- 阅读
- 隐私和数据权利
我们尽量少保存您的信息,也绝不出售。
您不需要账户。我们从不公开带姓名的行程或签报。本页列出我们保存的所有内容、保存位置和保存时间。
我们保存什么,保存多久
- not storedSearches
- your device only已保存的站点和行程
- Reports and crowdingour database · up to 365 days
- Messages to usencrypted · 365 days after closing
- Visitscounted, no cookie · 400 days
- Visits, second countCloudflare · counts only
- 数据分析On. Pages viewed and basic engagement, by Google Analytics and PostHog, unless you switch it off. Never your trips, stops or searches.
- Scrambled network addressto stop abuse · 24 hours
- Map tilesthe map provider sees your request
| 当您 | 我们保留的内容 | 地点 | 保留多久 |
|---|---|---|---|
| 搜索本网站 | 不保存任何内容。您未完成的搜索不会被保存,也不会向分析工具发送确切地点。 | 无处 | 未兑现 |
| 保存站点、地点或行程 | 这份列表。它只保存在此浏览器中,我们看不到。 | 您的设备 | 直到您删除为止 |
| 发送报告 | 报告和一份私密回执。不会随之保存姓名或确切位置。 | 我们的数据库 | 最长 365 天 |
| 联系我们 | 您的留言会加密。只有在您要求回复时,才会保存电子邮件地址。 | 我们的数据库 | 关闭后 365 天 |
| 访问任意页面 | 按页面类型、语言和国家每日计数。没有 Cookie，也没有地址。 | 我们自己的计数器 | 400 天 |
| 访问任何页面,以第二种方式计数 | 不依赖浏览器小文件的第二种访问计数，用作外部核对。 | 克劳德弗莱尔 | 仅保留计数，按克劳德弗莱尔的管控规定处理 |
| Visit any page, with analytics on | Coarse page categories and basic engagement, unless you switch analytics off or your browser sends a privacy signal. Never your trips, stops or searches. | 分析工具：Google Analytics、PostHog | 直到您关闭为止；同时适用服务提供方的限制 |
| 任何可能被滥用的内容 | 一条保存时间很短的记录，用来防止重复提交。 | 我们的数据库 | 24 小时 |
| 打开地图 | 不保存任何内容。您的浏览器会向地图提供方请求地图图块,提供方能看到您的请求。 | 地图提供方 | 提供方的条款 |
您的选择
数据分析
Pages viewed and basic engagement, by Google Analytics and PostHog. Never your trips, stops or exact location.
您发送的报告
用您的收据查询
您的权利
查看、复制、更正或删除
该页面尚未标明最后更改日期。
每次更改统计访问量
We count visits ourselves, without cookies. Cloudflare counts them too, without cookies. Google Analytics and PostHog count unless you switch analytics off, with one tap in Your choices. A browser privacy signal switches them off for you.
您的权利
您可以查看我们保存了您的哪些信息，获取副本、更正，或要求删除。大部分操作无需知道您是谁，凭您的收据即可完成。请在“您的选择”中选择一项权利。
谁对本网站负责
| 问题 | 答案 |
|---|---|
| 运营方 | One independent citizen, named on the independence page. Not OC Transpo, STO or the City. |
| Who owns it | The person who runs it. No company or investor. |
| Who decides what is published | Our published methods. No funder or operator can change a figure. |
| Who pays | The owner pays the costs; donations buy no coverage. Every cost is on the Funding page. |
| 提供给他人的数据 | Map tiles, Cloudflare (visit counts), Google Analytics and PostHog (unless you switch them off), Stripe (donations). The register lists every recipient. |
| Next review | October 14, 2026 |
- 运营方
- One independent citizen, named on the independence page. Not OC Transpo, STO or the City.
- Who owns it
- The person who runs it. No company or investor.
- Who decides what is published
- Our published methods. No funder or operator can change a figure.
- Who pays
- The owner pays the costs; donations buy no coverage. Every cost is on the Funding page.
- 提供给他人的数据
- Map tiles, Cloudflare (visit counts), Google Analytics and PostHog (unless you switch them off), Stripe (donations). The register lists every recipient.
