Privacy Policy

Who we are

Trip Planner Sydney (“Trip Planner”, “the app”) and this website are made by Jerrycan Co Pty Ltd (“we”, “us”), in Sydney, Australia. This policy covers the iPhone app and tripplannersydney.com.

For anything about your privacy, email metro_feedback@outlook.com.

Kept on your iPhone

The app stores these on your iPhone, and not on our server:

• your saved trips, saved places and their names, icons and colours, recent searches and your settings;
• a copy of your saved trips' names for the Trip Planner widget;
• the most recent position you planned a trip from or to with “Current location”, and the coordinates of places you picked on the map;
• two items in the iPhone's keychain that stay even if you delete the app, and move to a new iPhone with an encrypted backup: a random analytics identifier (see Analytics) and the record of any Visitor Pass you bought, so it isn't lost on reinstall;
• a short log of what the app has recently done, kept by iOS, which can include the details of recent requests, such as a search or a trip's coordinates.

None of this is synced to iCloud by the app. Some of it is sent elsewhere when you use a feature, as the sections below explain: positions to Transport for NSW and Apple Maps, and the analytics identifier to Google. The app never sends the log anywhere: crash reports carry a copy with those details removed. It can leave your iPhone only if you choose to share diagnostics with Apple or send someone a diagnostic report.

Your location

Trip Planner asks to use your location only while you're using the app, never in the background. If you allow it:

• the app takes your position to plan trips from where you are and to show how far away stops are;
• while the map is on screen, it shows where you are and follows you as you move.

When you plan a trip from or to “Current location”, or from a point on the map, those coordinates are sent to Transport for NSW to plan it. Our server never receives your location, and neither do crash reports: the copy of the app's activity log attached to them names the service a request went to, never its coordinates (see Analytics).

You can turn location off at any time in the iPhone's Settings → Privacy & Security → Location Services → Trip Planner. The app still works: you search for stops and places instead.

Trip planning: Transport for NSW

Journeys, departures, service alerts and stop searches come from Transport for NSW. The app sends what's needed to answer each request straight from your iPhone to Transport for NSW (transportnsw.info and its Open Data service): what you search for, the stops or coordinates of the trip, the date and time, and your travel preferences, such as transport modes and accessibility needs. It doesn't send anything that identifies you, but, as with any web request, Transport for NSW sees your IP address. How they handle it is set out in the Transport for NSW privacy statement.

Maps: Apple

The map is Apple Maps. Your iPhone fetches map imagery for the area you're looking at from Apple; tapping a landmark asks Apple Maps for its details; and Look Around previews fetch street-level imagery for the place you've selected. These requests go to Apple, not to us, and are covered by Apple Maps & Privacy.

Purchases and Trip Planner Plus

Purchases are made through the App Store. Apple handles the payment; we never see your card, name, email address or Apple Account.

To confirm whether you have Trip Planner Plus, the app sends our server the proof of purchase that Apple gives every App Store download, after you buy or restore purchases and from time to time when you open the app. Our server checks the proof is genuine and asks Apple for that account's Trip Planner purchases. Apple identifies the account to us by transaction numbers it issues, never by your name, email address or Apple Account. What we keep:

• The proof itself is never stored or logged.
• Your Trip Planner purchase history as Apple reports it (which products, when they were bought, when they expire or renew, and any refunds) is kept for 7 days after we last read it from Apple, then deleted automatically.
• Our server's logs record each check with the transaction number and the result, such as whether Plus is active. They're kept to at most 50 MB and discarded whenever the server is updated. If a request fails to reach the app (for example, while we're updating it), the web server logs the failure with your IP address; that log is also capped at 50 MB, with the oldest lines overwritten.
• Apple's purchase notifications. Apple tells our server when a purchase is made, renews, lapses or is refunded. Each notification carries the transaction details, including the product, price, currency and App Store country. Each notification is deleted automatically 30 days after it arrives, and the summary of each purchase we build from them (product, status, expiry, renewal and any refund) 30 days after it last changed.
• Backups. Our database is backed up nightly and each backup is deleted after 30 days. The whole server, including its logs, is also backed up weekly by our hosting provider, and those backups are kept for 4 weeks. So something deleted from the database or logs can remain in a backup for up to 30 days.

To limit abuse, our server caps how many purchase checks it answers each minute for each IP address and each account. It counts them in its working memory only: the IP address and transaction number are never written to disk or logged for this, and are forgotten when the server restarts.

When you buy something, the app also records the purchase (product, price and currency) in analytics.

Analytics, crash reports and performance

We use Google's Firebase to understand how the app is used and to find and fix problems. Firebase is run by Google, and we can see what it reports.

