files. They are shared only between the app, its Home Screen widget and its Live Activities, through an Apple App Group container that only SubwayStatus can read. Deleting the app deletes all of it.

Location. SubwayStatus asks for location “while using the app” (never “always”) when you tap Near Me or recentre the map. It takes a single fix, at roughly 100-metre accuracy, and uses it on the device only — to centre the map and to pick the nearest stations or stops from a list the app already has. That coordinate is never sent to our server or to anyone else, and we never store it. Deny or revoke the permission any time in iOS Settings; everything else in the app still works.

Your Pro purchase. The entitlement is recorded on your device so Pro features unlock. We do not keep a copy.

Widget and Live Activities. Both render from the same on-device data. Nothing extra is collected to draw them.

2. What our server stores

Push notification token. iOS gives the app an Apple Push Notification service device token. The app sends that token, plus whether it is a sandbox or production token, to our server so we can wake your device when an alert changes. We store the token string and the time it last checked in, in our Upstash Redis datastore. Nothing else is attached to it — no account, no location, no line choices (which lines matter to you is decided on your device, not ours).

To be precise about when this happens: the app registers a token on every launch, whether or not you have allowed notification alerts. iOS issues the token either way, and the only push our server sends is a silent “something changed, check now” wake-up that iOS delivers regardless of your alert setting — that wake-up is what lets an alert reach you promptly instead of whenever iOS next decides to run a background refresh. So an install that has never turned alerts on still has a token stored with us. Turning alerts off in iOS Settings stops SubwayStatus showing you notifications, but does not remove the token. Delete the app and the token stops working; a token that has not checked in for 60 days is then deleted automatically.

App Attest key record. To confirm requests come from a genuine, unmodified copy of the app, iOS generates an Apple App Attest key in your device’s Secure Enclave. Our server stores that key’s ID, its public key and a replay counter. It is a per-install cryptographic identifier, not an advertising ID, and it is not linked to you or shared with anyone. These records currently have no automatic expiry; we delete them when they are no longer useful, and you can ask us to delete yours (see Section 6).

Ordinary server logs. Like any web server, ours (and the CDN in front of it) processes IP addresses and request paths to serve traffic and to rate-limit abuse. We do not build profiles from these logs and do not use them to identify individuals.

3. What we do not do

4. Purchases

SubwayStatus Pro is a one-time in-app purchase handled entirely by Apple through StoreKit. We never see or store your payment details — not your card, not your Apple Account. The app only learns that the entitlement is owned, and that stays on your device. To restore a purchase on a new device: Settings → SubwayStatus Pro → Restore.

5. Who processes data for us, and where transit data comes from

Service What it does What it receives
Apple — APNs Delivers push notifications Your device’s push token, and a silent wake-up with no alert content
Apple — StoreKit Processes the Pro purchase Handled entirely by Apple; we never receive payment details
Apple — App Attest Confirms the app is genuine A device-generated attestation; no personal data
Render (app hosting) Runs our API server Ordinary request data, including IP address
Cloudflare (CDN) Sits in front of the server Ordinary request data, including IP address
Upstash (Redis datastore) Stores push tokens and App Attest key records The items described in Section 2
UmoIQ / Cubic (TTC surface feed) Serves TTC bus and streetcar predictions, which the app requests directly Ordinary request data, including IP address, and the route or stop you are viewing

Live transit data comes from the agencies’ own public feeds — the TTC and Metrolinx (GO Transit) open data, and regional feeds for York Region Transit, Brampton Transit and Regina. Our server reads almost all of them on your behalf, so those feeds get nothing about you at all. The exception is the TTC surface (bus and streetcar) feed listed above: the app asks UmoIQ for those predictions itself, so UmoIQ sees your device’s IP address and the route or stop you are looking at. No feed is ever told anything else about you, and SubwayStatus is not affiliated with or endorsed by any transit agency.

Our website at subwaystatus.live is a separate thing from the iOS app: the web map uses Google Analytics. The app does not, and these policy and support pages carry no analytics or cookies at all.

6. Retention, and asking us to delete something

Data Kept for
Everything in Section 1 (on-device) Until you delete the app or clear its data
Push token 60 days after its last check-in, then deleted automatically
App Attest key record No automatic expiry; deleted on request
Support email you send us As long as needed to answer you

One carve-out, stated plainly: a small number of push tokens collected before this policy took effect sit in an older record that the 60-day timer does not reach. Nothing reads them and nothing is ever sent to them; we are deleting that record by hand rather than leaving it to age out.

Because there are no accounts, we cannot look up “your” data from an email address alone — there is nothing tying either stored item to you. If you want a specific push token or App Attest key record deleted, email us and we will tell you what we need to identify it. Any privacy request gets a reply within 30 days.

7. Security

Every network request the app makes uses HTTPS. Our datastore is reachable only with a secret credential held by the server. Your on-device data is protected by your device’s own passcode/Face ID and Apple’s encryption at rest.

8. Your rights

EU/EEA (GDPR). The lawful basis for the on-device location processing is your consent, which you give through the iOS permission prompt and can withdraw at any time in iOS Settings; the same goes for whether notifications are shown to you. The push token itself, App Attest and server logs rest on our legitimate interest in delivering alert updates and keeping the service working and unabused — the token is registered without a prompt (see Section 2), carries no account, location or line choices, and you can ask us to delete yours (Section 6). You may lodge a complaint with your local Data Protection Authority.

California (CCPA/CPRA). We do not sell or share personal information, and we do not use it for cross-context behavioural advertising.

Canada (PIPEDA). Most of our users are here. We process the minimum described above, only to run the app, and keep no profile of you.

India (DPDP). Any processing described here is done with your consent for the stated purpose. Contact us for any request or grievance.

9. Children’s privacy

SubwayStatus is not directed at children and is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us personal information by email, contact us and we will delete it.

10. Changes to this policy

If a future version changes what is collected — new data, a new processor, or advertising — we will update this page and the “Last Updated” date above before the change ships, and note any material change in the app’s release notes. Continued use after an update means you accept the revised policy.

11. Contact