Skip to main content

Site usage analyticsWhat is collected

Usage analytics is on by default to improve Otranspo. You can turn it off here.

FR

Public rider information

Privacy and data rights

Back to rider informationFrançais

The short version

Otranspo minimizes rider data and does not publish individual journeys or reports.

Ownership and accountability

Who is responsible for Otranspo

Owner and operator
One independent Ottawa–Gatineau citizen, named on the independence page
Service responsibility
The owner named above owns Otranspo and is accountable for its product, operations, privacy decisions, security response, and public explanations.
Editorial control
The owner named above makes the final editorial and publishing decisions. Transit agencies, cities, data providers, hosting companies, analytics providers, and donors do not direct coverage or conclusions.
Funding model
The owner named above bears the project’s operating costs. Otranspo carries no advertising. If voluntary donations are available, they do not buy access, favourable coverage, or editorial control.
Official status
Otranspo is not affiliated with, endorsed by, or operated by OC Transpo, STO, the City of Ottawa, or the Ville de Gatineau. It supplements official information and does not run transit service.
Application explanation reviewed
September 14, 2026
Next source review due
October 14, 2026

This review compares the public explanation with the current application source and configured capability rules. It is not a legal opinion or proof that a pending source revision has reached production. Current service health and published corrections have their own evidence pages.

Provider register

Where rider data can go

Each row names the recipient, the exact purpose, what starts the handoff, what can be sent, and the retention boundary Otranspo enforces or can truthfully state. A conditional row is not evidence that the capability is currently enabled.

Otranspo does not sell rider data, build advertising profiles, or give a provider permission to reuse a private report as public content.

  • Vercel

    Active service
    Purpose
    Serve the Otranspo website and API, route requests, and operate security and availability controls.
    When it happens
    Whenever a browser requests an Otranspo page, asset, or API operation.
    Data sent
    The requested URL, network and browser request metadata, and the body of an API request when a rider submits one. Otranspo strips query strings before analytics, but the hosting request still has to reach the requested URL.
    Retention boundary
    Otranspo stores rider records only under the purpose-specific periods below. Provider security and request logs follow the configured hosting account controls and are not represented as rider history.

  • Supabase

    Active service
    Purpose
    Host Otranspo’s PostgreSQL records and provide optional account authentication.
    When it happens
    When the service reads or writes durable application data, or when a rider chooses to sign in.
    Data sent
    Purpose-limited Otranspo database records; for sign-in, the account identifier, email and session facts held by the shared identity service. A private journey is not synchronized merely because a rider signs in.
    Retention boundary
    Browser-only places and recent trips stay in the browser. Private reports and closed contact cases are scheduled for deletion after 365 days; abuse and idempotency records expire after 24 hours; shared identity and financial or legal exceptions are named in the deletion result.

  • Cloudflare Web Analytics

    Active service
    Purpose
    An outside check on Otranspo’s own visit count, without cookies or a rider profile.
    When it happens
    On every page visit.
    Data sent
    A page address without its query string plus the limited network and browser facts used by Cloudflare’s cookieless measurement. Search terms, coordinates, itinerary details, form text, and saved places are excluded.
    Retention boundary
    Otranspo receives aggregate audience counts and does not create a person-level Otranspo analytics record from this counter.

  • Upstash (Otranspo visit counter totals)

    Active service
    Purpose
    Hold the daily totals of Otranspo’s own cookieless visit counter.
    When it happens
    On each page view or finished rider task, except in browsers sending Global Privacy Control or Do Not Track.
    Data sent
    Only counts: page type, page address without its query string, language, referring site name, campaign tag, device size class, country and Canadian province, and rider task names. No internet address, browser description, cookie or identifier is sent to it.
    Retention boundary
    Daily totals only, deleted after 400 days. No record of a single page view exists.

  • Google Analytics

    Rider-controlled
    Purpose
    Measure coarse public page categories with advertising features disabled.
    When it happens
    Enabled by default after the site notice is shown, unless the rider has refused analytics or Do Not Track or Global Privacy Control is active. Private pages are excluded.
    Data sent
    A fixed public page category and category title, referring site origin, basic session engagement, and Google analytics cookie and technical request metadata. Detailed paths, all query strings, searches, coordinates, itineraries and form contents are excluded.
    Retention boundary
    Withdrawing consent stops new measurement and removes Otranspo-visible Google Analytics browser identifiers. Provider-held events remain subject to the configured analytics property and Google’s policy.

