Privacy policy

Who is responsible

NYC Express is made by Midware a.s., the controller of the personal data described here:

This policy covers the NYC Express app for iPhone and its web version at nycexpress.app. For this website, see the Midware privacy policy.

Your location

If you allow it, NYC Express uses your device’s location to plan trips from where you are and to show where you are during a trip. The trip is worked out on your device. NYC Express never sends your location to its servers, and we never see it.

When you ask for walking directions or search for an address, the map service needs the start and end points or your search text; see Maps and address search. You can turn location access off at any time in your iPhone’s Settings (Privacy & Security → Location Services → NYC Express) or in your browser, and still plan trips from a station or an address.

Saved trips and settings

Your saved trips, your settings (such as walking speed, appearance and how you travel) and a note that the app has been opened before are stored only on your device. Deleting the app, or clearing the site’s data in your browser, removes them.

Live train and bus information

To show live trains, service alerts and buses, the app asks the NYC Express servers for the latest data. These requests contain no personal information about you. As with any internet service, your device’s IP address is visible to our hosting provider, Cloudflare, when it delivers the data, and Cloudflare keeps short-lived technical logs (such as the time, the address requested and the IP address) for security and to keep the service running.

Usage counts

To know how much NYC Express is used, the app tells our server when it is opened and used, when a trip’s options are shown and when a trip is started, whether it is the iPhone app or the web version, and — once — that it is the first time the app is used on that device. The server only adds these to daily totals. No IP address, device identifier, location or anything else that tells who you are is stored with them.

To stop abuse, the server briefly keeps a one-way hash of the sender’s IP address in memory, to limit how many counts one address can send in an hour. It is never written to storage.

Feedback

In the app’s Settings you can send us feedback. If you do, we store:

• your message;
• your email address, only if you enter one because you would like a reply;
• the app version and your settings (appearance, walking speed, live or replay mode), which help us understand a problem;
• the time it was sent;
• a one-way hash of your IP address, used only to limit how many messages one sender can send in an hour.

We use feedback to answer you and to improve NYC Express. We keep it for as long as we need it for that, and no longer than two years. You can ask us to delete your message at any time.

Maps and address search

On iPhone, address and place search, walking directions and maps come from Apple Maps. When you use them, your search text and the points needed for directions are sent to Apple and handled under Apple’s privacy policy; NYC Express does not receive them.

In the web version, address search uses NYC GeoSearch, a public service of the New York City Department of City Planning, which receives the text you type. Maps and walking directions in the web version come from Apple Maps.

What we don’t do

• No advertising, and no tracking across other companies’ apps or websites.
• No third-party analytics or advertising tools in the app.
• We don’t sell or rent personal data, and we don’t share it with data brokers.
• No account, and no profile of you.

Who processes data for us

Cloudflare, Inc. hosts the NYC Express servers and the database that holds feedback and usage totals. Cloudflare may process data in the United States and other countries; such transfers are covered by the EU–U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses. Apple and NYC Planning provide their map and search services independently, under their own privacy policies.

Legal basis

For people in the European Union and the United Kingdom: we process feedback, usage counts and server logs on the basis of our legitimate interests in answering messages, running and improving the app, and preventing abuse (Article 6(1)(f) GDPR). Your location is processed only on your device, with your permission.

Children

NYC Express is a general-audience app. It does not ask for personal information, and we do not knowingly collect personal data from children.

Your rights

Wherever you live, you can ask us what personal data we hold about you and ask us to correct or delete it. In the EU and the UK you also have the right to restrict or object to processing and to data portability, and you may complain to a data protection authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

Because we don’t know who you are unless you write to us, feedback is the only personal data we can look up: tell us the email address you gave, or the text of your message, and we will reply within one month.

Changes

If we change how NYC Express handles data, we will update this page and the date at the top.

Contact

Email info@midware.cz with “NYC Express privacy” in the subject, or write to Midware a.s., U Bulhara 1655/5, 110 00 Praha 1, Czech Republic.