Privacy.Just your journey.

Platform has no accounts or advertising. The iPhone and iPad app contains no analytics, advertising or crash-reporting SDKs and sends no usage analytics. Its only usage statistic is the anonymous trip count described below. The Android beta app does use analytics and crash reporting, described under Android beta diagnostics. This website offers optional PostHog page-view analytics.

Platform is a free, non-commercial project operated by Immanuel Lam in Sydney, with co-founder Hunter Balderson. We do not sell personal information and do not use it for advertising.

Use at your own risk

Platform is a guide, not a guarantee. Transport times, maps and alerts can be wrong, late or missing, and Platform is not an official Transport for NSW service. Check station signs, announcements and official sources before you travel, and never use Platform while driving or near a platform edge or road in a way that distracts you. Your use of Platform is subject to our terms of use and disclaimer, which limit our liability to the extent the law permits.

Your location

Platform asks for location permission to show your position and move an active journey forward. Active journey tracking uses that location on your device. On iPhone, iOS shows its location indicator while background tracking is active, unless you allowed Always location and Live Activities are on; then Platform relies on the journey’s Live Activity as the visible sign instead. On Android, Platform shows a foreground-service notification. Ending the journey stops journey tracking, although other features you are using, such as the map, can still use your location while the app is open. On iPhone, tracking can also continue for up to ten minutes after an estimated arrival, so a fresh GPS fix can confirm you got there.

On Android, if the stop list on the phone is unavailable, the Nearby screen sends your current latitude and longitude to Platform’s server to find stops around you. The server uses them for that request and does not retain those coordinates in application logs or trip history. If the request fails, the web server’s error log can record it, including the coordinates and your IP address. Platform does not make them available to another rider.

Motion & Fitness

On iPhone, Platform can use Motion & Fitness data to tell walking from riding. This setting is optional, and the data stays on the phone.

Camera and microphone

On iPhone, the stop scanner uses the camera to read a stop number or QR code on the device. Images are not saved or sent. Platform listens only when you tap the microphone, and speech is recognised on the device. Platform does not upload audio. If you speak a place to search for, the recognised words go to Apple Maps search, as typed place searches do.

Saved trips and trip history

Platform stores completed trips on your device until you delete them (the current Android app keeps only the newest 200), so it can suggest regular journeys. It saves the trip’s start, destination and planned services, not a GPS trace or route recording. You can delete one trip or all history at any time. History stays on the device, apart from the backups described here. On iPhone, optional regular-trip suggestions use the last 90 days of history and are also calculated on the device. History is included in your iPhone’s iCloud Backup only if you turn on Back up to iCloud in Platform’s settings.

On Android, Android’s own device backup can include Platform’s data, including history and saved trips, if backup to your Google Account is turned on. On Apple devices, saved trips can sync through your private iCloud account so they remain available on your devices. Platform does not run its own account service for this sync.

What our servers see

If you use cloud journey planning, Platform sends your chosen start and destination to Transport for NSW through our proxy. This is separate from the location and completed-trip history stored on your device. That history is not sent to Platform’s servers. On iPhone, when the start or destination is your current location or an address, Platform sends a coordinate rounded to four decimal places (about 11 metres), not the address or the text you typed.

On iPhone, stop names you type are searched on the device, and address and place search uses Apple Maps search, so Apple receives the text you type into it. On Android, stop names are searched on the device when its stop list is available; otherwise the current app sends the text you type to Platform’s server to search.

The app requests live transport data through Platform’s server (api.platformtransit.com), which keeps Transport for NSW API credentials off your phone. Requests contain the public data being asked for, such as a stop or service. Routine access logs on Platform’s server are off. Error logs are separate: when a request fails, they can record the request and your IP address. Cloudflare keeps its own records of the traffic it handles. To limit abuse, the server counts requests under a one-way hash of the IP address, and these counters are configured to expire within about two hours. The server’s logs are capped in size and rotated, and are not used to build a profile. Cloudflare processes API traffic as Platform’s security and routing provider. Platform’s server is hosted by Amazon Web Services in Sydney.

If you send a problem report from the app’s settings, Platform receives your description, the app version and build, and your phone’s operating system version. Platform’s server keeps the stored report for 30 days. A copy of each report, with the description, also goes to the server’s logs, which can be forwarded to Datadog in the United States. Those copies follow the log rotation and Datadog’s retention, not the 30-day limit. On iPhone, you can choose to send a report by email instead. That email, with your email address, goes to Linear, the issue tracker Platform uses.

