BusBus NYC Privacy Policy

Effective October 29, 2026

This policy covers BusBus NYC for iPhone, iPad and Android, made by MGS Technologies LLC. It explains what the app collects, where it goes and what you can do about it. The two versions mostly work the same way. Where they differ, this page says so.

Your location

• When it's used. On iPhone and iPad, the app asks for your location the first time the map opens. On Android, it asks when you tap Find Me, and approximate location is enough. Either way, BusBus uses your location only while it's open, and never asks for it in the background.
• What it's used for. To show you on the map, move the map to you when it opens or when you tap Find Me, and show how far a bus or stop is from you, and to show the saved stop nearest you on the My Stops card and list bunched buses nearest you first.
• Where it goes. Your location itself isn't sent to us. But when the map is centered on you, the middle of the map is your location, and that point is sent to our server to find nearby buses (see below).
• Without it. BusBus works without location access. The map starts at Columbus Circle and you can move it anywhere.

Finding buses: what goes to our server

Bus positions, routes, stops and service advisories come from the MTA's Bus Time service. Our server fetches them from the MTA, and the app asks our server for them. The app doesn't send the MTA anything about you.

While the map is open, the app asks our server for buses about every half minute, when you move the map or change what it shows, and when new data is ready. On Android, a My Stops widget on your home screen also asks for its stops about every 15 minutes, when you add, set up or refresh a widget, when you change your saved stops, and each time Android starts the app or updates its widgets, including in the background, for example to deliver a refresh message. These requests contain:

• The latitude and longitude of the middle of the map. In Route mode and for My Stops (and the My Stops widget on Android), the app asks for the buses on the line instead, and sends points along the route, or the location of each stop you've saved or opened, only if that request doesn't work.
• The bus lines you've chosen to show, and the route or line you open.
• A Firebase App Check token, which shows the request came from a real copy of BusBus. It uses Apple's App Attest on iPhone and iPad, and Google Play Integrity on Android. The token doesn't identify you.
• The app's version and your device's operating-system version, in the standard header every app sends. It doesn't include your device model or any identifier. On iPhone and iPad, the system also adds a language header based on your language settings.
• Your IP address, as with any connection to the internet.

The server doesn't store any of this in its database, which holds only transit data from the MTA, and it doesn't link requests to a person or device. The server runs on Google Cloud, which keeps a log of the requests it receives (the address requested, which includes the point sent: the middle of the map, a point along a route or a stop's location, plus the IP address, the app and operating-system versions from the request header, and the time) for 30 days. We use these logs only to run the service, fix problems and protect it from abuse. To limit abuse, the server may also count requests from each IP address for a minute at a time, and log an address that sends too many. It also logs requests that don't pass the App Check check, without the IP address. These entries say what was requested, without the point, and include the app and operating-system versions from the request header.

Ads

BusBus shows a banner ad and a few native ads (in the bus details and in the Advisories list). The ads come from Google AdMob. No other ad network serves them. On iPhone, iPad and Android, ads are limited to content suitable for general audiences.

• What Google receives. When the app loads an ad, Google AdMob receives information about your device and the ad request, such as your IP address, the device type, operating-system and app version, and how you interact with the ad. The ads software also keeps an identifier of its own for BusBus on your device and sends it with ad requests. Google uses this to choose ads, measure them, and prevent fraud. The app doesn't give Google your location for ads, but Google may work out your general area from your IP address.
• iPhone and iPad. The app never asks for permission to track you, so Google can't use your device's advertising identifier. Google may still choose ads using the information in the ad request, as its policies allow.
• Android. Google can use your device's advertising ID unless you've deleted it, so ads may be personalized to your interests, unless you decline in the consent message described below. Google's ads software may also use Android's app set ID, which is the same only across apps from the same developer. On devices with Android's Privacy Sandbox, Google's ads software may also use the ad topics Android provides, and Google's ads and analytics software may use Android's ad measurement.
• Advertising partners. No other ad network serves the ads, but an ad Google shows can come with measurement by the advertiser's own ad companies. In the European Economic Area, the UK and Switzerland, these are limited to the partners listed in the consent message, and follow your choices there.

Google's handling of this information is covered by Google's privacy policy. Google explains how it uses information from apps that use its services and how it uses information for advertising.

Consent for ads and analytics

• European Economic Area, UK and Switzerland. If you use BusBus NYC there, the app shows a consent message from Google's User Messaging Platform the first time you open it, before any ads load. You can agree, decline, or choose by purpose and by partner. Your choices are stored on your device in the IAB Transparency & Consent Framework format. They control whether Google AdMob can show personalized ads, and whether Google Analytics for Firebase can store analytics data on your device and use your data for advertising. Until you choose, analytics and ad storage are turned off. If you decline, ads may still appear but aren't personalized.
• US states with privacy laws. If you live in a US state whose privacy law gives you the right to opt out of the sale or sharing of personal information for ads, Settings › Privacy › Privacy Settings in BusBus opens Google's message for doing that. No message is shown when the app opens. If you opt out, Google limits how it uses your information for ads, and BusBus tells Google Analytics for Firebase not to use your information for advertising or to personalize ads.
• Everywhere else. No consent message is shown.
• Checking whether a message applies. Each time BusBus starts, Google's User Messaging Platform checks with Google whether a consent message applies where you are. Google receives your IP address and basic information about your device and the app for this. It happens wherever you are, including when you've bought Ad Free.
• Changing your choice. You can change or withdraw your choice at any time in the app under Settings › Privacy › Privacy Settings. The row appears wherever one of these messages applies.
• BusBus Ad Free. Ad Free removes the ads, but the consent message still covers analytics.

