SubwayStatus

Privacy Policy for SubwayStatus

Effective Date: 2026-09-17
Last Updated: 2026-09-28

Faiz Prasla (“we,” “our,” or “us”) built SubwayStatus as a free iOS app with an optional one-time Pro purchase. This policy explains, in plain language, exactly what the app touches and what our server keeps.

The short version: SubwayStatus has no accounts and no sign-in. It shows no ads and does not track you: there is no analytics or crash-reporting SDK in the app at all, and the ad SDK bundled for a possible future version is never started in this one. Your location never leaves your device. The only things our server stores about your device are an Apple push token, the list of transit lines you asked to be notified about, and an App Attest key record — none of which identifies you. The token is only stored while you have disruption alerts switched on; turn them all off and we delete it.

1. What stays on your device

Settings and cache. Your favourited lines, notification choices, display options, saved routes and a cache of route/alert data are stored on your device with Apple’s UserDefaults and ordinary local files. They are shared only between the app, its Home Screen widget and its Live Activities, through an Apple App Group container that only SubwayStatus can read. Deleting the app deletes all of it. The one exception is the list of lines you want alerts for, a copy of which is sent to our server so it can send those alerts — see Section 2. Your saved routes, including which stations you travel between, stay on your device and are never sent anywhere.

Location. SubwayStatus asks for location “while using the app” (never “always”) when you tap Near Me or recentre the map. It reads your position once, at roughly 100-metre accuracy, when you tap Near Me, and iOS keeps the blue location dot current while the Buses map is on screen. Both stay on the device — used only to centre the map and to pick the nearest stations or stops from a list the app already has. That coordinate is never sent to our server or to anyone else, and we never store it. Deny or revoke the permission any time in iOS Settings; everything else in the app still works.

Your Pro purchase. The entitlement is recorded on your device so Pro features unlock. We do not keep a copy.

Widget and Live Activities. Both render from the same on-device data. Nothing extra is collected to draw them.

2. What our server stores

Push notification token. iOS gives the app an Apple Push Notification service device token. The app sends that token, plus whether it is a sandbox or production token, to our server so we can wake your device when an alert changes. We store the token string and the time it last checked in, in our Upstash Redis datastore. Attached to it is one thing: the list of transit lines you switched alerts on for — for example ttc:1, go:LW. That is what lets us send you an alert for Line 1 and not for every line in the city, including when the app is closed. There is no account and no location. Which stations on those lines matter to you — your saved routes — is decided on your device and never sent to us; when the app is closed we notify you about the whole line, and the app narrows it to your routes the next time you open it.

To be precise about when this happens: the app only sends us a token once you have switched on at least one kind of disruption alert in SubwayStatus and allowed notifications in iOS. If you have not, nothing is sent and nothing is stored. Switch every alert off again and the app tells our server to delete the token and your line list immediately. (Earlier versions of the app registered a token on every launch whether or not you had turned alerts on; those tokens age out under the same 60-day rule below.) When an alert starts on one of your lines we send a notification carrying the line, the affected stations and the reason, so it reaches you even if the app is not running. Delete the app and the token stops working; a token that has not checked in for 60 days is deleted automatically, and its line list with it.

App Attest key record. To confirm requests come from a genuine, unmodified copy of the app, iOS generates an Apple App Attest key in your device’s Secure Enclave. Our server stores that key’s ID, its public key, a replay counter, and when the key was registered and last verified. It is a per-install cryptographic identifier, not an advertising ID, and it is not linked to you or shared with anyone. These records currently have no automatic expiry; we delete them when they are no longer useful, and you can ask us to delete yours (see Section 6).

Ordinary server logs. Like any web server, ours (and the CDN in front of it) processes IP addresses and request paths to serve traffic and to rate-limit abuse. We do not build profiles from these logs and do not use them to identify individuals.

