Privacy policy

Last updated: 2026-06-12

Who runs this site

NextBuses.Live is operated by Katsunori Ogane, a UK sole trader, at:

267A Brighton Road
South Croydon
CR2 6EN, United Kingdom

For any privacy-related question or to exercise your data-protection rights, contact support@nextbuses.live.

What is collected

No tracking script is loaded on this site. There is no analytics beacon, no analytics cookies, and no per-visitor identifier of any kind. Page-view counts are derived from Cloudflare's standard edge access logs (the same HTTP metadata Cloudflare's CDN already processes to serve the request: pageview, referrer, country-level location derived from IP, browser / OS), presented as an aggregate view in the Cloudflare account. Nothing is stored on your device by this site for the purpose of measurement.

Your board configuration — the location you choose, the stops you pick, the display options, and optionally your Transport for London API key — is stored only in your browser's localStorage (under keys such as nextbuses-live.config.v1.<region>). It is not transmitted to us or to any third party as part of normal use.

To show arrivals, the app fetches data over the network. Which services your browser contacts depends on the region:

London calls the Transport for London Unified API and the postcodes.io postcode lookup directly from your browser.
Norway calls Entur's national journey-planner and geocoder directly from your browser; in Estonia the Tallinn live overlay calls transport.tallinn.ee directly.
Other regions call our own stateless Cloudflare Workers at api.nextbuses.live for nearby stops, arrivals and live delays, and/or fetch static timetable files from data.nextbuses.live. UK postcodes are geocoded via postcodes.io; free-text places in the other European regions via the OpenStreetMap Nominatim service (Finland uses Digitransit through our Worker).
The optional map in Settings loads tiles from CARTO and Esri via the Leaflet library.

None of these requests carry an identifier about you — only the standard HTTP metadata (your IP address and User-Agent) that each service sees in transit.

Paid plans. If you subscribe to a paid plan (Plus or Pro), payment is handled by Polar (Polar Software, Inc.), which acts as the Merchant of Record (the seller of record) for the transaction. Polar collects your email address, billing details, payment information, and approximate location / IP address (used to calculate the correct tax), and issues you a licence key. To activate and periodically re-check that key, the app sends the key, a random device identifier it generates, and the region you're viewing to our licence service (a Cloudflare Worker at api.nextbuses.live/billing), which confirms the key with Polar and keeps a small record — the key, that device identifier, and where/when it was last used — so that one licence activates one screen at a time and support questions can be answered. We never see or store your card details; the licence key and device identifier are kept in your browser's localStorage.

In-app support (paid plans). If you use the “Contact support” form on a Plus or Pro board, the message you write, whether it's support or a feature request, the board's region, plan and build version, and — so the form can confirm your plan — your licence key and device identifier are sent to a Cloudflare Worker at api.nextbuses.live/support, which records them as a private issue in this project's GitHub repository (GitHub, Inc.). An email address (so I can reply) and any images you attach are optional; images are stored privately in Cloudflare R2 and linked from the issue. Including your current settings (the “Debug” line — your saved stops and display options) is opt-in: on by default for support, off for feature requests. Only I can see the issue.

Why

To make the board work for your chosen stops, the app must remember your selections on your device and fetch the underlying transit data over the network. Aggregate page-view counts help me see how the site is used so improvements can be prioritised. Paid subscriptions fund the running costs. I do not sell or share data outside the recipients listed below, and I do not profile individual visitors.

Legal basis

Storing your board configuration locally on your device: necessary to provide the board as you've configured it (UK GDPR Article 6(1)(b)).
Fetching the public transit data and serving the site: legitimate interest (Article 6(1)(f)) in delivering the arrivals the site exists to present.
Processing a paid subscription (payment and licence validation): performance of a contract (Article 6(1)(b)).
Aggregate page-view counts derived from the hosting CDN's edge access logs (no per-visitor identifier): legitimate interest (Article 6(1)(f)) in measuring use of the site without identifying you.

Who receives data

Cloudflare, Inc. — hosts the site (Cloudflare Pages) and the arrivals API (Cloudflare Workers), and serves them through Cloudflare's global edge network. The edge sees the standard HTTP metadata (IP address, User-Agent, requested URL) it processes to provide the service; the aggregate page-view counts are derived from those logs.
Transport for London — serves the stop and arrivals data for the London board, called directly from your browser (London only).
postcodes.io — looks up UK postcodes you type into the location field.
OpenStreetMap Foundation (Nominatim) — geocodes free-text place searches for the Ireland board.
CARTO and Esri — provide the map tiles shown when picking stops.
Polar Software, Inc. — processes paid-plan subscription payments as Merchant of Record and confirms your licence key when our licence service checks it (paying subscribers only).
GitHub, Inc. — stores in-app support and feature-request submissions as private issues so they can be tracked and answered (paid plans only).

The arrivals themselves come from public open data — Transport for London, the Department for Transport's Bus Open Data Service, Transport for Ireland / the National Transport Authority, Translink / Open Data NI, Entur (Norway), Digitransit (Finland), Transpordiamet and Tallinna Transport (Estonia), Stadt Wien / Wiener Linien (Austria), and DELFI / gtfs.de (Germany). For most regions that data is fetched and indexed by our server-side jobs, not from your browser.

International transfers

Cloudflare, Inc. is a US company; visitors from the EU/UK are served from the nearest Cloudflare edge location (typically inside the EU/UK) and Cloudflare relies on the UK extension to the EU-US Data Privacy Framework and Standard Contractual Clauses for any transfers to the US. Polar Software, Inc. processes subscription data in the US under equivalent safeguards. Transport for London, postcodes.io and OpenStreetMap are UK/EU based.

How long data is kept

Cloudflare CDN access logs (the source of the page-view counts): retained by Cloudflare per their standard operational-log retention. The site operator does not separately retain copies.
Your board configuration and licence key stored locally in your browser: until you clear it (the Cancel / Settings controls in the app, or clearing your browser's site data). If your browser is set to sync, this local data may be mirrored to your other devices by your browser, not by this site.
Subscription and billing records held by Polar: kept by Polar for as long as needed to provide the service and to meet tax and accounting obligations. Our own licence-service record (key, device identifier, last-seen region/time) is kept while the key is in use and deleted on request.
In-app support and feature-request submissions (the GitHub issue and any attached images): kept while the request is open and for a reasonable period after it's resolved, then deleted; sooner on request.

Your rights

Under the UK GDPR you can ask me to:

Confirm what data I hold about you and provide a copy (right of access);
Correct inaccurate data (rectification);
Delete data I hold (erasure);
Restrict or object to processing;
Receive your data in a portable format.

Your board configuration lives only on your device, so clearing your browser's site data removes all of it. For subscription data, contact me at support@nextbuses.live or manage it through the Polar customer portal.

If you believe your rights have been infringed, you can lodge a complaint with the UK Information Commissioner's Office (ICO), or with your local supervisory authority in the EU/EEA.

Automated decision-making

There is none. Arrival times are taken from public transit feeds and shown as-is; paid features are unlocked by your own subscription licence, not by any profiling of you.

Changes to this policy

If something material changes (a new data recipient, a new processing purpose, new categories of data) this policy will be updated and the "Last updated" date above will be revised.

← Back to NextBuses.Live