Analytics and crash reports

BusBus uses Google Firebase to understand how the app is used and to find and fix problems.

• Firebase Analytics records when you open the bus details, a stop, My Stops and the bus filter, along with the standard events Firebase collects on its own, such as the first time the app opens, app sessions, the screens you view, app updates and in-app purchases. Each event comes with your device model, operating-system and app version, language, and a general region worked out from your IP address. Firebase gives each installation of the app a random identifier. The app doesn't give Analytics a user ID or any other identifier of its own. On Android, Firebase may also receive your device's advertising ID unless you've deleted it. Analytics can also tell Google which ad, if any, led to the app being installed: on Android from Google Play's install referrer, and on iPhone and iPad through Google's on-device conversion measurement.
• Firebase Crashlytics sends a report when the app crashes: what the app was doing in its code, your device model, operating-system and app version, and details such as free memory and storage, with a random identifier for this installation of the app. A crash report can also include the last few Analytics events, such as which screens you opened. Crashlytics also notes each time a session of the app starts, with the same identifier and details such as your device model and operating-system version, so we can see what share of sessions crash. On Android, it also sends a report when something goes wrong without a crash, such as a request that failed or data the app couldn't read. On Android, reports include short notes the app writes about problems, such as which bus line it was loading.
• Firebase Remote Config lets us adjust settings such as how often the map refreshes, without an app update. The app checks for new settings when it starts, at most once every 12 hours. With each check, Google receives the random identifier Firebase gives this installation of the app, the app and operating-system versions, your device's language, region and time-zone settings, and when the app was first opened.

We use this information only to understand which features are used and to improve the app. Unless you decline in the consent message, or opt out in Privacy Settings where it's offered, Google may also use Analytics data for its advertising services, such as measuring ads and personalizing them. In the European Economic Area, the UK and Switzerland, your choices in the consent message control how Firebase Analytics stores and uses data (see above). Otherwise, there's no setting in the app to turn analytics off, and crash reporting can't be turned off anywhere. Firebase's handling of this data is described in Privacy and Security in Firebase.

Refresh messages

Each time new bus data is ready, our server sends one message through Firebase Cloud Messaging to every copy of BusBus at once, so an open map can refresh right away. To receive these, the app signs up with Firebase, which gives your device a token for it. Signing up sends Google the same random identifier for this installation, the app and operating-system versions, and your device model and, on Android, its brand. On iPhone and iPad it also sends your language and time zone, and a device ID that Google assigns for Cloud Messaging.

• Our server never receives the token, keeps no list of devices, and doesn't know who receives the messages.
• BusBus doesn't send alerts about your stops or routes, and stores no stops, routes or schedules on our server for you.
• On iPhone and iPad, the app asks permission to show notifications the first time it opens, but it doesn't show any. The refresh messages work without that permission. On Android, the app doesn't ask for permission to show notifications.

Your saved stops and filters

The stops you save in My Stops, your bus filter and your filter sets are kept on your device.

• iPhone and iPad. Your saved stops and filter sets sync to your other Apple devices through your iCloud account. Apple stores them, and we can't see them. The bus filter you're using right now stays on the device.
• Android. If Android backup is turned on, your settings, bus filter, filter sets, saved stops, the lines you've seen recently and the counts used to decide when to ask for a rating are included in your device's backup to your Google account, so they can return when you set up a new phone. The same things are copied if you transfer your data directly from your old phone to a new one, even with backup turned off. The identifiers kept by Firebase and the ads SDK aren't backed up or transferred.

BusBus Ad Free

On iPhone and iPad, BusBus Ad Free is a one-time in-app purchase that removes the ads. Apple handles the purchase and payment, and we never see your payment details or your Apple Account. The app learns only whether your Apple Account owns Ad Free, and remembers that on your device. Ad Free stops the ads. It doesn't change the analytics, crash reports or requests to our server described above, and the consent message still appears where it applies.

Ad Free can't be bought in the Android app at this time.

Support emails

• iPhone and iPad. Email Support opens a new email in Mail, without leaving the app, addressed to busbus-support@mgsapps.com. It fills in the app version and build, the iOS version and your device's model, such as iPhone18,1. Nothing is attached.
• Android. Email Support opens a new email in your email app, addressed to busbus-support@mgsapps.com. It fills in the app version and build, the Android version, and the device maker and model. Nothing is attached.

Nothing is sent until you send the email yourself, and you can delete any of it first. We use it only to answer your request.