3. What we do not do

4. Purchases

SubwayStatus Pro is a one-time in-app purchase handled entirely by Apple through StoreKit. We never see or store your payment details — not your card, not your Apple Account. The app only learns that the entitlement is owned, and that stays on your device. To restore a purchase on a new device: Settings → SubwayStatus Pro → Restore.

5. Who processes data for us, and where transit data comes from

Service What it does What it receives
Apple — APNs Delivers push notifications Your device’s push token, and the notification itself — the line, the affected stations and the reason for the disruption
Apple — StoreKit Processes the Pro purchase Handled entirely by Apple; we never receive payment details
Apple — App Attest Confirms the app is genuine A device-generated attestation; no personal data
Render (app hosting) Runs our API server Ordinary request data, including IP address
Cloudflare (CDN) Sits in front of the server Ordinary request data, including IP address
Upstash (Redis datastore) Stores push tokens, your notification line list and App Attest key records The items described in Section 2
UmoIQ / Cubic (TTC surface feed) Serves TTC bus and streetcar predictions, which the app requests directly Ordinary request data, including IP address, and the route or stop you are viewing

Live transit data comes from the agencies’ own public feeds — the TTC and Metrolinx (GO Transit) open data, and regional feeds for York Region Transit and Brampton Transit. Our server reads almost all of them on your behalf, so those feeds get nothing about you at all. The exception is the TTC surface (bus and streetcar) feed listed above: the app asks UmoIQ for those predictions itself, so UmoIQ sees your device’s IP address and the route or stop you are looking at. No feed is ever told anything else about you, and SubwayStatus is not affiliated with or endorsed by any transit agency.

Our website at subwaystatus.live is a separate thing from the iOS app: the web map uses Google Analytics. The app does not, and these policy and support pages carry no analytics or cookies at all.

6. Retention, and asking us to delete something

Data Kept for
Everything in Section 1 (on-device) Until you delete the app or clear its data
Push token Deleted as soon as you switch all alerts off; otherwise 60 days after its last check-in
Your notification line list Stored and deleted with the push token it belongs to
App Attest key record No automatic expiry; deleted on request
Support email you send us As long as needed to answer you

One carve-out, stated plainly: a small number of push tokens collected before this policy took effect sit in an older record that the 60-day timer does not reach. Nothing reads them and nothing is ever sent to them; we are deleting that record by hand rather than leaving it to age out.

Because there are no accounts, we cannot look up “your” data from an email address alone — there is nothing tying any stored item to you. The fastest way to delete your push token and line list is to switch every disruption alert off in the app, which tells our server to delete them straight away. If you want a specific record deleted by hand, email us and we will tell you what we need to identify it. Any privacy request gets a reply within 30 days.

7. Security

Every network request the app makes uses HTTPS. Our datastore is reachable only with a secret credential held by the server. Your on-device data is protected by your device’s own passcode/Face ID and Apple’s encryption at rest.

8. Your rights

EU/EEA (GDPR). The lawful basis for the on-device location processing is your consent, which you give through the iOS permission prompt and can withdraw at any time in iOS Settings; the same goes for whether notifications are shown to you. Your push token and the line list attached to it are processed on the basis of your consent: they are only sent once you switch disruption alerts on, and switching them off withdraws that consent and deletes both. App Attest and server logs rest on our legitimate interest in keeping the service working and unabused. The token carries no account and no location, and the stations you travel between are never sent to us at all. You may lodge a complaint with your local Data Protection Authority.

California (CCPA/CPRA). We do not sell or share personal information, and we do not use it for cross-context behavioural advertising.

Canada (PIPEDA). Most of our users are here. We process the minimum described above, only to run the app, and keep no profile of you.

India (DPDP). Any processing described here is done with your consent for the stated purpose. Contact us for any request or grievance.

9. Children’s privacy

SubwayStatus is not directed at children and is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us personal information by email, contact us and we will delete it.

10. Changes to this policy

If a future version changes what is collected — new data, a new processor, or advertising — we will update this page and the “Last Updated” date above before the change ships, and note any material change in the app’s release notes. Continued use after an update means you accept the revised policy.

11. Contact