Kollektivknappen Privacy Policy

1. Controller and contact

Asadi Dev is the controller for personal data used to provide Kollektivknappen, features connected to the physical Kollektivknappen, and kollektivknappen.com.

• Controller: Asadi Dev
• Address: Havnegata 101B, 3040 Drammen, Norway
• Privacy and support email: info@kollektivknappen.com

Contact Kollektivknappen through the contact form — Do not send passwords, sign-in links, codes, precise location, or other secrets.

2. Scope of this policy

This policy applies when you use Kollektivknappen, connect the Kollektivknappen to your phone or use it, visit the website, open an account link, or contact support. It does not cover external websites, app stores, operating systems, or public-transport operators that process information under their own responsibility.

This policy describes the processing and features that apply to Kollektivknappen.

3. Personal data we process

The data processed depends on the features you use and the permissions you grant.

• Account and profile: account ID, email address, system-generated or chosen username, a random default image or a profile photo you choose and crop on your phone (with a smaller version for the map marker), authentication state, time and version of accepted Terms, and necessary security and session data. The uncropped original is not uploaded.
• Installation and notifications: random installation ID, platform, app version, language, permission and subscription state, delivery state, and limited event or navigation references.
• Kollektivknappen and your access: whether an administrator has enabled the feature for the account, which app installation may handle presses, local pairing state on the phone, and necessary event and failure categories. The service does not store the identity of the physical button as an account link.
• Journey information: selected departures or journeys, stop, platform, line, times, Entur identifiers, journey legs, the current onboard journey, consent and audience for optional onboard-status sharing, controlling product and app installation, session generation, completion reason, use of the Kollektivknappen, signal state, and announcements relevant to the journey.
• Location: a fresh device position when a selected feature needs it, together with accuracy and time. Some selected journeys may contain a chosen start point on the device. During an active onboard journey, the service may temporarily store the first and most recently updated phone and vehicle positions.
• Operations, control, and troubleshooting: pseudonymous references to the account, product, installation, and journey generation; timestamps; press type or lifecycle-event type; safe reason code; public line/stop labels; affected journey feature; outcome; failure category; and technical version and timing data. This information does not contain the identity of the physical button, full spoken text, driver messages, or precise coordinates.
• Support and contact form: name, email address, selected language, the content you submit (including a report of an inappropriate username or profile image), and limited technical details such as the time, browser/device type, and IP address for delivery, replies, review of the request, and abuse prevention.
• Website: ordinary technical request information such as IP address, time, browser/device, requested address, and security or delivery status processed by the hosting service.

Kollektivknappen does not ask for diagnoses or health information and does not create an ability profile from whether VoiceOver or TalkBack is active. Use of an accessible product may nevertheless indirectly suggest a possible accessibility need. We do not use this for advertising, profiling, or analytics.

4. Purposes and legal bases

• Contract and steps requested before a contract, GDPR Article 6(1)(b): create and secure an account; provide journey search, Kollektivknappen pairing and help from Kollektivknappen, selected journeys, onboard guidance, signals, announcements, and support that you request.
• Legitimate interests, Article 6(1)(f): protect the account and service, prevent misuse, troubleshoot, maintain operation and security, and deliver a stable, accessible website. The interest is a secure and reliable service using the least data reasonably necessary.
• Consent, Article 6(1)(a): enable optional processing where the interface expressly asks for consent, including registration with the push-notification provider and sharing onboard status with users covered by your sharing choice. Consent can be withdrawn without affecting processing that was lawful before withdrawal. Sharing can be turned off without ending onboard guidance.
• Legal obligation, Article 6(1)(c): process or preserve data where law requires it, for example for valid authority requests or documentation needed for legal claims.

A system permission for location, Bluetooth, or notifications is also a technical control. It does not change the purpose or permit use for another purpose. You can withdraw permissions in the phone settings, but the relevant feature may then stop working.

5. Location

Kollektivknappen may use a fresh position to find nearby stops and departures, use Current location as a journey origin, validate a selected departure or journey, and do what you request with the Kollektivknappen. When Kollektivknappen is ready and the system permits it, the app may obtain fresh positions in the background while following a selected departure, journey, or active guidance. On iPhone, location updates may also continue in the background before you select a departure so the first physical press can use a fresh position without reopening the app. This may use more battery. Positions received while you are not following a journey are not used as journey history.

An old or cached position is not used as a substitute when a feature requires a fresh position. Kollektivknappen does not build a continuous location history. A position may be processed briefly with a selected journey or signal. For onboard guidance, Kollektivknappen may send bounded updates with a fresh position and exact journey and vehicle identity to create, validate, or update the account's onboard status, even when sharing is off. The sharing choice decides whether other people can see that status. During an active onboard journey, the service may temporarily keep the first and most recently updated phone and vehicle positions in the same session instead of storing a point-by-point history. A chosen Current location origin may be stored as part of the time-limited journey on the device.

You control system access in the phone settings. If location is unavailable, Kollektivknappen should explain that the action cannot be completed instead of pretending it knows your position.

