Privacy policy

This policy covers Where's My Bus Ireland (wheresmybusireland.ie and the companion Android/iOS app), an independent project for viewing and reporting on public transport in Ireland. It is not operated by, or affiliated with, the National Transport Authority, Transport for Ireland, Dublin Bus, Go-Ahead Ireland, Iarnród Éireann or Luas.

Data controller: Darragh O'Toole, trading as Where's My Bus Ireland, contactable at support@wheresmybusireland.ie.

Accounts — your display name, email address, authentication records and account timestamps. Supabase Auth processes passwords and stores a hash rather than the plain password. If you choose Google sign-in, Google provides basic account information such as your name, email address and profile image.

Account features — saved stops and reports you submit, including the transport type, route, stop, direction, incident date/time, selected issue, delay and any description or passenger-impact text you provide. Complete reports and written answers are visible only to your account and authorised service administration.

Public-safe report information — report totals and statistics may be shown in aggregate. For selected current-trip issues, such as a full or missing service, the issue category may briefly appear as a service notice to other users. These outputs do not include your name, email address or written answers.

Optional public quotation — if you deliberately enable the switch on a report, edited excerpts from its description or passenger-impact answers may be quoted on Where's My Bus Ireland after review. Account names and email addresses are not displayed, and identifying details should be removed. Because the original report remains linked to your account, this use is based on your consent rather than treating the source report as anonymous. You can withdraw permission from that report's details page.

Device location — only after you grant operating-system permission, and only to centre the map or use “My Location” in search and journey planning. Loading the map checks for an existing permission but does not itself ask for permission; the request appears when you choose the location control or “My Location”. You can decline and type a stop or address instead. The app does not store a history of device locations in the report database.

Searches — address/place text is sent through a Supabase function to LocationIQ to find matches. Stop-name searches use the transport data bundled with the app. Search text is not added to your account or report record, although infrastructure providers may create short-lived technical logs.

Walking directions — when you open a planned journey, the coordinates at the beginning and end of each walking section are sent through a Supabase function to Google Routes to calculate pedestrian distance, time and directions. Results may be cached on your device to reduce repeated requests and are not added to your account or report record.

Device-only information — recent journeys, visual preferences and cookie choices are stored in browser/app storage. Saved stops are also device-only when you use the app without an account. Guest saved stops remain separate from account-synced saved stops.

Technical information — IP address, browser/device type, request details, error messages and timestamps may be recorded by hosting, authentication and infrastructure providers for security, reliability and troubleshooting.

Account, saved-stop and private-report processing is necessary to provide the service you request and administer your account. The legitimate-interests basis is used for service security, troubleshooting, abuse prevention, aggregate statistics and limited service-issue notices, balanced against passenger privacy.

Consent is used for optional public quotation, device location and non-essential Google Maps cookies on the web. You can refuse these without losing the app's core guest features. Processing may also be necessary to comply with a legal obligation or handle legal claims.

Supabase — provides the Frankfurt-hosted database, authentication, API and server functions used for accounts, reports and synced saved stops.

Titan Email — sends transactional messages such as account confirmation and password-reset emails. It receives the destination email address and message needed for delivery.

Google — provides Google sign-in when selected, renders the web map only after cookie consent, and calculates walking directions when you open a planned journey. Google receives the technical and map/location information needed to provide those chosen services.

LocationIQ — receives address/place search text to return matching results.

Netlify — hosts and delivers the web app and may process ordinary connection, security and deployment logs. Blacknight registers the wheresmybusireland.ie domain.

Choosing “Write me an email” opens a draft in your own email service. The app does not send it. If you send it, the selected transport operator or the NTA and your email provider process that message under their own privacy terms.

Some providers may process limited information outside the EEA. Where GDPR requires safeguards for such a transfer, an adequacy decision or approved contractual safeguards are relied on. Contact the address above for more information about a particular provider.

Account and report data is kept for as long as your account exists, unless it is needed for a legal claim or legal obligation. Deleting your account from Settings deletes its profile, reports and synced saved stops. Expired service notices stop being shown and are deleted with their source report. Aggregate statistics are recalculated from reports that still exist.

Public-quotation permission and any withdrawal time are kept with the report to demonstrate your choice. Guest saved stops, recent journeys and preferences remain on the device until you remove them or clear app/browser storage. Search and support/infrastructure logs are kept only for as long as needed to provide support, secure the service, diagnose faults and handle disputes, subject to each provider's retention settings.

Signing in uses a session cookie/local storage entry that is necessary for the requested account service. Google Maps is not loaded on the web until you accept its non-essential cookies. Your choice is remembered on that device and can be reset from Settings → Cookie preferences. Declining affects the web map, not stop search, accounts or reports.

Under GDPR you can ask to access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent. These rights can depend on the legal basis and statutory exceptions. Public-quotation permission can be withdrawn from the saved report; cookie choices from Settings; and location permission from device settings. You can also contact the address above.

You may complain to Ireland's Data Protection Commission at dataprotection.ie. There is no solely automated decision-making or profiling that produces legal or similarly significant effects.

Access controls, encrypted connections and account-based database rules are used to protect personal data. No internet service can guarantee absolute security; suspected privacy or security issues can be reported to the contact address above.

This service is not directed at children under 16. Anyone under 16 should not create an account or submit a report and should use the guest transport information only with a parent or guardian.

This page and its “last updated” date will change when data use changes. Material changes will be highlighted in the app or by email where reasonably possible before they take effect.