Links, maps and sharing

• Maps. On iPhone and iPad, the map is provided by Apple Maps. On Android, it's provided by Google Maps, and your location on the map comes from Google Play services. Apple and Google serve the map for the area you're looking at.
• Walking directions. Asking for walking directions to a stop opens Apple Maps, or on Android Google Maps (or another maps app if Google Maps isn't installed), with the stop's location.
• Web pages. BusBus Help, Privacy Policy and MTA Bus Time open those websites in an in-app browser. Our help and privacy pages at www.mgsapps.com don't use analytics or cookies. The help pages link to our homepage, which uses Google Analytics to count visits and sets cookies. Each other website's own privacy policy applies.
• Sharing and copying. When you share a bus, or copy its details or an advisory, the app passes them to the app you choose or to your clipboard. A shared bus picture includes how far the bus is from you and the walk time, if BusBus can use your location. On Android, the last picture you shared of each bus stays in the app's cache until Android clears it. It doesn't read your clipboard.
• Ratings. The app counts how often it's opened, on your device, to decide when to ask for a rating. The rating prompt is shown by Apple or Google Play. Rate BusBus in Settings opens BusBus's page in the App Store or Google Play.

What stays on your device

The app keeps your settings and colors, your bus filter and filter sets, your saved stops, the lines you've seen recently, copies of route data so the app starts quickly, the rating counts, your choices in the consent message, which Google's software also sends to Google with ad and analytics requests, and, on iPhone and iPad, whether Ad Free was bought. On Android, it also keeps what each My Stops widget should show, shortcuts to your saved stops, and the bus pictures you've shared. Apart from what the app sends our server to find buses, such as the lines you show and, sometimes, the location of a saved stop, what you open in Maps or share, the syncing and backups described above, and your iPhone or iPad's own iCloud or computer backup if you use one, none of this leaves your device. Deleting the app removes it.

Who receives information

We don't sell your information. We share it only with the companies that provide the services described above:

• Google, for ads (AdMob), Firebase (Analytics, Crashlytics, Remote Config, Cloud Messaging and App Check), Google Cloud, which runs our server, and, on Android, Google Maps, Google Play services and Google Play. See Google's privacy policy.
• Apple, for iCloud sync, App Attest, delivering refresh messages through Apple's push service, Apple Maps and in-app purchases on iPhone and iPad. See Apple's privacy policy.
• The MTA provides the bus data. It receives nothing about you from BusBus. If you open MTA Bus Time from the app, the MTA's privacy policy covers your visit.

Letting Google use information from the app to personalize ads may count as "selling" or "sharing" personal information, or "targeted advertising", under some US state privacy laws. Where those laws apply, you can opt out in Settings › Privacy › Privacy Settings. On Android, you can also delete your advertising ID (see below). We may also disclose information if the law requires it.

Your choices

• Location. You can allow or turn off location access at any time in Settings › Privacy › Location Access in BusBus, which opens the app's page in your device's settings. On iPhone and iPad you can also turn off Precise Location there.
• Consent and privacy settings. In the European Economic Area, the UK, Switzerland and US states with privacy laws, Settings › Privacy › Privacy Settings in BusBus lets you change or withdraw your choices about ads and analytics.
• Ads and tracking. On iPhone and iPad, BusBus never asks to track you, and BusBus Ad Free removes the ads. On Android, you can delete or reset your advertising ID in your device's settings (usually Settings › Privacy › Ads, or Settings › Google › Ads), and turn off Ad topics and Ad measurement under Ad privacy there.
• Notifications. On iPhone and iPad you can turn off notifications for BusBus NYC in the Settings app. BusBus doesn't show notifications either way.
• Analytics and crash reports. Outside the European Economic Area, the UK and Switzerland, analytics can't be turned off in the app. Crash reports can't be turned off in the app anywhere. Deleting the app stops them.
• Sync and backup. To remove saved stops and filter sets from iCloud, delete them in the app on any of your devices. Deleting the app doesn't remove the iCloud copy. On Android, you can turn off backup in your device's settings. A direct transfer to a new phone still copies them.

How long information is kept

• Our server's request logs: 30 days, then deleted.
• Firebase Analytics: event data tied to an identifier is kept for up to 14 months. Reports that combine many users can be kept longer.
• Crashlytics: crash reports are kept for 90 days.
• Ads: Google keeps ad data according to its own policies.
• Emails you send us: kept for as long as needed to answer you and follow up.
• On your device, in iCloud and in Android backups: until you delete it.

Because we don't link our server's records to a person, we usually can't find the data that came from a particular phone. Depending on where you live, you may have the right to ask what information we hold about you, or to have it deleted. Write to us at the address below and we'll do what we can, including asking Google to delete data it holds for us.

Children

BusBus is made for a general audience of bus riders, not for children, and we don't knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us and we'll delete it.

Changes to this policy

If BusBus starts handling information differently, this page will be updated first, with a new effective date at the top.

Contact

Questions about this policy or about BusBus's handling of information can be sent to MGS Technologies LLC at busbus-privacy-policy@mgsapps.com.