  • PostHog

    Rider-controlled
    Purpose
    Measure a small allowlist of product outcomes so Otranspo can find failed rider flows.
    When it happens
    Enabled by default when the governed aggregate-only configuration is available, unless the rider has refused analytics or a browser privacy signal is active.
    Data sent
    Reviewed event names and coarse properties such as language, viewport class, input mode, connection state, and the outcome of a rider action. Autocapture, session recording, free text, precise position, and individual journey history are disabled.
    Retention boundary
    Events use a shared aggregate identifier rather than a rider identity. Requests still reach the provider and are not described as completely anonymous. PostHog keeps events for one year, the fixed period of the account plan. Turning analytics off stops new events and leaves rider features usable.

  • Google Maps Routes

    Rider-controlled
    Purpose
    Calculate optional driving, walking, and cycling comparisons.
    When it happens
    Only when a rider explicitly requests a mode comparison.
    Data sent
    Confirmed origin and destination coordinates and departure intent. Place labels, saved-place names, transit itineraries, account details, and reports are excluded.
    Retention boundary
    Otranspo treats the response as transient and does not store it or add it to recent trip history. Google processes the request under its own terms and privacy policy.

  • OpenStreetMap Standard, the active basemap tile provider

    Active service
    Purpose
    Draw the interactive basemap behind stops, vehicles, and routes.
    When it happens
    When a rider opens a view that displays an interactive map.
    Data sent
    The browser requests map tiles for the visible map area and zoom level, with ordinary network request metadata. Private reports, account records, and saved-place labels are not sent as tile data.
    Retention boundary
    Otranspo does not store a provider copy of the rider’s map viewport. Provider request logs remain governed by the active provider’s terms.

  • Stripe

    Active service
    Purpose
    Host an optional donation checkout and issue the processor’s payment receipt.
    When it happens
    Only when a person chooses Continue to secure checkout on the donation page. Viewing rider information or the funding page sends nothing to Stripe.
    Data sent
    Donation amount and frequency, a private Otranspo donation reference, and the payment and receipt details entered directly on Stripe. Otranspo never receives or stores card or bank details.
    Retention boundary
    Otranspo schedules minimum accounting, refund, dispute, and reconciliation records for deletion seven years and one day after their retention anchor. Optional encrypted donor contact details are erased after 400 days or earlier on request. Card and bank details remain with Stripe.

  • OC Transpo or STO

    Rider-controlled
    Purpose
    Let a rider reach the official operator for fares, emergencies, accessibility help, complaints, or authoritative service decisions.
    When it happens
    Only when the rider follows a clearly labelled link to the selected operator.
    Data sent
    Otranspo does not transmit a private Otranspo report. The destination site receives the normal navigation request and whatever the rider chooses to provide there.
    Retention boundary
    The selected operator’s site and contact process govern information submitted after the handoff.

What the rider service processes

Departure and trip-planning searches are processed to answer the current request. Otranspo does not persist unsuccessful or abandoned searches and does not send exact origins, destinations, coordinates, notes, or itinerary details to analytics.

Saved places, stops, trips, and recent journeys are kept only in the current browser. They are not synchronized to an Otranspo account.

Anyone may submit a private transit report without creating an account. Anonymous evidence is weighted less than account-linked evidence, receives a private receipt, and is reviewed before any sufficiently large aggregate can appear publicly. Signing in afterward never silently links the earlier report.

A precise position used to confirm a nearby crowding observation is not stored with the observation. Only the matched vehicle, reported crowding level, coarse verification evidence, and required audit facts are retained.

Anyone may send a private contact or website-support message. The message and optional reproduction steps are encrypted. An email address is collected only when the sender asks for a reply and gives explicit consent; the message is never treated as evidence of a transit incident or published.

Analytics and cookies

Essential session, language, security, and offline storage support requested features. Usage analytics is enabled by default with a visible notice and an off switch. Existing refusals, Do Not Track and Global Privacy Control are respected. Transit tools remain usable when analytics is off.

Otranspo counts visits with its own counter, built into the site. It sets no cookie and stores no internet address, browser description, or identifier of any kind. For each page view it records only: the type of page, a coarse category address without detailed identifiers or query strings, the language, the website that sent the visit (its name only, such as google.com), a campaign tag if the link carried one, whether the screen is phone, tablet, or desktop size, and the country (with the province inside Canada) given by the hosting network. Each view only adds one to that day’s totals; no record of a single view is kept, and the totals are deleted after 400 days. Rider tasks such as planning a trip or sharing a page are counted the same way, by name only. Tools, service tabs and transitions between coarse sections also add to daily totals, without an identifier or individual journey. Search and trip values are never sent. Campaign tags are removed from the address bar once read. A browser marker for the current tab, which is never sent, stops a reload being counted as a new arrival. Browsers sending Global Privacy Control or Do Not Track are not counted at all.