Anonymous trip count

The iPhone app counts the trips you finish and sends that anonymous count. There is no setting to turn it off. The app sends at most once a week the number of trips you finished since the last send, up to 50 at a time, with any extra carried to the next send. It also counts, once, the completed trips already in your history, sent alongside the weekly number. If a send fails, the app tries again at least a day later, when it is open. The count contains no location, stops, trip times or device identifier, although the request reaches the server like any other, with your IP address. Platform’s server adds it to the public total shown on this website. It keeps running totals, plus short-lived records that stop a count being replayed: token challenges for 10 minutes and one-way hashes of used tokens for 24 hours. Apple’s Private Access Tokens confirm the count came from a real device without telling Platform which one. Settings › Privacy describes the count, and the privacy policy link in the app opens this page. To stop it, delete the app.

Android beta diagnostics

To help us test, the Android beta app sends product events (such as a completed journey plan or a started journey), crash reports and diagnostics to Datadog, and app usage events, errors and session replays to PostHog through astro.platformtransit.com. Session replay records screenshots of the app’s screens, your touches and app log messages. Text you type and images on screen are not masked. These services start automatically when the app opens, before onboarding, and the app has no setting to turn them off. Datadog processes this data in the United States. PostHog requests use the same route as this website’s analytics. The iPhone and iPad app does not include these services.

Notifications

iPhone get-off and interchange alerts are generated on the device. On Android, during an active journey the app registers a Firebase Cloud Messaging token and sends the journey’s service identifiers, planned stops, timing and progress to Platform’s server, which sends journey updates through Google’s Firebase Cloud Messaging. The app refreshes that registration while the journey is active, and it expires about six hours after the last refresh. When remote Live Activity updates are enabled on iPhone, Platform sends the Live Activity push token, service identifiers, planned stops and timing to its server. The server sends updates through the Apple Push Notification service. This data does not include your GPS coordinates, but the route and progress it contains can show where you are along the journey. The server keeps only the latest update for each Live Activity, with no IP address or device identifier. Ending the journey starts cleanup: the server keeps the push token for about 30 minutes so the final update can reach your phone, then removes the token, route and journey state. A small record of the ended activity, with its identifiers but without the token, expires within nine hours. If your phone is offline, cleanup waits until the app can reach the server. A Live Activity that is never ended expires nine hours after its last update.

Trip sharing

If you create a trip link, Platform uploads a short-lived journey snapshot containing the planned route, named stops, progress estimate, timing, delay status and service alerts. Your position along the route can show exactly where you are. Your GPS location isn’t shared. No device or vehicle IDs are included. Anyone with the link or code can see your route, stops, progress and times. The link expires 8 hours after you create it. Stopping sharing deletes it from our server; if the app can’t reach the server, it lasts until it expires. On iPhone the app keeps trying to delete it. On iPhone, if you added a next trip, the link carries on into it, within the same 8 hours. We keep the latest snapshot, its times, the share code and a hash of the delete key. People you send it to can save copies; deleting it from our server doesn’t remove those. The link is a bearer credential, so only send it to people you trust.

Suggestions and feedback

The suggest a fix form lets anyone tell us about a missing lift, a wrong platform or another problem, and the feedback form lets anyone tell us about the app itself. There is no account. When you send either one, your browser sends contribute.platformtransit.com, a Cloudflare Worker run by Platform, the category and your answers (for a suggestion, the stop, line or place you picked; for feedback, the device and app version if you give them), your note, up to three optional photos or screenshots, an optional email address, and whether you opened the form from the website or one of the apps. The apps only open these pages. They send nothing about you themselves.

Photos and screenshots are resized and re-encoded in your browser before they upload, which removes their location and camera data. If any of that data is still in one, the Worker removes it before storing it. Please do not photograph people, and crop anything private out of a screenshot.

Cloudflare Turnstile checks that a person, not a script, is sending the form. It loads from challenges.cloudflare.com, and Cloudflare processes information about your browser and connection to make that check. To limit abuse, the Worker counts submissions under a one-way hash of your IP address mixed with a value that changes every day. It does not store the IP address itself, and the counters expire within about a day.

A person reviews every suggestion and reads all feedback. Each one becomes an issue in a private GitHub repository that only Platform can see. GitHub processes that data in the United States. The issue holds your answers and note, but never your email address or IP address. Photos and screenshots stay in Platform’s Cloudflare storage and can only be opened by Platform through a login-protected link. Your email address is used only to reply to you, from Platform’s own mail. If we accept a suggestion, the fix can appear in Platform labelled as reported by riders, never as Transport for NSW data, and without your name, email or photos.

