Privacy without surprises

Location stays on your device during ordinary browsing

For nearby-stop sorting and your position on the map, the app uses foreground location while it is on screen. That ordinary browsing location is processed on the device and is not written to a server.

A GO ride that you deliberately start is different: it records the ride route and can continue while the screen is locked until the ride ends. Verify mode also uses your coordinates when you deliberately submit a stop correction. Both optional paths are described below.

Permission is optional. If you decline it, browsing stops, routes, timetables, and the map keep working; only the “near me” ordering and your own position marker are unavailable.

Schedule data is bundled, not fetched

Timetable, route, and stop data ships inside the app itself and is read from the device. The app performs no update downloads for this data, so no request, device identifier, or update telemetry reaches SD2 Studio while you are planning a journey.

Because the data is bundled, the app does not receive live or real-time departure information, and it keeps working with no signal.

GO ride companion

GO is an optional companion that you start yourself, ride by ride. A GO ride you start uploads an anonymous location trace to Supabase in the EU so SD2 Studio can improve route information. It never starts on its own and is not part of ordinary planning or browsing.

Each upload carries a one-time random code, with no account and no persistent device identifier. Separate rides cannot be linked through that code or tied to your name or email. Under the Play Data safety definition, the precise location is collected, not shared: collection is optional app functionality, and Supabase acts as SD2 Studio’s backend processor rather than an independent recipient.

Cyprus traces are currently discarded server-side after transmission because Cyprus is not registered in the ingest backend. That server-side rejection does not prevent the app from sending the trace.

Stop contributions in Verify mode

Verify mode is optional and is switched on by you. When you confirm, move, add, or remove a stop, the app sends the stop change, your coordinates, and an install-scoped device ID to Supabase in the EU. The coordinates help assess how close you were to the stop; the device ID helps protect the contribution process from duplicate or abusive submissions.

For the Play Data safety declaration, precise location and device or other IDs are collected, not shared. Both are optional app functionality. Supabase processes them for SD2 Studio as its backend processor; they are not shared with an independent third party for advertising or another company’s purposes.

The install-scoped device ID is not an advertising identifier and is not used for product analytics, cross-app tracking, or profiling. A Verify contribution is sent only after you choose a stop action; simply opening the map or turning on Verify mode does not submit a contribution.

• Supabase privacy policy ↗

Tours and activities from GetYourGuide

The app links to activity searches on GetYourGuide and can render a GetYourGuide booking widget inside an in-app web view. SD2 Studio earns a commission on qualifying bookings made through those links and that widget, at no extra cost to you.

Opening a link or the widget loads GetYourGuide, an independent company acting as its own controller. GetYourGuide receives your IP address, device or browser information, and your interactions inside the widget, and it sets its own cookies under its own policy. SD2 Studio does not receive your booking details.

• GetYourGuide privacy policy ↗

What the app does not do

These exclusions apply to the Cyprus Bus mobile app.

• It has no accounts, logins, or signups.
• It runs no product analytics and sends no usage or page-view events.
• It sends no crash reports, diagnostics, performance data, or session replay.
• It shows no ads and uses no advertising identifier.
• It contains no purchases or subscriptions and collects no payment details or purchase history.
• It does not collect contacts, photos, files, or phone numbers.
• It does not track riders across other apps or websites.
• It does not sell or rent personal data.

Reaching SD2 Studio

Email is the route for privacy questions, corrections, and requests about the Cyprus Bus mobile app. There is no in-app messaging or feedback channel, and no support form collects your message inside the app.

Transit data attribution

Bundled timetable, route, and stop data comes from the Cyprus National Access Point published by the Public Works Department of the Republic of Cyprus, and is reused under the Creative Commons Attribution 4.0 International licence, which requires attribution to the publisher including display of its logo.

Coverage is limited to scheduled services in the government-controlled areas of the Republic of Cyprus.

• Creative Commons Attribution 4.0 International ↗

Bases, residency, and privacy rights

SD2 Studio is the developer, operator, and controller for the Cyprus Bus mobile app. Your choice to start a GO ride or submit a Verify-mode stop contribution is the basis for that optional processing. Supabase processes those submissions for SD2 Studio in the EU.

Depending on the law that applies to you, you may ask to access, correct, delete, or restrict your data, object to processing, or complain to a supervisory authority.