Data Usage Policy

• Required

  INTERNET

  Needed for address search, walking routes, live bus times, toilet status and service alerts, and to serve AdMob advertisements and analytics events (after consent). The map itself works offline.

• Optional

  ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION

  Used for GPS route tracking and finding nearby stations. You can deny or revoke this at any time; core route planning works without it.

• Required

  AD_ID

  Declared as required by Google Play when AdMob is integrated. Used by AdMob and analytics only if you consent.

• Optional

  POST_NOTIFICATIONS (Android 13+)

  Used to show your journey progress while route tracking is running, and to deliver transport incident notifications if you switch those on. Incident notifications are off by default and are enabled in Settings.

The following features operate entirely on your device with no network communication:

• Route planning and transfer calculation across M1-M5
• Timetable lookups and next-train calculations
• Station search and line filtering
• Door-opening direction indicators
• Station notes and favourite route storage
• Theme, language, and font-size preferences
• GPS route tracking progress display
• Crash report storage (until you send one)

The following are the only situations in which data leaves your device:

• Address search: the text you type into a destination field is sent to an external map service to find matching places.
• Street name lookup: when the App shows the street you are currently on, your GPS coordinates are sent to an external map service. This is the only feature that transmits your precise position, and only while you are using it.
• Walking routes: when a walking route is drawn, its start and end points are sent to an external routing service.
• Toilet status: the shared toilet data is read from a Google cloud database. If you submit a report, the station, the condition you selected, the time and your optional note are sent. No account, device identifier or location is attached.
• Report validation: submitting a toilet report involves a Google integrity check confirming the submission comes from a genuine install. It carries no account or personal data, and we do not store it.
• Incident notifications: if you switch them on, notifications are delivered through Google's messaging service. The same notification goes to everyone who has them enabled, so nothing identifying you reaches us. Switching them off stops delivery.
• Live arrival times: the stop whose times you are viewing is sent to an external transit data provider.
• Service alerts: the App requests the current alerts, news and events list from an external provider and sends nothing about you.
• Ad requests: when ads are loaded, Google's advertising service receives device and context signals (see Section 5), and only after consent.
• Analytics events: anonymous app events and device information are sent to Google's analytics service (see Section 5b), only after consent and off by default.
• Crash report emails: only if you manually choose to send one from Settings → Crash Reporting.
• External app launches: opening a location in a map application is initiated entirely by your tap.

Metrou București uses Google AdMob to display banner advertisements. AdMob is subject to Google's privacy policies and EU GDPR requirements.

On first launch the App shows a GDPR consent dialogue via Google's User Messaging Platform (UMP). Your choices:

• Consent granted: AdMob may show personalised ads using your Advertising ID, device model, OS, network type, and approximate location.
• Consent declined: AdMob shows contextual (non-personalised) ads. Some contextual signals, such as app context and general location, are still used.

For Google's full data practices see: Google Privacy Policy and AdMob data disclosure.

Metrou București uses Google Analytics for Firebase to collect anonymous, aggregated statistics about how the App is used (for example which features are opened and how often). This helps us prioritise improvements. We do not use it to identify you personally or to build advertising profiles.

Collected only after consent: app events & screen views, session counts, device model, OS and app version, language/country, and approximate (IP-based, city-level) location. Never collected: your name, email, precise GPS, or your local notes/favourites.

See Firebase Privacy & Security for Google's data practices.

Only relevant if you buy MetroBUC PRO, the optional paid upgrade that removes all advertising. It is sold either as a monthly subscription, which renews until you cancel it in Google Play, or as a one-time purchase that is permanent. Both remove exactly the same ads.

• Collected by us: whether PRO is active, kept on your device only. It is the same either way, whichever of the two products you bought.
• Handled by Google: the purchase itself, payment included. Google Play processes the transaction under its own privacy policy.
• Transmitted to us: nothing. No information about your purchase ever reaches a server we control.
• Effect on advertising data: while PRO is active, no ads are shown, so no advertising identifiers or ad-related signals are collected at all.

App data (local)

• Retained on your device until you clear app data or uninstall the app
• Station notes and favourites can be deleted individually within the app
• All local data is permanently removed when you uninstall Metrou București

AdMob & Analytics data

• Managed by Google per their data-retention policies
• You can reset your Advertising ID at any time via Android Settings
• Declining or resetting consent stops further ad-personalisation and analytics collection

Crash reports

• Stored locally until you delete them or send them via email
• Manageable from Settings → Crash Reporting

Submission checks & notification subscriptions

• Integrity checks on submissions are used once to validate a toilet report and are never stored by us
• Toilet reports themselves stay in the shared data and cannot be withdrawn individually, because they are anonymous and cannot be traced back to whoever submitted them
• The incident notification subscription lasts until you turn those notifications off or uninstall the app

• Location access: grant or revoke in Android Settings → Apps → Metrou București → Permissions
• Ad personalisation & analytics: opt out via Android Settings → Google → Ads, or reset consent inside the app (this disables analytics too)
• Incident notifications: switch on or off in Settings. They are off by default, and switching them off stops delivery
• Crash reports: view, send, or delete individual reports in Settings → Crash Reporting
• All app data: clear via Android Settings → Apps → Metrou București → Storage → Clear Data, or by uninstalling

• All local data is protected by standard Android application sandboxing
• All connections to external services use HTTPS/TLS
• No sensitive personal data (passwords, financial information, health data) is ever collected or stored
• The App does not implement its own user accounts or authentication

We will update this policy when data practices change materially, for example if new third-party services are added. Changes are indicated by the "Last updated" date above. Continued use of the App after the effective date constitutes acceptance.

For data-related questions or requests:

• Email: contact@metroubucuresti.ro
• In-app: Settings → About → Contact
• Website: www.metroubucuresti.ro