Privacy Policy
Last updated: 2 June 2026
This Privacy Policy explains what personal data Busdex (“Busdex”, “we”, “us”, “our”) collects when you use the website and app at busdex.io, why we collect it, who we share it with, and the rights you have over it. Busdex is a small, independently-run web app for logging and tracking the buses you ride, and is operated from the United Kingdom.
By creating an account or using Busdex, you agree to the practices described here. If you do not agree, please do not use Busdex. Any questions? Email us at busdex@thomaskeig.com.
1. What data we collect
Information you give us
- Account details: your email address, username, and (for email/password accounts) a password. Passwords are never stored in plain text: they are stored only as a salted bcrypt hash that we cannot reverse.
- Sign in with Google (optional): if you register or log in with Google, we receive your email address, your name/Google profile details, and a Google account identifier so we can recognise you on return. Google accounts do not have a Busdex password.
- Profile information: your selected city and, if you choose to upload one, a profile picture. Uploaded images are re-encoded on our side, which strips metadata such as EXIF/GPS tags before storage.
- Content you create: comments you add to bus logs, your chosen display title and profile gradient, and any usernames you have used (we keep a history of previous usernames).
- Optional referral code: if you were invited, the referral code/username you enter so we can link you and your inviter as friends.
Information created as you use Busdex
- Your bus logs: which buses you log and, for each log, the timestamp, the route and destination (fetched from a third-party bus-data source), and the city the log was made in.
- Progress & gameplay: your XP, level, completed sets, and stats.
- Social features: your friends and friend requests, the networks you belong to, duels you take part in, and people you have referred.
- Purchases: a record of cosmetic items and upgrades you own. Payments are handled entirely by a third-party payment processor: we do not receive or store your card number or full payment details.
- Account metadata: the date your account was created, your email-verification status, and your privacy settings.
- Technical data: your IP address is processed transiently to apply rate limits and protect the service from abuse, and we set a small number of cookies (see “Cookies”).
2. Location data
We do not store your location. When you log a bus, your device asks for your current location and sends it to us for one purpose only: to check that you are close enough (within roughly 450 metres) to the live bus you are logging. This check happens at the moment you log, the coordinates are used to calculate that distance, and they are then discarded: your latitude and longitude are never written to your bus logs or saved to your account.
You can refuse the location permission in your browser, but logging a bus requires location in order to verify proximity, so logging will not work without it.
3. How and why we use your data
We use your data to run Busdex and, where required, we rely on the following legal bases under the UK GDPR:
| What we do | Legal basis |
|---|---|
| Create and operate your account, save your logs and progress, and provide the social features (friends, networks, duels, leaderboards, referrals). | Performance of a contract (our Terms of Service). |
| Verify your email address and send password-reset codes. | Performance of a contract. |
| Verify you are near a bus when logging (location check). | Performance of a contract / legitimate interests in keeping logs genuine. |
| Moderate usernames, comments and profile pictures to keep Busdex safe and lawful. | Legitimate interests in preventing abuse and harmful content. |
| Apply rate limits, prevent fraud/cheating and secure the service. | Legitimate interests in security. |
| Process shop purchases. | Performance of a contract. |
4. Cookies
Busdex uses a small number of cookies:
- Session cookie: keeps you logged in. This is essential for the app to work.
- Referral cookie: if you arrive via a referral link, we remember the referral code for up to 30 days so your inviter can be credited when you sign up.
- Analytics cookies: with your consent, we use Google Analytics to understand how Busdex is used so we can improve it. These cookies are only set after you choose “Accept” on the cookie banner; if you decline, no analytics cookies are set and no analytics data is collected. Your choice is remembered on your device, and you can change it by clearing your browser storage for this site.
5. Who we share data with
We do not sell your personal data. To operate Busdex we rely on a small number of trusted third-party service providers, for example for hosting and data storage, account sign-in, payment processing, sending email, and automated content moderation. These providers only process your data on our behalf, as needed to provide their service to us, and under appropriate confidentiality and data-protection obligations.
We may also disclose data if required to do so by law, or to protect the rights, safety and property of Busdex, our users or others.
6. How long we keep your data
We keep your account data for as long as your account exists. If you delete your account (see below), we remove your account and its associated personal data. Some information may persist briefly in backups or in third-party logs before being overwritten, and we may retain limited records where we are legally required to. Aggregated or anonymised data that can no longer identify you may be kept.
7. Your rights & deleting your account
If you are in the UK or EEA, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. You can change much of your data yourself in Account Settings (email, username, city, password, profile picture and privacy options).
To delete your account and all associated personal data, email us from the address registered to your account at busdex@thomaskeig.com. For your security, we only action deletion requests sent from the email address on the account, so we can confirm it is really you. We aim to complete deletions within 30 days, in line with GDPR. You can also start this request from the “Delete Account” button in Account Settings.
You also have the right to lodge a complaint with a data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk).
8. Security
We take reasonable measures to protect your data: passwords are stored only as salted bcrypt hashes, traffic is served over HTTPS, sessions are protected with secure, HTTP-only cookies and CSRF protection, and we apply rate limiting to guard against abuse. No online service can be guaranteed 100% secure, but we work to protect your information.
9. Children
Busdex is not intended for children under 13. If you are under 13, please do not use Busdex or provide us with any personal data. If you believe a child under 13 has given us personal data, contact us and we will delete it.
10. International transfers
Some of our service providers are based outside the UK/EEA. Where personal data is transferred internationally, it is protected by appropriate safeguards (such as adequacy decisions or standard contractual clauses) as required by data protection law.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Significant changes may be highlighted in the app. Continued use of Busdex after a change means you accept the updated policy.
12. Contact
For any privacy questions or requests, email busdex@thomaskeig.com.