该页面尚未标明最后更改日期。 Next review October 14, 2026. 每次更改
完整政策，以及您的隐私控制
谁对 Otranspo 负责
- 所有者和运营方
- 一位独立的渥太华–加蒂诺市民，姓名见独立性页面
- 服务责任方
- 上述所有者拥有 Otranspo,并对其产品、运营、隐私决定、安全响应和公开说明负责。
- 编辑控制
- 上述所有者负责最终的编辑和发布决定。公交机构、城市、数据提供方、托管公司、分析服务商和捐赠者都不能左右报道内容或结论。
- 资金模式
- 上述所有者承担本项目的运营费用。Otranspo 不刊登广告。如果有自愿捐款，捐款也不能换取访问权限、有利的报道或编辑控制权。
- 官方身份
- Otranspo 与 OC Transpo、STO、渥太华市或加蒂诺市没有隶属关系，也未获其认可，并非由其运营。本服务只是官方信息的补充，不提供公共交通服务。
- 已审核应用说明
- 九月14日，2026年
- 下次来源审核到期日
- October 14, 2026
本次审查将公开说明与当前应用程序的来源以及已配置的功能规则进行对比。这不是法律意见,也不能证明待定的来源修订已经上线。当前服务的运行状况和已发布的更正有各自的数据页面。
乘客服务处理哪些信息
发车查询和行程规划查询只用于回应当前请求。Otranspo 不会保存失败或中途放弃的查询,也不会把确切的出发地、目的地、坐标、备注或行程详情发送给分析工具。
已保存的地点、站点、行程和最近的出行记录只保存在当前浏览器中。它们不会同步到 Otranspo 账户。
任何人都可以不创建账户，提交私密的公交报告。匿名数据的权重低于关联账户的数据。匿名提交者会收到私密回执。只有数量足够大的汇总数据经审核后，才可能公开显示。事后登录，也不会自动关联之前的报告。
用于确认附近拥挤情况观测的精确位置不会与观测一同保存。只保留匹配的车辆、报告的拥挤程度、粗略的核实数据，以及必需的审计信息。
任何人都可以发送私密的联系或网站支持消息。消息和可选的重现步骤都会加密。只有在发送者要求回复并明确同意时，才会收集电子邮件地址。该消息绝不会被当作公交事件的证据，也不会被公开。
可选的谷歌地图出行方式比较
只有在乘客明确要求比较时,Otranspo 才会把已确认的坐标和出发意向发送给 Google Maps Routes,用来计算驾车、步行和骑行。地点标签、已保存的地点名称、公交行程、账户信息和报告都不会包含在内。
对比结果是临时的，Otranspo 不会保存它，也不会将其写入浏览器历史记录。没有这项对比，核心的公交规划也能正常使用。Google 按其自身的条款和隐私政策处理该请求。
查阅、导出、更正、撤回和删除
已登录的乘客可以使用需验证身份的隐私接口,导出或删除与账户关联的 Otranspo 记录。删除请求只会以去标识化的形式,保留法律或运营上必须保留的审计数据。
匿名提交报告或联系信息的人会收到一个私人回执凭证。如需提出查阅、更正、撤回或删除请求，请将该回执交给授权的隐私联系人。它不是公开分享链接。
请不要在一般联系留言中填写敏感的出行或安全信息。如需提出权利请求,请使用联系页面上列出的授权隐私联系人。
保留期限
您提交的私人报告最多保留 365 天。若有正在进行的安全审查、申诉或法律保全要求，并有书面记录，可以延长。幂等性和防滥用记录在 24 小时后到期。运营数据源的观测记录不属于乘客记录。
私人联系案件在分类处理期间保持开放。案件解决、关闭、标记为垃圾信息或标记为转错后,将在 365 天后安排删除。与账户关联的案件也适用于已验证的账户删除。
仅保存在浏览器中的信息会一直保留，直到乘客删除、清除网站数据，或浏览器将其清除。
乘客数据可能流向哪里
每一行都写明接收方、确切用途、什么会启动数据交接、可以发送什么，以及 Otranspo 执行或能如实说明的保留期限。带条件的行不能证明该功能目前已启用。
Otranspo 不出售乘客数据，不建立广告画像，也不允许任何服务提供方把私下提交的报告当作公开内容再次使用。
Vercel 公司
运行中- 用途
- 提供 Otranspo 网站和 API,处理请求转发,并运行安全和可用性控制。
- 发生时间
- 每当浏览器请求 Otranspo 的页面、资源或 API 操作时。
- 已发送的数据
- 所请求的网址、网络和浏览器请求元数据，以及乘客提交时的 API 请求内容。Otranspo 在分析前会去掉查询字符串，但托管服务的请求仍须到达所请求的网址。
- 保留期限
- Otranspo 只在下列按用途设定的期限内保存乘客记录。服务提供方的安全日志和请求日志，遵循所配置托管账户的管控措施，不属于乘客历史记录。
Supabase 数据库服务
运行中- 用途
- 存放 Otranspo 的 PostgreSQL 记录，并提供可选的账户验证。
- 发生时间
- 当服务读取或写入持久的应用数据时，或当乘客选择登录时。
- 已发送的数据
- 仅限特定用途的 Otranspo 数据库记录。登录时,还包括共享身份服务保存的账户标识、电子邮件和会话信息。乘客登录并不代表其私人行程会被同步。
- 保留期限
- 仅保存在浏览器中的地点和最近行程会留在浏览器里。私人报告和已关闭的联系个案计划在 365 天后删除。滥用记录和幂等记录在 24 小时后过期。共享身份信息以及财务或法律方面的例外情况,会在删除结果中列明。
Cloudflare 网站分析
运行中- 用途
- 对 Otranspo 自身访问量统计的外部核对。不使用浏览器跟踪文件，也不建立乘客档案。
- 发生时间
- 每次访问页面时。
- 已发送的数据
- A page address without its query string plus the limited network and browser facts used by Cloudflare’s cookieless measurement. Search terms, coordinates, itinerary details, form text, and saved places are excluded.
