SubwayStatus

Privacy Policy for SubwayStatus

Effective Date: 2026-09-17
Last Updated: 2026-10-28

Faiz Prasla (“we,” “our,” or “us”) built SubwayStatus as a free, ad-supported iOS app with an optional one-time Pro purchase that removes the ads. This policy explains, in plain language, exactly what the app touches and what our server keeps.

The short version: SubwayStatus has no accounts and no sign-in. The free version shows ads served by Google AdMob; SubwayStatus Pro never shows them and never loads the ad SDK. Where the law requires it, Google asks for your consent first, and iOS asks before any advertising identifier is used to personalise ads. Apart from the ad SDK there is no analytics or crash-reporting SDK in the app. Your location never leaves your device. The only things our server stores about your device are an Apple push token, the list of transit lines you asked to be notified about, and an App Attest key record — none of which identifies you. The token is only stored while you have disruption alerts switched on; turn them all off and we delete it.

1. What stays on your device

Settings and cache. Your favourited lines, notification choices, display options, saved routes and a cache of route/alert data are stored on your device with Apple’s UserDefaults and ordinary local files. They are shared only between the app, its Home Screen widget and its Live Activities, through an Apple App Group container that only SubwayStatus can read. Deleting the app deletes all of it. The one exception is the list of lines you want alerts for, a copy of which is sent to our server so it can send those alerts — see Section 2. Your saved routes stay on your device. The one part that is sent is described in Section 2: if you use My Routes for alerts, the stretch of each line you ride goes with your alert subscription.

Location. SubwayStatus asks for location “while using the app” (never “always”) when you tap Near Me or recentre the map. It reads your position once, at roughly 100-metre accuracy, when you tap Near Me, and iOS keeps the blue location dot current while the Buses map is on screen. Both stay on the device — used only to centre the map and to pick the nearest stations or stops from a list the app already has. That coordinate is never sent to our server or to anyone else, and we never store it. Deny or revoke the permission any time in iOS Settings; everything else in the app still works.

Your Pro purchase. The entitlement is recorded on your device so Pro features unlock. We do not keep a copy.

Widget and Live Activities. Both render from the same on-device data. Nothing extra is collected to draw them.

2. What our server stores

Push notification token. iOS gives the app an Apple Push Notification service device token. The app sends that token, plus whether it is a sandbox or production token, to our server so we can wake your device when an alert changes. We store the token string and the time it last checked in, in our Upstash Redis datastore. Attached to it is the list of transit lines you switched alerts on for — for example ttc:1, go:LW — and, if you use SubwayStatus Pro’s My Routes for alerts, the first and last station of each stretch you ride on those lines (for example Line 1, St Clair West to Union). That is what lets us send you an alert for the part of Line 1 you ride and not for every station on it, including when the app is closed. There is no account and no location: these are station names you chose from a list, not where you are. Your other saved routes and your commutes stay on your device.

To be precise about when this happens: the app only sends us a token once you have switched on at least one kind of disruption alert in SubwayStatus and allowed notifications in iOS. If you have not, nothing is sent and nothing is stored. Switch every alert off again and the app tells our server to delete the token and your line list immediately. (Earlier versions of the app registered a token on every launch whether or not you had turned alerts on; those tokens age out under the same 60-day rule below.) When an alert starts on one of your lines we send a notification carrying the line, the affected stations and the reason, so it reaches you even if the app is not running. Delete the app and the token stops working; a token that has not checked in for 60 days is deleted automatically, and its line list with it.

App Attest key record. To confirm requests come from a genuine, unmodified copy of the app, iOS generates an Apple App Attest key in your device’s Secure Enclave. Our server stores that key’s ID, its public key, a replay counter, and when the key was registered and last verified. It is a per-install cryptographic identifier, not an advertising ID, and it is not linked to you or shared with anyone. These records currently have no automatic expiry; we delete them when they are no longer useful, and you can ask us to delete yours (see Section 6).

Ordinary server logs. Like any web server, ours (and the CDN in front of it) processes IP addresses and request paths to serve traffic and to rate-limit abuse. We do not build profiles from these logs and do not use them to identify individuals.

3. What we do not do

3A. Advertising (free version only)

The free version shows a banner at the bottom of the Alerts and Upcoming tabs and occasional “Sponsored” cards in the alert feed and station arrival lists, served by Google AdMob (Google LLC). A card is never the first item in a list, and arrival-list ads are limited to every third opening and at most one per ten minutes.

When an ad is requested, Google receives data from your device that the SDK collects: your IP address, device and app information (model, iOS version, app and SDK version), approximate location derived from the IP address, and the ad interactions (impressions, taps). If you allow tracking, it also receives the advertising identifier (IDFA); otherwise Google may use a different SDK-generated identifier for ad delivery, frequency capping, fraud prevention and measurement. Google uses this to choose and measure ads and may use it to personalise them. We do not receive any of it from Google except aggregate revenue and performance reports, and we send Google nothing about your lines, routes, stations or location. Google’s use is described at policies.google.com/technologies/partner-sites.

Your choices. Before the first ad, if you are in the EEA, UK or another region that requires it, Google’s consent form (Google’s User Messaging Platform) asks you to accept or decline; if you decline, no ads are requested. In the EEA/UK a Settings → About → Ad Privacy Choices row lets you change that answer at any time. Everywhere, iOS shows its App Tracking Transparency prompt once, after your first session; you can change it in iOS Settings → Privacy & Security → Tracking. You can also limit ad personalisation at myadcenter.google.com. Buying SubwayStatus Pro removes ads entirely, and from then on the ad SDK is not loaded.