Cloudflare Web Analytics also counts visits, as an outside check. It sets no cookie, reads nothing already in the browser, and does not fingerprint or identify the reader. It records the page address without its query string, so trip searches, coordinates, and itinerary details are never part of either count.

Google Analytics measures coarse public page categories by default unless disabled here or by a browser privacy signal. It may use analytics cookies, removed when it is turned off. Private pages, detailed identifiers, searches, trip endpoints and query strings are excluded. PostHog counts reviewed actions with a shared aggregate identifier, without session recording or individual rider profiles. Vendor requests reach Google and PostHog; they are not described as completely anonymous. These totals are measurements, not a verified count of people.

The service does not sell rider data. The provider register below names every recipient used by the current application, the purpose, the trigger, the data involved, and the retention boundary. Optional and conditional providers receive nothing until their stated trigger occurs.

Optional Google Maps mode comparison

Only when a rider explicitly requests the comparison, Otranspo sends the confirmed coordinates and departure intent to Google Maps Routes to calculate driving, walking, and cycling. Place labels, saved-place names, transit itineraries, account details, and reports are not included.

The comparison response is transient and is not stored or placed in browser history by Otranspo. Core transit planning works without this comparison. Google processes the request under its own terms and privacy policy.

Access, export, correction, withdrawal, and deletion

Signed-in riders can use the authenticated privacy endpoints to export or delete account-linked Otranspo records. A deletion request preserves only legally or operationally required audit evidence in de-identified form.

An anonymous report or contact sender receives a private receipt capability. Use that receipt with the authorized privacy contact for an access, correction, withdrawal, or deletion request; it is not a public sharing link.

Do not place sensitive journey or safety information in a general contact message. Use the authorized privacy contact shown on the contact page for a rights request.

Retention

Private submitted reports are retained for up to 365 days unless an active safety review, appeal, or legal hold requires a documented extension. Idempotency and abuse-prevention records expire after 24 hours. Operational feed observations are not rider records.

A private contact case remains open while it is being triaged. Once resolved, closed, marked spam, or marked misdirected, it is scheduled for deletion after 365 days. Account-linked cases are also covered by authenticated account deletion.

Browser-only saved information remains until the rider removes it, clears site data, or the browser evicts it.

Your privacy controls

Before you export or delete

Four data scopes, four separate controls

A server download or deletion cannot reach every place where information may exist. Review each scope first so the result says exactly what changed and what still needs a separate action.

Deleting Otranspo records does not clear this browser, delete a shared sign-in identity, or cancel a monthly donation. Each needs its own action below.

  • This browser and device

    Local to this device

    These records stay in browser storage and remain usable without an account.

    Inspect or clear this device’s data
    Details about this data and its limits
    What this includes
    • saved places and recent searches
    • recent or active trips
    • unfinished report and crowding drafts
    • local notification inbox, map choices, language and rider preferences
    Export result
    They are not in the server export because the server cannot read them. Settings shows the local categories that this browser can inspect and clear.
    Deletion result
    Deleting Otranspo service records does not clear this browser. Clear the chosen local category in Settings on each device you used.

  • Otranspo service records

    Controlled by the signed-in owner

    These are records in Otranspo’s database that are linked to the current account.

    Go to the owner-only export
    Details about this data and its limits
    What this includes
    • private reports, contact cases and privacy requests
    • route requests, votes, proposal support and crowding submissions
    • account saves and merge history
    • journey watches, recurring journeys, devices, consents, delivery history and access grants
    Export result
    The owner-only JSON download includes current account-linked records and identifies intentionally excluded secrets such as notification addresses and replaceable encrypted coordinates.
    Deletion result
    Permanent deletion removes each covered category inside one transaction and re-counts every category before claiming success. A short pseudonymous audit and replay-safe receipt remain under their stated limits.

  • Shared sign-in identity

    Separate account-service record

    The account identifier, email, authentication methods and sessions belong to the shared Supabase identity service.

    Ask for shared account removal steps
    Details about this data and its limits
    What this includes
    • account identifier and email
    • password, passkey or configured sign-in method
    • authentication sessions and security events
    Export result
    These records are not included in an Otranspo export. The export names the processor and the boundary instead of silently copying the identity into Otranspo.
    Deletion result
    Otranspo deletion does not delete the sign-in identity. Complete Otranspo deletion first if desired, then use the private privacy intake to request the account-service steps and learn which other service sessions may be affected.

