Privacy Policy

The site and apps are run as an independent project and the data controller is the site owner. Contact us with any questions about your data or to exercise your rights.

contact@sthlm-metro.com

If you accept analytics in the consent prompt, we use Google Analytics 4 and our own anonymous usage measurement to understand how the app is used and make it better. No measurement happens before you accept, and no data is used for advertising.

The following cookies are then used:

• Google Analytics (_ga and related): anonymised usage statistics. Google LLC processes the data and IP addresses are anonymised.
• sthlm-telemetry-install: a random identifier that recognises your installation, valid for 12 months.
• sthlm-telemetry-day: a daily variant of the same thing, valid for 2 days.

You can change your mind at any time under Settings → Analytics. Measurement stops immediately and any cookies already set become inactive and expire on their own.

We also use Vercel Analytics, which counts page views entirely without cookies or identifiers on your device. The statistics are aggregated and cannot be linked to you. Legal basis: legitimate interest in understanding overall site traffic.

If you create an account to sync your settings, we store your email address, name, password (hashed) and your synced preferences. Legal basis: performance of a contract. The data is stored within the EU (Frankfurt) and deleted when you delete your account.

Your location is used in your browser or app to find the nearest station, and is sent to SL’s journey-planner API when you plan a trip. We never store your location on our servers.

If you enable push notifications, a device token is stored and used only to send the alerts you have chosen.

Your settings, saved stations and consent choice are stored locally on your device and are not sent to us. This is functional storage required for the app to work the way you configured it. If you use account sync, some settings are synced to your account as described above.

We use the following providers:

• Google (Google Analytics): processing partly in the US under the EU–US Data Privacy Framework.
• Vercel (hosting and cookie-free statistics): processing partly in the US under the EU–US Data Privacy Framework.
• Neon (database): storage within the EU (Frankfurt).
• SL/Trafiklab: receive your queries, such as departures and journeys, when the app fetches transit data.

• Google Analytics: up to 14 months.
• Our own usage measurement: raw data is deleted after at most 12 months.
• Account: until you delete it.

You have the right to access, rectify and erase your data, to object to or restrict processing, and to data portability. Consent to analytics can always be withdrawn under Settings.

You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

imy.se

If this policy changes, we update this page and the date above.