- 保留期限
- Otranspo 只收到汇总的访问人数，不会根据这个计数器建立任何针对个人的 Otranspo 分析记录。
Upstash（Otranspo 访问计数总数）
运行中- 用途
- 保存 Otranspo 自有的、不使用追踪文件的访问计数器的每日总数。
- 发生时间
- 每次查看页面或完成乘客任务时发送,但发送全球隐私控制(Global Privacy Control)或“请勿跟踪”信号的浏览器除外。
- 已发送的数据
- 只统计数量：页面类型、不含查询字符串的页面地址、语言、来源网站名称、活动标签、设备尺寸类别、国家和加拿大省份，以及乘客任务名称。不会向其发送网络地址、浏览器描述、小型跟踪文件或标识符。
- 保留期限
- 只保留每日总数，400 天后删除。不会记录任何单次页面浏览。
Google 分析
- 用途
- 在关闭广告功能的情况下,统计公共页面的大致类别。
- 发生时间
- 在显示网站通知后默认启用，除非乘客已拒绝分析，或已开启“请勿跟踪”或全球隐私控制。私人页面不包括在内。
- 已发送的数据
- 固定的公开页面类别和类别标题、来源网站、基本的会话互动情况、Google 分析 cookie 和技术性请求元数据。不包括详细路径、所有查询字符串、搜索内容、坐标、行程和表单内容。
- 保留期限
- 撤回同意后,将停止新的测量,并删除 Otranspo 可见的 Google Analytics 浏览器标识符。服务提供方持有的事件,仍受已配置的分析属性和 Google 政策约束。
PostHog 数据分析平台
- 用途
- 只衡量一小份经批准的产品成效指标，让 Otranspo 能找出乘客操作中失败的流程。
- 发生时间
- 当受管控的仅汇总配置可用时默认启用，除非乘客已拒绝分析，或浏览器的隐私信号已开启。
- 已发送的数据
- 经过审核的事件名称，以及一些粗略的属性，例如语言、视口类别、输入方式、连接状态和乘客操作的结果。自动捕获、会话录制、自由文本、精确位置和个人行程历史均已停用。
- 保留期限
- 事件使用共享的汇总标识符,而不是乘客身份。请求仍会发送到服务提供方,因此不会被说成完全匿名。PostHog 将事件保留一年,这是账户套餐的固定期限。关闭分析后,不再产生新事件,乘客功能仍可使用。
谷歌地图路线
- 用途
- 计算可选的驾车、步行和骑行对比。
- 发生时间
- 仅当乘客明确要求比较交通方式时。
- 已发送的数据
- 已确认的出发地和目的地坐标，以及出发意向。地点标签、已保存的地点名称、公交行程、账户信息和报告均不包含在内。
- 保留期限
- Otranspo 将该响应视为临时数据，不会保存，也不会加入最近行程记录。Google 按其自身条款和隐私政策处理该请求。
开放街道地图标准样式，当前使用的底图图块提供方
运行中- 用途
- 在站点、车辆和线路后面绘制可交互的底图。
- 发生时间
- 乘客打开显示交互式地图的页面时。
- 已发送的数据
- 浏览器会为可见的地图区域和缩放级别请求地图图块，并附带普通的网络请求元数据。私人报告、账户记录和已保存地点的标签不会作为图块数据发送。
- 保留期限
- Otranspo 不保存乘客地图视窗的服务商副本。服务商的请求日志仍按当前服务商的条款管理。
Stripe（支付服务商）
运行中- 用途
- 提供可选的捐款结账页面，并开具支付处理方的付款收据。
- 发生时间
- 只有当用户在捐款页面选择“继续前往安全结账”时才会发送。查看乘客信息或资助页面不会向 Stripe 发送任何内容。
- 已发送的数据
- 捐款金额和频率、Otranspo 的私密捐款参考编号，以及直接在 Stripe 上填写的付款和收据信息。Otranspo 不会收到或保存银行卡或银行账户信息。
- 保留期限
- Otranspo 会安排在保留起算日之后满七年零一天时,删除最低限度的会计、退款、争议和对账记录。可选的加密捐赠者联系方式会在 400 天后删除,或应您的要求提前删除。银行卡和银行账户信息由 Stripe 保管。
OC Transpo 或 STO
- 用途
- 让乘客可以联系官方运营方，了解票价、紧急情况、无障碍协助、投诉或权威的服务决定。
- 发生时间
- 仅当乘客点击指向所选运营方的、标注清楚的链接时才会发生。
- 已发送的数据
- Otranspo 不会发送私密的 Otranspo 报告。目标网站会收到正常的浏览请求,以及乘客在该网站上选择提供的内容。
- 保留期限
- 转交之后提交的信息,适用所选运营方网站和联系流程的规定。
Your privacy controls
Before you export or delete
Four data scopes, four separate controls
A server download or deletion cannot reach every place where information may exist. Review each scope first so the result says exactly what changed and what still needs a separate action.
Deleting Otranspo records does not clear this browser, delete a shared sign-in identity, or cancel a monthly donation. Each needs its own action below.
This browser and device
Local to this deviceThese records stay in browser storage and remain usable without an account.
