Privacy

This page describes what actually happens, not what would sound best.

If you never share a zone

Nothing about your group is stored. The addresses you enter live in your browser and in the part of the URL after the #, which browsers never send to a server. They do travel to our server while a zone is being computed, because they have to reach the routing service, and they are not written to disk or into logs. Server logs record how many people were in the party and which transport modes they used, never coordinates.

If you do share a zone

Pressing share creates a link with a random, unguessable id. Behind that link we store the labels you typed, your coordinates rounded to roughly 100 metres, and the computed result. That is what lets the link show a preview in a group chat. It is deleted automatically after 30 days. These pages are excluded from search engines.

If you send an invite link

This is the one feature that has to hold several people’s starting points on a server before anyone has seen a result, so it is worth being exact about. Each person who opens your link and adds a departure has their label, transport mode and coordinates — rounded to roughly 100 metres before they are stored, so a neighbourhood rather than a front door — kept behind a random, unguessable id. The whole thing is deleted automatically after 24 hours. It is scaffolding for one evening, not a record.

Holding the link lets you add yourself. It does not hand you anyone else’s coordinates: those are only ever returned to the browser that created the invite, which holds a separate secret the link does not contain. A link pasted into a group chat gets forwarded, and being able to add a departure should never mean being able to read five people’s addresses. Everyone who joins can also ask for the meeting point once at least two people are in, without waiting for the group to be complete; when they do, they see the area, the arrival times and first names only — never a street, never a coordinate, never anyone’s individual travel range.

One thing worth saying plainly rather than glossing over: the meeting area is the overlap of everybody’s reach, so its shape is a statement about the group. In a small party — two people, one of them on foot — the edge of that area sits close to where the walker started. No stored coordinate is ever sent, but the answer is not location-free, because the answer is the whole point. Anyone who joined can change or remove their own entry at any time, and the person who created the invite can close it, which deletes everything immediately.

If you turn on notifications

Asking to be told when someone answers your invite stores one more thing: the push subscription your browser hands out. That is an address at Apple, Google or Mozilla — not at us — which lets exactly one message be delivered to that browser, and it contains no name, no email and no device identifier we can read. It is stored on the invite itself, so it is deleted when the invite is closed and expires with it after 24 hours. The notification we send says a first name and a count, nothing about where anyone is. Turning notifications off for this site in your browser stops delivery immediately, and the subscription is dropped the next time someone joins.

Measurement

A random identifier is kept in your browser so we can tell whether people come back and whether shared links get opened. It is not linked to a name, an email or an account, and clearing your site data resets it. Events record counts, transport modes, city and outcome. They never record where you are.

One addition worth stating plainly rather than hiding under “outcome”: an event also records the name of the area the group was sent to — “Bastille”, “Porte de Vincennes” — because which areas people actually meet in is the first thing anyone wants to know about how this gets used. That is the meeting point: a place this app computed, or one the group chose by tapping the map. It is a neighbourhood or a station, never a street, and it is never anybody’s departure. Nothing derived from an address you typed is recorded, here or anywhere else.

Third parties

Coordinates are sent to a routing service to compute travel times, and to a geocoder to turn what you type into a location. Public-transport journeys are routed against real timetables by Transitous, whose page lists every transit agency the data comes from. Map tiles are served by CARTO. Tapping a category opens Google Maps or Apple Maps, at which point their terms apply, not ours.

Your data

There are no accounts, so there is nothing to log into and delete. To remove a shared zone before it expires, stop sharing the link and it will lapse within 30 days. An invite link can be deleted on the spot with “Close” on the invite panel, and lapses by itself within 24 hours either way. To reset your measurement identifier and saved crews, clear this site’s data in your browser.