46 lines
2.3 KiB
Markdown
46 lines
2.3 KiB
Markdown
# Privacy Policy
|
|
|
|
TimeToLeave is designed to keep user data local where possible. The app does not include third-party analytics or advertising trackers.
|
|
|
|
## Data Stored Locally
|
|
|
|
- Web events and reminder settings are stored in browser `localStorage`.
|
|
- Mobile events, origin station, notification settings, theme, and selected native calendars are stored in `AsyncStorage`.
|
|
- Mobile notifications are scheduled locally through Expo notifications.
|
|
|
|
## Data Sent to External Services
|
|
|
|
Some features require network calls to calculate routes or import calendars:
|
|
|
|
| Data | Sent to | Purpose |
|
|
| --- | --- | --- |
|
|
| Destination text or address | Nominatim | Convert a place into coordinates. |
|
|
| Coordinates | OSRM | Calculate bike and walking routes. |
|
|
| Station IDs, dates, and times | ÖBB HAFAS | Search stations and live public-transport journeys. |
|
|
| Coordinates or stop IDs | Wiener Linien | Find nearby stops and live departures. |
|
|
| Calendar URL | TimeToLeave backend, then the calendar host | Fetch and parse remote ICS feeds. |
|
|
| Google Calendar authorization code and tokens | Google and the TimeToLeave backend | Connect and sync Google Calendar on web. |
|
|
| Device calendar event fields | Local mobile app process | Import native calendar events with locations. |
|
|
|
|
Remote ICS imports are restricted by server-side URL validation. Private and reserved hosts are blocked.
|
|
|
|
## Google Calendar
|
|
|
|
Google Calendar sync is optional. When connected on the web app, OAuth tokens are stored in HTTP-only cookies and used only to fetch calendar events. Disconnecting Google Calendar deletes the token cookie.
|
|
|
|
## Location
|
|
|
|
Location access is optional and used to find nearby stations or calculate routes. Coordinates may be sent to route, geocoding, or transit APIs only when the corresponding feature is used.
|
|
|
|
## Calendar Data
|
|
|
|
Only events with locations are useful to TimeToLeave. Imported events are normalized to title, destination, event time, source, and ID. The app stores those normalized events locally.
|
|
|
|
## Data Retention
|
|
|
|
Local data remains until the user clears app/browser storage, deletes events, disconnects Google Calendar, or uninstalls the app. Server-side proxy routes are intended for request handling and do not provide application-level persistent event storage.
|
|
|
|
## Changes
|
|
|
|
This policy may be updated as the app changes. Updates are made in this repository.
|