Privacy

This site

No cookies, no analytics, no third-party requests. The fonts, the network data and the planner are all served from this domain.

Planning a journey happens in your browser. The page downloads the metro network once and works out the route on your phone, so the stations you look up are never sent anywhere — there is no server here to send them to, only static files.

Your recent stations and journeys are kept in your browser’s own storage so the box can offer them again. They stay on your device, and clearing site data removes them. The station names in the address bar are part of the link, so a journey you share is a journey the person you sent it to can open.

Cloudflare serves these files and keeps server logs, including IP addresses, as any web host does. Those are Cloudflare’s and I never see them.

The Android app

The app declares INTERNET only in order to remove it, so the permission is stripped out of the finished app even if a library asks for it. On this build that permission is removed, and so is ACCESS_NETWORK_STATE. The app has no network code and no server to talk to; timetable and fare data ship inside the download.

There is no account and no sign-in. There is no crash reporter, no usage measurement and no advertising code.

If you start live tracking, the app asks for location so it can tell where you are on the line, and stops when you arrive. It never asks for background location. Position data is used and stored on the phone and, by the paragraph above, cannot leave it. Settings has a button that clears it.

Changes

If any of this stops being true it changes here first. Questions go to the person who wrote it — see About.