Inspect or clear this device’s dataDetails about this data and its limits
What this includes
- saved places and recent searches
- recent or active trips
- unfinished report and crowding drafts
- local notification inbox, map choices, language and rider preferences
- Export result
- They are not in the server export because the server cannot read them. Settings shows the local categories that this browser can inspect and clear.
- Deletion result
- Deleting Otranspo service records does not clear this browser. Clear the chosen local category in Settings on each device you used.
Otranspo service records
Controlled by the signed-in ownerThese are records in Otranspo’s database that are linked to the current account.
Go to the owner-only exportDetails about this data and its limits
What this includes
- private reports, contact cases and privacy requests
- route requests, votes, proposal support and crowding submissions
- account saves and merge history
- journey watches, recurring journeys, devices, consents, delivery history and access grants
- Export result
- The owner-only JSON download includes current account-linked records and identifies intentionally excluded secrets such as notification addresses and replaceable encrypted coordinates.
- Deletion result
- Permanent deletion removes each covered category inside one transaction and re-counts every category before claiming success. A short pseudonymous audit and replay-safe receipt remain under their stated limits.
Shared sign-in identity
Separate account-service recordThe account identifier, email, authentication methods and sessions belong to the shared Supabase identity service.
Ask for shared account removal stepsDetails about this data and its limits
What this includes
- account identifier and email
- password, passkey or configured sign-in method
- authentication sessions and security events
- Export result
- These records are not included in an Otranspo export. The export names the processor and the boundary instead of silently copying the identity into Otranspo.
- Deletion result
- Otranspo deletion does not delete the sign-in identity. Complete Otranspo deletion first if desired, then use the private privacy intake to request the account-service steps and learn which other service sessions may be affected.
Donation and payment records
Controlled by a private donation receiptStripe holds card or bank details. Otranspo holds only the minimum donation, accounting, refund, dispute and optional contact records described on the funding pages.
