Kiwimap privacy policy

Effective 14 October 2026

Kiwimap is a live map of Auckland's buses, ferries and planes. This page explains what the app collects, why, and what happens to it. The short version: there are no accounts, no advertising and nothing is sold. The app uses your location only while it is open, and it sends a small amount of technical information so we can keep it working.

Your location

When you allow it, Kiwimap uses your phone's location while the app is open to show the stops nearest you, to find your bus or ferry, and to tell you when to leave. The app never asks for "always" access.

There is one exception, and only when you start it. When you start a trip, the iPhone app keeps using your location while it is in the background, so it can tell when you have boarded, keep the trip card on your Lock Screen up to date and remind you when to get off. Your phone shows the blue location indicator while this is happening. It stops when the trip ends, when you end it, or at the latest 3 hours after you started it (45 minutes after the planned arrival). During the trip your position is sent to our server only to update that trip, and it is not kept as a history of where you have been.

To show departures near you, the app sends your coordinates to our server with the request. Those requests are recorded in the ordinary access logs of our hosting provider for a limited time. The server does not build a history of where you have been, and there is no account to attach it to.

You can turn location off at any time in your phone's Settings. The map still works; it just cannot centre on you.

Technical information about your session

While the app runs it sends short status reports to our server so we can see when it is slow, crashes or shows something wrong. A report contains a random session code, the type of phone and the version of its operating system (iOS or Android), the screen size, which screen of the app is showing, the map camera position, which of the top tabs were pressed, and health figures such as memory use and frame rate. It does not contain your name, contact details or anything typed into the app.

Our hosting provider records the internet address of each request. We use that address to work out roughly where a visit came from (city and internet provider) using public registry lookups, so we can tell real visitors from our own test runs. We do not use it to identify you.

Notifications

Some notifications are scheduled on your phone itself, for example telling you when your stop is coming up while the app is open.

Bus reminders work differently, because they have to reach you when the app is closed. If you set a reminder, your phone generates a push token through Expo's notification service. We store that token on our server alongside the stop and the service you asked to be reminded about, and when your bus is close we send the reminder to Expo, which delivers it to your phone. The token identifies a device, not a person. It carries no name, contact details or location.

Turning notifications off in your phone's Settings stops this. If you would like the stored token deleted, email us and we will remove it.

Services the app relies on

• Mapbox draws the map. Your phone requests map tiles and styles directly from Mapbox, so Mapbox sees the requests and receives map usage statistics under the Mapbox privacy policy. Map data is collected and used under Mapbox's Product Terms, Data Processing Addendum and Privacy Policy.
• Railway hosts our server and keeps its access logs.
• Apple handles the App Store, TestFlight and, if you opted in on your iPhone, crash reports.
• Google handles Google Play on Android and, if you opted in on your phone, crash reports. On Android, bus reminders are passed from Expo to Google's Firebase Cloud Messaging, which delivers them to your phone.
• Expo delivers bus reminders to your phone. It receives the push token and the text of the reminder, under the Expo privacy policy.
• Supabase stores the map's own reference data, such as building models and place records. It holds nothing about you.
• Public transport open data feeds supply the timetable and live vehicle data. Nothing about you is sent to them.
• Planespotters.net supplies aircraft photos. When you open an aircraft, your phone asks Planespotters for its photo, so Planespotters sees that request and your IP address.
• Google Fonts supplies the fonts on some pages. Your phone loads them from Google, so Google sees those requests and your IP address, under the Google privacy policy.
• cdnjs, run by Cloudflare, supplies one code library used on the Buses page. Cloudflare sees that request and your IP address, under the Cloudflare privacy policy.
• Land Information New Zealand (LINZ) supplies the aerial photos when the "Real" view is on. Your phone loads them from LINZ, so LINZ sees those requests.
• NZ Transport Agency Waka Kotahi supplies the speed limits when the motorway signs layer is on. Your phone loads them from the agency, so it sees those requests.

Kiwimap contains no advertising, no analytics kit and no social media components. It does not use the advertising identifier and does not track you across other apps or websites.

How long we keep things

Session reports live in the server's memory for a short time and are copied into our own working records while we are improving the app. Hosting logs are kept for the period set by our hosting provider. If you would like anything removed, email us with the approximate time you used the app and the type of phone, and we will delete what we can find.

Children

Kiwimap is a general transport app and is not directed at children under 13.

Seeing and correcting your information

Under the Privacy Act 2020 you can ask us what personal information we hold about you, and ask us to correct it if it is wrong. Email the address below. Because there are no accounts, the practical way to find anything is to tell us roughly when you used the app and what kind of phone you were on. We will answer within 20 working days. If you are not satisfied you can complain to the Office of the Privacy Commissioner.

Changes

If this policy changes, the new version will appear at this address with a new effective date.

Contact

Our privacy officer is Antony Ross.