Last updated 10 August 2026
QuixBus shows you where UK buses are right now. This policy explains what the app collects, why, and what you can do about it. It covers the QuixBus mobile apps for Android and iOS and the QuixBus API behind them.
QuixBus is made by Supun Praneeth, an independent developer, not a company. I am the data controller for the personal data described here, and you can reach me at hello@travelquix.com about anything on this page.
| Data | Why |
|---|---|
| Email address | To identify your account, sign you in, and send verification and password-reset codes. |
| First and last name | Shown on your profile in the app. |
| Password | Stored only as an Argon2id hash. Your actual password is never stored or seen. If you sign in with Google or Apple, no password is stored at all. |
| Saved buses and stops | So your saved list follows you between devices. |
| Appearance preference | So light or dark mode follows you between devices. |
You can use QuixBus without an account. Without one, none of the above is collected and nothing is stored on the server.
If you grant the location permission, your device's position is used to centre the map on you and to sort nearby buses and stops by distance.
Your position is used on the device. When the app asks the API which buses are running, it sends the area of the map you are looking at, or a coordinate pair for a nearby search. Your location is never stored against your account, and no history of where you have been is kept.
The app works without the permission. You will see buses and be able to search; the map simply will not centre on you. You can withdraw the permission at any time in your device settings.
When something goes wrong, the app sends a crash or error report so I can fix it. These reports contain the type of failure, where in the app it happened, your app version, and your device model and OS version.
Reports are scrubbed before they are sent: authentication tokens, request bodies, and anything that looks like an email address are removed automatically. If you are signed in, a report carries your numeric account ID so I can tell whether a problem affects one person or everyone, but never your email address or name.
The server and CDN record the usual things a web server records: IP address, the time of the request, which endpoint was called, and the app version. I use this to keep the service running, to apply rate limits, and to investigate abuse.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running your account and syncing your saved list | Performance of a contract |
| Sending verification and password-reset codes | Performance of a contract |
| Using your location to centre the map | Consent, given through the device permission prompt, withdrawable at any time |
| Crash reporting, rate limiting, abuse prevention, keeping the service secure | Legitimate interests: running a reliable and safe service |
I do not sell your data and I do not use it for advertising. QuixBus relies on the following providers, who process data on my instructions:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (EC2, London) | Running the API and database | United Kingdom |
| Cloudflare | DNS, TLS, and protecting the API from attack | Global network |
| Sentry | Crash and error reporting | European Union (Frankfurt) |
| Amazon SES | Sending verification and password-reset emails | European Union |
| Google Maps | Map tiles and map rendering inside the app | Governed by Google's own privacy policy |
| Google / Apple | Sign in with Google or Apple, only if you choose it | Governed by their own privacy policies |
Bus times and live vehicle positions come from the UK Bus Open Data Service (BODS), operated by the Department for Transport. That is a source of data, not a recipient: nothing about you is sent to them.
| Data | Kept |
|---|---|
| Your account and saved list | Until you delete your account |
| Sign-in sessions | Refresh tokens expire 30 days after last use, and are revoked when you sign out |
| Email verification and reset codes | 10 minutes |
| Crash reports | 90 days |
| Server logs | 30 days |
When you delete your account, your profile, saved items and sessions are removed from the database. Crash reports already sent are not linked to your email address and age out on the schedule above.
Under UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how I use it, and to receive it in a portable form.
Two of these are built into the app, under Profile → Privacy & data:
For anything else, email hello@travelquix.com and I will respond within one month.
If you are not happy with how your data has been handled, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
QuixBus is not directed at children under 13, and their data is not knowingly collected. If you believe a child has given me personal data, contact me and I will delete it.
Traffic between the app and the API is encrypted with TLS. Passwords are stored as Argon2id hashes. Sign-in sessions use rotating refresh tokens, so a stolen token stops working as soon as the real one is used again.
If this changes, I will update this page and change the date at the top. Significant changes will be announced in the app.