Privacy Policy
Effective date: 2 November 2026
Who we are
PixBus is developed by THE GROWING COMPANY SL, a company registered in Spain (D-U-N-S 471616639), registered office in Madrid, Spain. For any question about this policy, contact us at privacy@pixbus.co.uk.
What this policy covers
This policy explains how we handle data through:
- The pixbus.co.uk website.
- The PixBus mobile app (iOS and Android).
Data we collect
Through the website (pixbus.co.uk). Today, pixbus.co.uk does not use any analytics, advertising, or tracking cookies. We may collect basic technical server logs (IP address, browser type, date/time of access) generated automatically by our hosting provider, for security and troubleshooting purposes only. These logs are not linked to any individual identity.
Through the PixBus app:
- Location. With your permission, PixBus uses your device's approximate or precise location to show you nearby bus stops ("Nearby stops") and, if you use PixTour, to follow the bus you are riding (see below). To list the stops around you, the app sends your position to Transport for London's public API, which answers with the nearby stops; during a PixTour ride it is processed only on your device. PixBus never sends your location to our servers or keeps a history of it.
- Push notification tokens. If you enable "Follow this bus" or "Arrival alerts", we register a device token so we can send you live updates about a specific bus you chose to follow. On iOS that token is issued by Apple's Push Notification service (APNs); on Android, by Google's Firebase Cloud Messaging (FCM). In both cases it is a device token only: it is not linked to your name, email, or any other identifier — PixBus does not require an account.
- PixTour (the guided tour). While a PixTour ride is open, the app uses your device's precise location to work out which line you are on, in which direction, and which places are in view, and it keeps doing so with the screen locked. On iOS you will see the blue location indicator; on Android, a notification while it lasts. Tracking stops when you close the ride. Your location is processed only on your device: it is not sent to our servers or to anyone else, and no history is kept. The app downloads each line's 3D city and audio from our server; those downloads ask for the line, never for your position.
- Purchases. PixTour passes are bought through the App Store (or Google Play): Apple or Google handle the payment, and we never see your card or your name. To know which pass you hold and to let you restore it, we use RevenueCat, which receives an anonymous identifier created by the app and that identifier's purchase history (product, date and store country).
- Free day by QR code. The QR code is checked on your device. To keep the free day to one per phone, the app stores a marker in the device's keychain; that marker never leaves the phone.
- Usage analytics. We use PostHog, an analytics provider hosted in the EU, to understand app usage (e.g., which stops are viewed). IP geolocation is disabled and IP addresses are discarded at project level; data is pseudonymous.
- No account data. PixBus does not require registration, login, email, or password. We do not collect your name or email through the app.
Legal basis for processing (UK GDPR / EU GDPR)
- Location data: consent (granted through your device's system settings, on iOS or Android).
- Push tokens: consent (you activate follow/alerts) and legitimate interest (providing the feature you requested).
- Analytics: legitimate interest, with data minimised and pseudonymised.
- Location during PixTour: consent (the system location permission), and only while a ride is open.
- Purchases: performance of a contract (giving you the pass you bought).
Who we share data with
- Apple Inc. — solely to deliver push notifications to iOS devices via APNs, under Apple's own privacy terms.
- Google (Firebase Cloud Messaging) — solely to deliver the same push notifications to Android devices, under Google's own privacy terms. Same data as the Apple channel: a device token, not linked to your identity.
- Map data (OpenStreetMap). The stylised map is drawn from OpenStreetMap data. PixBus fetches it from our own server (hosted on Fly.io, London region), which caches each area, so in normal use your device contacts no third-party map service at all. If our server is unavailable, the app falls back to public Overpass API mirrors, all of them operated within the EU (Germany, Austria and France); those mirrors then receive your device's IP address and the map area requested, and nothing else.
- PostHog (EU-hosted instance) — analytics processor.
- Transport for London (TfL) — PixBus queries TfL's public API for live bus arrival data. Those requests carry only stop and line identifiers, except when you ask for nearby stops: that request carries your position, so that TfL can answer with the stops around it. PixBus does not keep that position.
- Google Analytics 4 (Google Ireland Limited / Google LLC) — only on the pixbus.co.uk website, and only if you accept our cookie banner. Used to measure site visits and App Store/Google Play download link interactions. See our Cookie Policy for details on cookies, retention, and international transfer.
- RevenueCat, Inc. (USA) — processor that manages PixTour passes: an anonymous identifier and the purchase history. It does not receive your location or your name.
- Our content server (pixbus.uk), hosted by Dinahosting in Spain — serves PixTour's 3D city and audio. Like any web server, it sees your device's IP address and which file it asks for.
- Apple Maps — on iOS only, and only if a line's 3D city is not available: PixTour then shows Apple's map, and Apple receives the map area being drawn, under its own terms.
- Tower Bridge (towerbridge.org.uk) — PixTour reads its public lift-times page so the bridge lifts at the real times; that page sees your device's IP address, and nothing else.
- We do not sell your data, and we do not use it for ad targeting.
International transfers
THE GROWING COMPANY SL is based in Spain (EU). Where data is processed in or transferred to/from the UK, this relies on the UK's data protection adequacy arrangements with the EU. RevenueCat processes pass data in the United States, under the safeguards the GDPR requires for such transfers (the standard contractual clauses in its data processing agreement).
Data retention
- Push tokens are kept only while a "follow"/"arrival alert" subscription is active, and are deleted when you stop following, disable alerts, or if the token becomes invalid.
- Analytics data is retained for 14 months and is pseudonymised.
- Purchase history is kept as long as needed to give you access to what you bought and to meet our legal obligations.
Your rights
Depending on your location, you may have the right to access, rectify, delete, restrict, or port your data, and to object to processing. Contact privacy@pixbus.co.uk. UK residents may also contact the Information Commissioner's Office (ICO); Spanish/EU residents may contact the Agencia Española de Protección de Datos (AEPD).
Children
PixBus is designed to be easy to use for anyone, including older adults with low digital literacy, but is not directed at children. We do not knowingly collect personal data from children, and the app does not collect names, emails, or account data from any user in any case.
Changes
We may update this policy from time to time. The "Effective date" above reflects the latest revision.
THE GROWING COMPANY SL · Madrid, Spain · D-U-N-S 471616639
privacy@pixbus.co.uk · hello@pixbus.co.uk