• Analytics. When the app is first opened it creates a random identifier and keeps it in the keychain, so that reinstalling the app isn't counted as a new user. Analytics receives that identifier with app events, such as viewing or acting on a Trip Planner Plus offer, purchases, ad and review-prompt events, and measures of the app's health. It also receives whether you have Plus and your answer to the iPhone's tracking prompt. The Firebase software adds its own information, such as your device model, iOS version, country and how long sessions last, and, only if you allow tracking (see Advertising), your iPhone's advertising identifier. Google Analytics keeps event-level data for up to 14 months.
• Crash reports (Crashlytics). When the app crashes, hangs or hits certain errors, it sends a report with technical details of the device and what the app was doing. Each report includes a redacted copy of the app's recent activity log: the app's own events, analytics events (whose details are products, offers and outcomes), which services it called, without the search or the coordinates, and error codes. That log copy never includes the analytics identifier, App Store transaction numbers, what you searched for, coordinates, or the names of saved trips and places. A crash report also carries the system's own description of the crash, which the app doesn't write. An error report the app sends carries the error's category and code, and those of the errors that caused it, plus technical context such as which step of a data migration was running, or where in the app's code a hang or crash happened along with the app and iOS versions; never the error's text or anything you typed or saved. Earlier versions of the app attached the detailed log, which could include those details. Google keeps crash reports for 90 days.
• Performance. Firebase Performance Monitoring measures how long the app takes to start and how long network requests take, recording which addresses the app called and the responses' status. Google keeps this data for up to 60 days, and anything associated with an IP address for 30 days.

Firebase also uses its own identifiers for your installation of the app, and sees your IP address, which it uses to estimate your country. None of this data includes your name or email address, but it is linked to these identifiers. How Google uses information from apps that use its services and Privacy and Security in Firebase explain more.

Advertising

Trip Planner is free with ads. From the third time you open the app, it shows banner ads from Google AdMob, unless you have Trip Planner Plus, which removes them.

To show ads, measure them and prevent fraud, the AdMob software collects your IP address (which can show your general area, such as your city), information about your device, identifiers for your device and app installation, which ads you see and tap, and diagnostic information about the ads. This is separate from your precise location, which the app never gives AdMob.

Around the same time, iOS asks whether Trip Planner may track you. Only if you allow it can Google use your iPhone's advertising identifier to show ads more relevant to you and measure them across other apps and websites. Whatever you choose, you still see ads. You can change your answer any time in the iPhone's Settings → Privacy & Security → Tracking. Google explains its use of this data in How Google uses information from apps that use its services.

App settings

The app regularly reads a small set of settings from Google's Firebase Realtime Database, such as which app versions are current and which features are switched on. The app never writes anything to it. Google processes the request's IP address and browser information and keeps them for a few days.

This website

tripplannersydney.com uses no cookies, no analytics and no third-party scripts. Our server needs your IP address to send you the page, but it doesn't keep a log of visitors' IP addresses. Its logs note which page was requested and when. The one exception is a request the server fails to answer: that error is logged with the request's details, including the IP address, so we can fix the fault. Both logs are size-capped and backed up as described under Purchases.

Email

The app's Feedback button opens your own mail app with a message to tripplanner@jerrycan.co, including the app's version. We see whatever you choose to send, including your email address, and keep it so we can reply and improve the app. You can ask us to delete it.

Where your information goes

• Our server and its backups are hosted by DigitalOcean in Sydney, Australia.
• Google (Firebase and AdMob) may process data in the United States and other countries.
• Apple handles App Store purchases and Apple Maps.
• Transport for NSW answers trip planning requests.

Everything the app and this website send travels encrypted over HTTPS. Only the people who build and run Trip Planner can see what we hold, and we don't sell personal information.

What we don't collect

Trip Planner has no accounts or sign-in, and doesn't access your contacts, photos, camera, microphone, health data, calendars or motion data.

Your choices and rights

• Turn location or tracking off at any time in the iPhone's Settings, as described above.
• Deleting the app removes what it stored on your iPhone, apart from the two keychain items described under Kept on your iPhone.
• Ask us what we hold about you, and to correct or delete it, by emailing metro_feedback@outlook.com. We hold purchase records only by Apple's transaction number, so to find yours we'll need the order ID from your App Store receipt.
• Google's own controls for data it holds are at How Google uses information from apps that use its services.

Children

Trip Planner isn't directed at children under 13, and we don't knowingly collect personal information from them. If you think a child has sent us personal information, contact us and we'll delete it.

Changes to this policy

When the app or this website changes how it handles information, we update this page and the date at the top. We'll mention significant changes in the app's release notes.

Questions and complaints

Email metro_feedback@outlook.com and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.