Photos and screenshots are deleted after 90 days, unless we mark them to keep while we check what they show. Your email address is deleted after 90 days, or sooner once we close your suggestion or feedback. The text is kept as a record of why Platform changed. To have your photos and email deleted and the text redacted sooner, email admin@platformtransit.com with the receipt code you were shown, such as PLT-7Q4K.

Web planner

The trip planner at platformtransit.com/plan works without an account. The start, destination and time you choose are kept only in the page and in its web address, so you can bookmark or share it. Platform does not store them in your browser or on its servers. Cloudflare, which hosts this website, receives that web address when your browser loads the page.

When you type in From or To, the text goes to api.platformtransit.com to find matching stations and stops. For streets and places, the planner uses Apple Maps search when it’s available. What you type there is sent to Apple, not to Platform, and Apple handles it under its own privacy policy. When Apple Maps search isn’t available, pressing Enter searches Photon (photon.komoot.io), a public OpenStreetMap search service run by Komoot, which then receives what you typed. Search results are kept in the page’s memory until you close it.

“Use my location” asks your browser for your location only when you tap it. The planner rounds it to four decimal places (about 11 metres) before it leaves the page. To plan a trip, your browser sends api.platformtransit.com the stop IDs or rounded coordinates for the start and destination, and the time. Platform’s server passes them to the Transport for NSW Trip Planner to find journeys. Platform does not store them against you or log them: the server removes coordinates from its log lines. The same search from anyone is answered from a short cache, kept for at most 30 minutes, keyed by those stops or rounded coordinates and not linked to who asked.

The map on the planner uses MapLibre with OpenFreeMap tiles, so OpenFreeMap receives ordinary network information, such as your IP address and the map area being shown. Send to phone, Copy link and Add to calendar make a link, QR code or calendar file in your browser. Nothing about the journey is sent to Platform when you use them. A copied link leaves out your location if you used “Use my location”.

Maps and this website

The iPhone and iPad app uses Apple Maps. The Android app loads map styles and tiles from CARTO. Live trip pages on this website use MapLibre with OpenFreeMap and OpenStreetMap data. These providers receive ordinary network information, such as an IP address, when they deliver a map. Platform does not send a trip code or journey snapshot to CARTO or OpenFreeMap.

This website’s own code sets no cookies. Its bundled page assets and fonts are served from this domain; the exceptions are the Cloudflare script below, the maps on live trip pages and the planner, and the planner’s place search. Your theme and app-preview choices are saved in your browser’s local storage. The homepage uses your browser’s user agent locally to select the Android preview on Android, and the iPhone preview on other devices. Platform does not save or send that user agent for this feature. You can change either choice on the page.

The homepage asks api.platformtransit.com for the public count of trips tracked with Platform. That request carries no cookie, identifier or journey data.

Phone handoff links at /p contain a destination and, only when the sender includes it, a starting point. The page asks for your location only when you tap “Use my location”. It sends the starting point, destination and requested time to Platform’s API to find trips, and does not save them in your browser. Your appearance choice is stored on your device. Phone handoff pages do not run Platform’s optional PostHog analytics.

Website analytics

Cloudflare, which hosts this website, adds its Web Analytics script from static.cloudflareinsights.com to pages. It runs whether or not you allow PostHog, and reports page visits and page-load performance to Cloudflare.

PostHog website analytics is off until you allow it below. We use PostHog to count visits to public pages during website testing, until 30 November 2026 at 00:00 Sydney time. Collection then stops automatically. We send the page path and a random identifier held only in page memory. The identifier changes on each page load, so these counts are page views, not a count of distinct people. We do not create person profiles, record sessions, capture clicks or form text, or send query strings, URL fragments, referrers, location or journey data. Shared trip pages are excluded. On the web planner a page view records only the path /plan, never the places or time in its web address.

Requests go through astro.platformtransit.com to PostHog US Cloud, where analytics data is processed in the United States. Network providers receive your IP address when delivering requests. We disable PostHog IP-based geolocation. Analytics identifiers are not stored in cookies or local storage. Your allow or decline choice is stored in this browser's local storage. We respect Do Not Track and Global Privacy Control. You can turn analytics off here at any time; this stops future collection but does not delete events already sent.

Changes

Platform updates this policy when a feature changes how the apps or website handle data.

Contact

Questions about privacy? Email admin@platformtransit.com. Answers to common questions are in the help and FAQ.