Privacy Policy for Shuttle Bus

1. Information We Collect

1.1 Personal Information

When you use Shuttle Bus, we collect the following personal information:

• Google Account Information: Name, email address, and profile picture through Google Sign-In
• User ID: A unique identifier generated for your account

1.2 Location Data

Our app collects real-time location data for the following purposes:

• GPS Coordinates: Latitude and longitude when tracking is active
• Location Accuracy: To provide precise tracking information
• Heading and Speed: Direction and movement speed for better tracking
• Background Location: Location updates continue when the app is in background mode during active tracking sessions

1.3 Service Usage Data

• Bus service names and unique codes you create or join
• Organization names you provide
• Your role in each service (Creator or Member)
• Membership information in bus services
• Tracking session participation
• Host route information (pickup and destination points)
• Passenger point preferences
• Host report submissions

1.4 Technical Data

• Device information (model, operating system)
• App usage statistics
• Error logs and crash reports
• Session duration and timestamps

2. How We Use Your Information

2.1 Primary Purposes

• Authentication: To verify your identity and manage your account
• Real-Time Tracking: To share location between service members during active tracking sessions
• Service Management: To create, join, and manage bus services
• Communication: To display your information to other service members
• Navigation: To calculate distances, routes, and estimated arrival times

2.2 Safety and Security

• To implement the host reporting system for user safety
• To enforce our 4-report automatic host removal policy
• To prevent abuse and maintain service quality
• To protect against unauthorized access

2.3 App Improvement

• To analyze app usage and improve user experience
• To fix bugs and technical issues
• To develop new features based on user needs

3. How We Share Your Information

3.1 Within Bus Services

Your information is shared with other members of the same bus service:

• Name and Photo: Visible to all service members
• Role: Displayed as Creator or Member
• Real-Time Location: Visible to all members during active tracking sessions
• Host Routes: When you are the host, your route is visible to passengers
• Passenger Points: Your pickup point is visible to the host

3.2 Third-Party Services

We use the following third-party services:

• Google Sign-In: For authentication (Google's Privacy Policy applies)
• Supabase: For secure database and real-time data synchronization
• Google Maps: For map display and location services (Google's Privacy Policy applies)

3.3 What We DON'T Share

• We DO NOT sell your personal information to third parties
• We DO NOT share your data with advertisers
• We DO NOT use your information for marketing purposes
• We DO NOT share your location with anyone outside your bus services

4. Data Storage and Security

4.1 Where We Store Your Data

• All data is stored securely on Supabase cloud infrastructure
• Location data is stored in PostgreSQL database with row-level security
• Authentication tokens are managed by Supabase Auth
• Session data is stored locally on your device

4.2 Security Measures

• Encryption: All data transmission is encrypted using HTTPS/TLS
• Row-Level Security (RLS): Database access is restricted based on user authentication
• Access Control: Users can only access data from services they're members of
• Secure Authentication: OAuth 2.0 through Google Sign-In
• Session Management: Automatic session expiration and token refresh

4.3 Data Retention

• Account Data: Retained until you delete your account
• Location Data: Active tracking data is retained during tracking sessions and for session history
• Service Data: Retained as long as the service exists or until you leave the service
• Inactive Services: Deactivated services are marked as inactive but data is preserved

5. Your Rights and Choices

5.1 Access and Control

• View Your Data: Access your profile, services, and membership information within the app
• Update Information: Update your profile through Google Account settings
• Leave Services: Exit any bus service you're a member of at any time
• Deactivate Services: Creators can deactivate services they created

5.2 Location Permissions

• Enable/Disable: Control location access through device settings
• Background Location: You can disable background location in device settings (tracking features will be limited)
• Stop Sharing: Leave tracking session to immediately stop location sharing

5.3 Account Deletion

5.4 Data Portability

You can request a copy of your data by contacting us (see Contact section below).

6. Children's Privacy

Shuttle Bus is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will delete such information.

7. Location Tracking Details

7.1 When Location is Collected

• Only during active tracking sessions
• Only when you are a member of an active bus service
• Continuous updates while tracking is active (every 10 meters or significant movement)
• Background updates if you granted background location permission

7.2 How Location is Used

• Real-Time Sharing: Your location is shared with other service members on the map
• Distance Calculation: To show distance to host or destination
• ETA Calculation: To estimate arrival time
• Route Display: To show movement path on the map

7.3 Location Accuracy

We use high-accuracy GPS mode to ensure precise tracking. This may consume more battery but provides better service quality.

7.4 Stopping Location Sharing

You can stop sharing your location by:

• Leaving the tracking session
• Exiting the tracking screen
• Closing the app
• Disabling location permissions in device settings
• Leaving the bus service

8. Host Reporting System

For safety and accountability, our app includes a host reporting feature:

• Members can report a host for inappropriate behavior
• Each user can submit one report per host per service
• After 4 reports, the host is automatically removed from the host role
• Report data includes: reporter ID, host ID, service ID, and timestamp
• Reports are stored for moderation purposes
• False reporting may result in account restrictions

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• Significant changes will be notified through the app
• Continued use of the app after changes constitutes acceptance of the new policy

We encourage you to review this Privacy Policy periodically.

10. International Data Transfers

Your data may be stored and processed in servers located in different countries where Supabase operates. We ensure that adequate safeguards are in place to protect your data in accordance with this Privacy Policy, regardless of where it is processed.

11. Your California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

• Right to Know: Request information about data we collect
• Right to Delete: Request deletion of your personal information (use in-app account deletion)
• Right to Opt-Out: We don't sell personal information, so no opt-out needed
• Non-Discrimination: We won't discriminate against you for exercising your rights

12. GDPR Compliance (European Users)

If you are in the European Economic Area (EEA), you have rights under GDPR:

• Legal Basis: We process data based on consent and legitimate interests
• Right to Access: Request a copy of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Delete your data (use in-app deletion)
• Right to Restriction: Limit how we use your data
• Right to Portability: Receive your data in a structured format
• Right to Object: Object to certain data processing
• Right to Withdraw Consent: Withdraw consent at any time

13. Third-Party Links and Services

Our app may contain links to third-party services (Google Maps, Google Sign-In). These services have their own privacy policies:

• Google Privacy Policy
• Supabase Privacy Policy

We are not responsible for the privacy practices of these third parties.

14. Permissions Required

Shuttle Bus requires the following permissions:

• Location (Foreground & Background): For real-time tracking
• Internet: To sync data and communicate with servers
• Network State: To check connectivity

You can manage these permissions in your device settings at any time.

15. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours of discovering the breach
• Provide details about what data was affected
• Explain the steps we're taking to address the breach
• Advise on protective measures you can take

16. Automated Decision Making

Our app uses automated decision making in the following cases:

• Host Removal: Automatic host removal after 4 reports (based on predetermined rules)
• Distance/ETA Calculations: Automated calculations using GPS data

These automated decisions are based on clear rules and you can contest them by contacting us.

18. Consent

By using Shuttle Bus, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree with this policy, please do not use our app.