Privacy Policy — SG Commute Buddy

1. Who is responsible

SG Commute Buddy is published by DevBox. For anything in this policy, or to exercise the rights described in section 9, write to contact@devbox.tn.

2. What stays on your phone

The following is stored only in the app's private storage on your device. It is not sent to us, and we have no way to read it:

• Your saved stops and stations
• Your recurring trips, and which stops your home-screen widget shows
• Your trip history, the distance and CO₂ figures derived from it, and your badges
• Your notification settings and your onboarding answers
• A local copy of Singapore's public bus-stop list, so that searching a stop needs no network call

Uninstalling the app deletes all of it. There is no backup on our side to restore.

3. What leaves your phone

3.1 Transport data

To show arrival times, crowding and routes, the app sends the following to a server we operate on Cloudflare Workers, which forwards it to Singapore's public transport APIs:

• The bus stop codes you open, save, or put on your widget
• The text you type into the trip planner's search fields
• The start and end coordinates of a trip you ask to plan — these come from the stop or address you picked, never from your device's location

The upstream sources are LTA DataMall (Land Transport Authority) and OneMap (Singapore Land Authority). Our server exists so that our API credentials are not shipped inside the app; it only relays six read-only endpoints and accepts nothing else.

As with any internet request, Cloudflare sees your IP address. We use it for one purpose: rate limiting, so that a single source cannot exhaust our quota. We do not store it in a database, and we do not link it to you. Cloudflare processes it on our behalf under its own privacy policy. Responses are cached at the edge for between 20 seconds and 24 hours depending on how often the source publishes.

3.2 Weather

If you enable rain warnings, the app requests Singapore's two-hour forecast from data.gov.sg (National Environment Agency). This request carries no parameters at all — it asks for the whole island's forecast, and your phone picks the relevant area locally. Nothing about you or your stops is sent.

3.3 Advertising

The app shows banner, interstitial and rewarded ads through Google AdMob. AdMob may collect your device's advertising identifier, coarse information about your device, and how you interacted with an ad, in order to serve and measure advertising. This is described in Google's privacy practices and AdMob's policies.

If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your consent before loading any ad, using Google's User Messaging Platform. You can reopen that choice at any time from Settings → Ad privacy choices inside the app.

We do not sell your data, and we receive no personal data back from Google — only aggregate revenue figures.

4. What we never collect

• No account. No name, email address, phone number or password — there is nothing to sign up for.
• No device location. The app does not declare the Android location permission, so it cannot read your GPS or network position even if it wanted to.
• No analytics and no crash reporting. There is no Firebase, no Google Analytics, and no third-party SDK tracking how you use the app.
• No contacts, photos, files, microphone or camera.
• No advertising profile built by us. We run no server-side user database.

5. Permissions the app requests, and why

6. Notifications

Alerts are computed on your device. The app periodically fetches public service-status and weather information and compares it against the stops you saved locally. No alert rule, and no list of your stops, is ever sent to a server.

7. How long data is kept

• On your phone: until you delete it in the app or uninstall the app.
• On our relay: nothing is stored deliberately. Cached responses expire within 24 hours at most. Cloudflare may retain operational logs under its own policy; we do not query them to identify anyone.
• At Google AdMob: under Google's own retention rules, which we do not control.

8. Children

SG Commute Buddy is a general-audience commuting tool. It is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided personal data through the app, contact us and we will look into it — though, as stated above, the app collects no personal data by which a child could be identified.

9. Your choices and your rights

• Ads: reopen your consent choice from Settings → Ad privacy choices. On Android you can also reset or delete your advertising ID from the system settings, under Privacy → Ads.
• Notifications: turn each type off in the app, or revoke the permission from Android settings.
• Everything else: uninstalling the app erases all locally stored data.

Depending on where you live, you may have rights of access, correction, deletion or objection under the Singapore PDPA, the EU/UK GDPR, or equivalent laws. Because we hold no user database, we usually cannot locate data "about you" — there is none to find. For advertising data held by Google, use the Google controls linked in section 3.3. For anything else, write to contact@devbox.tn and we will answer within 30 days.

10. Third parties involved

11. Changes to this policy

If we change what the app collects, we will update this page and raise the version number above. The effective date always reflects the current text. Material changes will also be described in the app's release notes on Google Play.

12. Contact

DevBox — contact@devbox.tn