Privacy Policy

1. Who runs this

Odjezdy Online (app.odjezdy.online) is a personal, non-commercial hobby project run by Vlastimil Novotný. For anything privacy-related, contact this address.

2. What data is processed

• Favorite stops. Stored only in your browser's local storage. They're never sent to our server and we never see them.
• IP address. Used briefly, in server memory only, to (a) figure out which country you're browsing from - so vehicle-lookup links point at the right mirror site (see §4) - and (b) basic abuse/rate-limit protection. Not written to any database or log file. The country lookup result is cached in memory for 24 hours per IP and then discarded.
• Push notification subscriptions. If you opt in to delay alerts for a stop, your browser's push subscription (an endpoint URL and public keys - no name, email, or account of any kind) is stored so we know where to send the alert, together with the stop and delay threshold you picked. Kept until you turn notifications off, at which point it's deleted.
• Language preference. A small cookie (i18next) remembers whether you're using the Czech or English interface.
• Standard analytics. Google Analytics (see §4) collects the usual: pages visited, approximate location derived from IP, device/browser type, and engagement events.

There is no user account or login system on this site, so none of the above is tied to an identity beyond a browser/device.

3. Legal basis

Favorite stops and the language cookie are strictly functional and don't need consent. Push notifications are entirely opt-in (consent). IP-based country detection and basic abuse protection rely on legitimate interest in operating the service correctly and safely. Google Analytics runs on the basis of legitimate interest in understanding how the site is used; you can opt out at any time (see §4).

4. Who we share data with

• Google Analytics (GA4). Standard usage analytics. Google may process this data on servers outside the EU under its own safeguards. See Google's Privacy Policy. You can opt out using a browser extension like Google's own Analytics Opt-out, or with an ad/tracker blocker.
• ip-api.com. Your IP address is passed to this third-party geolocation lookup solely to determine your country (see §2). No other data is sent.
• Your browser's push service. If you enable push notifications, delivery goes through your browser vendor's own push infrastructure (e.g. Google, Mozilla, or Apple's push servers) - a standard part of how Web Push works, outside our control.
• CDN providers. Fonts, icons, and some JavaScript libraries are loaded from Google Fonts, cdnjs.cloudflare.com, unpkg.com and cdn.tailwindcss.com. Loading a resource from these means your IP address and browser info reach them, as with any direct web request.
• Transit data providers. We fetch departure/delay/vehicle data from PID (Golemio), DÚK/Portabo, ČD, ARRIVA, DPMD, and regional IDS systems to show you the board or map - this is public transit data, not your personal data, flowing the other way.

5. Your rights

Under GDPR you can ask us to access, correct, or delete data we hold about you, object to processing, or request a copy in a portable format. In practice, that mostly means: tell us your push subscription/stop, and we'll delete it (or just turn notifications off yourself in the app - it deletes the record immediately). You can also lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz).

6. Changes

This policy may be updated as the service changes. Meaningful changes will be reflected here with an updated date at the top.