4. Purchases

SubwayStatus Pro is a one-time in-app purchase handled entirely by Apple through StoreKit. We never see or store your payment details — not your card, not your Apple Account. The app only learns that the entitlement is owned, and that stays on your device. To restore a purchase on a new device: Settings → SubwayStatus Pro → Restore.

5. Who processes data for us, and where transit data comes from

Service What it does What it receives
Apple — APNs Delivers push notifications Your device’s push token, and the notification itself — the line, the affected stations and the reason for the disruption
Google — AdMob (free version only) Serves and measures ads, with consent where required IP address, device and app information, ad interactions, and the advertising identifier only if you allowed tracking
Apple — StoreKit Processes the Pro purchase Handled entirely by Apple; we never receive payment details
Apple — App Attest Confirms the app is genuine A device-generated attestation; no personal data
Render (app hosting) Runs our API server Ordinary request data, including IP address
Cloudflare (CDN) Sits in front of the server Ordinary request data, including IP address
Upstash (Redis datastore) Stores push tokens, your notification line list and App Attest key records The items described in Section 2
UmoIQ / Cubic (TTC surface feed) Serves TTC bus and streetcar predictions, which the app requests directly Ordinary request data, including IP address, and the route or stop you are viewing

Live transit data comes from the agencies’ own public feeds — the TTC and Metrolinx (GO Transit) open data, and regional feeds for York Region Transit and Brampton Transit. Our server reads almost all of them on your behalf, so those feeds get nothing about you at all. The exception is the TTC surface (bus and streetcar) feed listed above: the app asks UmoIQ for those predictions itself, so UmoIQ sees your device’s IP address and the route or stop you are looking at. No feed is ever told anything else about you, and SubwayStatus is not affiliated with or endorsed by any transit agency.

Our website at subwaystatus.live is a separate thing from the iOS app: the web map uses Google Analytics. The app does not, and these policy and support pages carry no analytics or cookies at all.

Advertising on the website. Ads in the iOS app are described in Section 3A, and the website can show ads served by Google AdSense. Visitors who have a Ko-fi supporter key active in their browser see none, and Google’s ad script is not even loaded for them. For everyone else, Google sets and reads cookies and similar identifiers in your browser, and receives your IP address, browser details and the page you are on, to choose, deliver and measure ads and to prevent fraud; this is governed by Google’s policy on how it uses data from sites that use its services. If you are in the European Economic Area, the United Kingdom or Switzerland, Google’s own consent message asks for your choice before it uses cookies or identifiers for ad personalisation or measurement, and a Privacy choices row appears under Settings → About so you can change that choice at any time. You can also manage or turn off personalised ads at Google’s ad settings, or see aboutads.info (or youronlinechoices.eu in Europe). We do not receive the personal data Google collects for this, and we do not sell it. The authorised sellers of our ad space are listed at /ads.txt.

6. Retention, and asking us to delete something

Data Kept for
Everything in Section 1 (on-device) Until you delete the app or clear its data
Push token Deleted as soon as you switch all alerts off; otherwise 60 days after its last check-in
Your notification line list Stored and deleted with the push token it belongs to
App Attest key record No automatic expiry; deleted on request
Support email you send us As long as needed to answer you

One carve-out, stated plainly: a small number of push tokens collected before this policy took effect sit in an older record that the 60-day timer does not reach. Nothing reads them and nothing is ever sent to them; we are deleting that record by hand rather than leaving it to age out.

Because there are no accounts, we cannot look up “your” data from an email address alone — there is nothing tying any stored item to you. The fastest way to delete your push token and line list is to switch every disruption alert off in the app, which tells our server to delete them straight away. If you want a specific record deleted by hand, email us and we will tell you what we need to identify it. Any privacy request gets a reply within 30 days.

7. Security

Every network request the app makes uses HTTPS. Our datastore is reachable only with a secret credential held by the server. Your on-device data is protected by your device’s own passcode/Face ID and Apple’s encryption at rest.

8. Your rights

EU/EEA (GDPR). The lawful basis for the on-device location processing is your consent, which you give through the iOS permission prompt and can withdraw at any time in iOS Settings; the same goes for whether notifications are shown to you. Your push token and the line list attached to it are processed on the basis of your consent: they are only sent once you switch disruption alerts on, and switching them off withdraws that consent and deletes both. App Attest and server logs rest on our legitimate interest in keeping the service working and unabused. The token carries no account and no location, and the only stations we receive are the ends of the stretches you choose for My Routes alerts. You may lodge a complaint with your local Data Protection Authority.

California (CCPA/CPRA). We do not sell personal information. The ads in the free version are served by Google, which may count as “sharing” for cross-context behavioural advertising under California law; you can opt out through the ATT prompt, iOS Settings → Tracking, or by buying Pro, and we do not otherwise share personal information.

Canada (PIPEDA). Most of our users are here. We process the minimum described above, only to run the app, and keep no profile of you.

India (DPDP). Any processing described here is done with your consent for the stated purpose. Contact us for any request or grievance.

9. Children’s privacy

SubwayStatus is not directed at children and is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us personal information by email, contact us and we will delete it.

10. Changes to this policy

If a future version changes what is collected — new data or a new processor — we will update this page and the “Last Updated” date above before the change ships, and note any material change in the app’s release notes. Continued use after an update means you accept the revised policy.

11. Contact