  • Donation and payment records

    Controlled by a private donation receipt

    Stripe holds card or bank details. Otranspo holds only the minimum donation, accounting, refund, dispute and optional contact records described on the funding pages.

    Open donation receipt and management help
    Details about this data and its limits
    What this includes
    • Stripe payment method and processor receipt
    • donation amount, frequency and private Otranspo receipt
    • optional encrypted contact details
    • separate optional public-recognition choice
    Export result
    Donation records are receipt-scoped rather than joined to the Otranspo account export. Otranspo never exports card or bank details because it never receives them.
    Deletion result
    Otranspo account deletion does not cancel a monthly donation or erase records under financial retention. Use the private donation receipt to manage recurrence, erase optional contact details or remove public recognition.

Opening a linked control carries only the page address and the purpose named in the link. Otranspo does not merge browser, account, journey, report, donation, or payment records across services behind the scenes.

Consent register

Each optional use has its own decision

There is no single accept-all switch. Changing one choice affects only the purpose and records named in that row.

  • Optional analytics

    Manage optional analytics
    Applies to
    This browser
    How state is known
    Shown and changed directly below. Browser privacy signals keep it off.
    What changing it does
    Turning it off stops future optional collection, removes Otranspo-visible Google Analytics identifiers and leaves all rider tools working.

  • Exact journey monitoring and closed-page delivery

    Manage journeys and delivery devices
    Applies to
    One activated journey watch and one delivery device
    How state is known
    Granted during watch activation; browser permission alone is not consent or registration.
    What changing it does
    Ending the watch stops future checks. Revoking the registered device stops future delivery without changing other saved routes or trips.

  • Working location, live sharing and support access

    Review or revoke journey grants
    Applies to
    One active journey, recipient and short purpose
    How state is known
    Separate expiring grants are listed in Journey privacy; a location grant is not a sharing or support grant.
    What changing it does
    Revocation immediately ends that access. The replaceable working point expires within five minutes and does not create a movement trail.

  • Private contribution and any public aggregate use

    Open contribution receipts
    Applies to
    One report, observation or request
    How state is known
    Confirmed during that submission. Public rail evidence requires a second explicit choice and moderation.
    What changing it does
    Withdrawal follows the private receipt and stops future permitted use where policy allows; it does not erase already de-identified public aggregates.

  • Donation receipt or project-update contact

    Manage from a private donation receipt
    Applies to
    One private donation receipt
    How state is known
    Off until a person asks for contact and separately consents to encrypted retention.
    What changing it does
    Erasing contact removes the optional name and email while retaining only records required for accounting, refunds or disputes.

  • Public donor recognition

    Manage public recognition
    Applies to
    One donation receipt and one chosen display name
    How state is known
    Separate from contact consent and off by default. A contact name is never treated as permission to publish it.
    What changing it does
    Turning recognition off removes the name from future supporter-page output without cancelling the donation or receipt contact choice.

What works without an account

Reading rider information, changing consent on this device, and asking a privacy question do not require an account.

Access, export, correction, scoped deletion review, appeal, and permanent deletion of account-linked records require the signed-in account owner.

Saved places, recent searches, and unfinished drafts stay on this device. The server cannot export or delete them.

Manage device-only data in Settings

Access or export account-linked records

The download contains only records linked to this Otranspo account. It does not contain browser-only data or records held by the shared identity provider.

Sign in

Request access, correction, deletion review, or an appeal

Choose the smallest useful scope. Do not enter identity documents, passwords, payment details, or unrelated personal information.

Delete account-linked Otranspo data

Review every item below. This action permanently deletes the account-linked records that Otranspo can verify, while browser data, the shared sign-in identity and payment records keep their separate controls.

Deletion review

  • Account-linked reports, requests, votes, crowding submissions, private contact cases, and rider scores in the Otranspo database are deleted where no documented exception applies.
  • Device-only saves and drafts stay on this browser until you clear them in Settings; the server cannot reach them.
  • Notification endpoints and synced saves are removed only when they exist in the account-linked Otranspo systems covered by the verified deletion response.
  • Donation and payment records may have separate legally required financial retention and are not claimed deleted by this control.
  • Public aggregate statistics that no longer identify a person are not reversed.
  • After successful permanent deletion, the deleted account-linked records cannot be restored.
  • The shared authentication account is not deleted by this Otranspo-specific action.

Sign in as the account owner before submitting or changing account-linked records.

Ask a privacy question without an account

Use the private contact form for a general question or to ask for another identity-verification method. Do not send identity documents.

Open the privacy contact form