Last Updated: August 10, 2026
This page explains what the Porto Bus app collects, who receives it, why, and what you can do about it. The app has no accounts and no payments, so we never ask you for your name, your address or payment details.
Porto Bus is responsible for the personal data described on this page. In the language of the General Data Protection Regulation (GDPR), we are the controller. You can reach us at support@portobus.app, the same address the app shows under Settings, Support, Contact support.
The app fetches timetables, routes, stops and service notices from our servers. Each request tells us which platform you are on, your operating system version, your app version and your app language, so that we can return data your version can display. It also carries your device's IP address, which we use to limit how many requests a single source can make.
When you search, the words you type are sent to our servers, because the search runs there and not on your phone. We use them to answer that search and nothing else.
The app asks for your location only while you are using it, never in the background. Your position is used to centre the map on you and to show where you are, as the blue dot on the map.
Your coordinates are never sent to our servers. The app has no nearby-stops search, and nothing else in it puts your position into a request to us. The blue dot is drawn by Google's map software running inside the app, so your position reaches Google there; on Android the position itself comes from Google Play services rather than from the device's own sensors.
You grant and revoke this permission in your device settings. If you refuse, the map simply does not centre on you and everything else in the app keeps working.
If you email us, we receive your email address and whatever you write, and we use it only to answer you. We keep the exchange until the matter is settled and then delete it, unless we are legally required to keep it for longer.
For several operators, live departure times come from the operator's own system and your device fetches them directly, so that operator sees your IP address and which stop you are looking at. Those operators are not processing anything on our behalf, and what they log is governed by their own policies rather than this one. The same applies to images attached to a service notice, which your device loads from them as soon as you open the notice, and to their own links, such as a timetable or an attached document, which open in your browser and go straight to them.
The app is free, and ads are how it is paid for. They are served by Google AdMob, which receives your device information, your IP address, your advertising identifier and your interactions with the ads, and uses them to select, display and measure ads.
Where consent is required, the app shows Google's consent form before you reach the main screen. Your answer decides whether ads are personalised, not whether they appear; saying no makes them non-personalised. You can reopen that form at any time from Settings, Legal, Ad preferences. See how Google uses data for advertising.
Both platforms give apps a resettable advertising identifier, and the ads can use it. On Android this is the Google advertising ID, which you can reset or delete in your device settings. On iOS it is the IDFA, and Apple's tracking prompt appears first; if you decline, the app cannot use it. Both platforms also run their own ad measurement, Apple's SKAdNetwork and Android's Privacy Sandbox, which tell an ad network that an ad it showed you led to an install. They are part of the operating system, so the app has no switch for them.
These services run inside the app and receive data from your device. All but the last are provided by Google. None of them has a switch in the app.
When you tap directions, the app hands the stop's coordinates to a map app you choose. Nothing goes to our servers, and what happens next is between you and that app.
Beyond the services named on this page, the only other recipients are our hosting and security providers, which handle data on our instructions and for no purpose of their own. We do not sell your data. See also Firebase's privacy and security page and Google's privacy policy.
Each activity relies on one of the legal bases in Article 6(1) GDPR.
We keep our own records only while they serve the purpose they were collected for: server logs while they are useful for spotting abuse and diagnosing faults, and emails until your question is settled and no legal duty requires us to keep them for longer. Data held by the services in Sections 4 and 5 is kept on their schedules rather than ours; we set the retention period where the service lets us, and we cannot shorten it where it does not.
Some of these recipients are outside the European Economic Area, mainly in the United States. Where that happens, the transfer relies on the safeguards those companies publish: European Commission adequacy decisions, including the EU-U.S. Data Privacy Framework, or the standard contractual clauses approved by the European Commission. Google publishes its own on its data transfer frameworks page, and for any of the others email support@portobus.app and we will send you the details. The transport operators in Section 3 are the exception, because your device contacts them directly and we have no agreement with them about where that request is handled.
The app has one privacy control of its own: Settings, Legal, Ad preferences reopens Google's consent form. It governs ads and nothing else.
The rest sit in your device settings. You can grant or revoke the location permission there, reset or delete your advertising identifier, and on iOS change your answer to the tracking prompt. The services in Section 5 have no switch; you can object by emailing us, or uninstall the app, which stops all of it.
Under the GDPR you can ask us to:
Where we rely on your consent, you can withdraw it at any time, with effect from that point on (Article 7(3)). Withdrawing does not make what happened before it unlawful.
Because the app has no accounts, most of the data described here is tied to a random per-installation identifier rather than to you by name, so we often have no way to connect it to a person. Tell us what you need and we will do what is technically possible. Email support@portobus.app to exercise any of these rights.
If you think we are handling your data unlawfully, please tell us first so we can fix it. You also have the right to complain to a data protection authority. Ours is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), which takes complaints at cnpd.pt. You can also complain to the data protection authority of the country where you live or work.
When we change what the app collects, we update this page and the date at the top. The app links here from Settings, Legal, Privacy policy, so the current version is always one tap away.