Open donation receipt and management helpDetails about this data and its limits
What this includes
- Stripe payment method and processor receipt
- donation amount, frequency and private Otranspo receipt
- optional encrypted contact details
- separate optional public-recognition choice
- Export result
- Donation records are receipt-scoped rather than joined to the Otranspo account export. Otranspo never exports card or bank details because it never receives them.
- Deletion result
- Otranspo account deletion does not cancel a monthly donation or erase records under financial retention. Use the private donation receipt to manage recurrence, erase optional contact details or remove public recognition.
Opening a linked control carries only the page address and the purpose named in the link. Otranspo does not merge browser, account, journey, report, donation, or payment records across services behind the scenes.
Consent register
Each optional use has its own decision
There is no single accept-all switch. Changing one choice affects only the purpose and records named in that row.
Optional analytics
Manage optional analytics- Applies to
- This browser
- How state is known
- Shown and changed directly below. Browser privacy signals keep it off.
- What changing it does
- Turning it off stops future optional collection, removes Otranspo-visible Google Analytics identifiers and leaves all rider tools working.
Exact journey monitoring and closed-page delivery
Manage journeys and delivery devices- Applies to
- One activated journey watch and one delivery device
- How state is known
- Granted during watch activation; browser permission alone is not consent or registration.
- What changing it does
- Ending the watch stops future checks. Revoking the registered device stops future delivery without changing other saved routes or trips.
Working location, live sharing and support access
Review or revoke journey grants- Applies to
- One active journey, recipient and short purpose
- How state is known
- Separate expiring grants are listed in Journey privacy; a location grant is not a sharing or support grant.
- What changing it does
- Revocation immediately ends that access. The replaceable working point expires within five minutes and does not create a movement trail.
Private contribution and any public aggregate use
Open contribution receipts- Applies to
- One report, observation or request
- How state is known
- Confirmed during that submission. Public rail evidence requires a second explicit choice and moderation.
- What changing it does
- Withdrawal follows the private receipt and stops future permitted use where policy allows; it does not erase already de-identified public aggregates.
Donation receipt or project-update contact
Manage from a private donation receipt- Applies to
- One private donation receipt
- How state is known
- Off until a person asks for contact and separately consents to encrypted retention.
- What changing it does
- Erasing contact removes the optional name and email while retaining only records required for accounting, refunds or disputes.
Public donor recognition
Manage public recognition- Applies to
- One donation receipt and one chosen display name
- How state is known
- Separate from contact consent and off by default. A contact name is never treated as permission to publish it.
- What changing it does
- Turning recognition off removes the name from future supporter-page output without cancelling the donation or receipt contact choice.
What works without an account
Reading rider information, changing consent on this device, and asking a privacy question do not require an account.
Access, export, correction, scoped deletion review, appeal, and permanent deletion of account-linked records require the signed-in account owner.
Saved places, recent searches, and unfinished drafts stay on this device. The server cannot export or delete them.
Manage device-only data in SettingsSite usage analytics
Optional analytics is off on this device.
Turning optional analytics off stops future optional collection on this device immediately. The page reloads to apply the new setting everywhere.
Previously aggregated or de-identified measurements cannot be traced back to this device and therefore cannot be reversed.
Access or export account-linked records
The download contains only records linked to this Otranspo account. It does not contain browser-only data or records held by the shared identity provider.
Delete account-linked Otranspo data
Review every item below. This action permanently deletes the account-linked records that Otranspo can verify, while browser data, the shared sign-in identity and payment records keep their separate controls.
Deletion review
- Account-linked reports, requests, votes, crowding submissions, private contact cases, and rider scores in the Otranspo database are deleted where no documented exception applies.
- Device-only saves and drafts stay on this browser until you clear them in Settings; the server cannot reach them.
- Notification endpoints and synced saves are removed only when they exist in the account-linked Otranspo systems covered by the verified deletion response.
- Donation and payment records may have separate legally required financial retention and are not claimed deleted by this control.
- Public aggregate statistics that no longer identify a person are not reversed.
- After successful permanent deletion, the deleted account-linked records cannot be restored.
- The shared authentication account is not deleted by this Otranspo-specific action.
Sign in as the account owner before submitting or changing account-linked records.
Ask a privacy question without an account
Use the private contact form for a general question or to ask for another identity-verification method. Do not send identity documents.
Open the privacy contact form