6. Kollektivknappen, journeys, and signals

The physical Kollektivknappen can be used only when an administrator has enabled the feature for the account, a compatible button is paired locally with the phone, and an authorised app installation is active. The user can replace the button by forgetting the local connection and pairing another compatible button. The Bluetooth identity of the physical button remains on the phone and is not sent to the service as an account link or usage telemetry.

When you select a departure or journey, the necessary account-bound journey information is stored on the device under that selection's lifecycle rules. A current selected departure has no clock-based expiry and remains until manual ending, exact destination/journey transition, invalid state, or sign-out; planned journeys, legacy selected departures, and short response prompts retain their own safety deadlines. When you use the Kollektivknappen, necessary parts of that journey information and a fresh position may be sent to the service for validation against fresh public-transport data. Raw provider responses are not stored as journey history.

The setting “Show my onboard status on the map” is optional. Onboard status may be created automatically for a selected departure or journey leg when the correct vehicle reaches the selected quay and a fresh phone position is within the boarding area, regardless of the sharing choice. When you choose On, all users with access to the map view can see your username and profile image on the vehicle marker while the service shows you onboard. A location error can create an incorrect status; you can end the selected departure or journey. When sharing is off, other people cannot see your onboard status. Earlier limited sharing choices remain unchanged until you explicitly change them; they are not made public automatically.

You can turn sharing on or off in Settings. Turning it off hides onboard status from other people without ending the selected departure or onboard guidance. Onboard guidance can also start for new journey selections while sharing is off. The onboard session may end automatically when reliable information shows that the journey completed, the vehicle continued with another journey, the vehicle remains absent from successful Entur updates for more than 15 minutes where that rule applies, or passenger tracking becomes stale. A short network interruption or uncertain data alone is not treated as alighting. A linked departure selection reaching its final stop does not delete an exact standard onboard record.

• A boarding or alighting signal uses limited information about the journey, vehicle, stop, and event to reach the correct eligible driver or evaluate how long the signal remains active and its outcome.
• The driver surface does not receive the passenger's name, email address, raw Kollektivknappen identifier, or precise coordinates through the signal.
• A relevant driver announcement may be shown or spoken while you follow the journey onboard. Kollektivknappen does not build a passenger announcement history.

A ready signal or displayed indicator is an aid. It does not prove that a driver has read or acted on the signal and does not guarantee that the vehicle will stop.

7. Notifications

If you enable push notifications, Kollektivknappen uses OneSignal. The provider may process an external account ID, subscription and device identifier, platform, app language, app version, permission and delivery state, and limited event or deep-link data required for delivery.

Core notifications are functional notices about the account, journey, onboard state, or Kollektivknappen. Kollektivknappen does not send precise coordinates, a complete journey, route geometry, stop history, raw Kollektivknappen identifiers, or authentication secrets in push content. Networks, the provider, and the operating system may delay or prevent delivery.

• You can refuse the system permission or withdraw general push registration.
• Notification settings may control available categories but cannot override a refusal by the operating system or provider.
• The persistent Android notification shown while help from Kollektivknappen runs in the background is a system indicator and is separate from push notifications.

8. Data sources, providers, and transfers

We give providers and recipients only the information needed for the relevant task. The following categories apply when the related feature is used:

• Supabase for authentication, database, access control, technical functions, and account services.
• Entur as a source and service for stops, departures, journeys, and fresh public-transport information. Requests may contain stop preferences or coordinates needed for the search, and ordinary network information may accompany the request.
• OneSignal for push notifications when you have enabled them.
• Vercel for hosting and delivery of kollektivknappen.com, including limited technical request and security logs.
• Apple and Google for operating-system permissions, device notifications, and app/account-link handling, and for distribution when the app is published, under their own terms and privacy rules.
• Resend for delivering email about contact requests and sign-in links. The email address, email content, and a secure account link are processed where needed for delivery.
• Other authenticated users with access to the map view may receive limited onboard state, username, and profile image on the relevant vehicle marker when public sharing is selected. Earlier limited sharing choices retain their stored restrictions until the user changes them.

Some providers may process data outside Norway or the EEA. Where we are responsible for the transfer, we use a valid transfer mechanism and necessary supplementary measures, such as an adequacy decision or the European Commission's standard contractual clauses. We do not sell personal data or use Kollektivknappen data for third-party advertising.

9. Device storage and security

Kollektivknappen stores the authentication session, the last email address used for easier sign-in again, a random installation identity, and notification consent in protected device storage. The email address is removed after confirmed account deletion. Selected language, settings for the Kollektivknappen, and lifecycle-bound information about selected departures, journeys, response prompts, and onboard state are stored locally. The official library for the physical Kollektivknappen may keep local pairing information in the app's isolated area.

We use access control, account and installation scoping, encrypted transport, validated data models, limited identifiers, and secure storage where relevant. No digital service can be guaranteed entirely risk-free. Use the contact form if you suspect unauthorised access, but do not include secrets in the message.

Contact Kollektivknappen

If a sign-in session is lost or app data is removed, account-dependent activity stops on this phone. This does not delete the account, administrator-managed account access, the physical Kollektivknappen, or all provider and security records. Local Bluetooth pairing may remain on the phone until the button is forgotten or app data is removed.

10. Retention and deletion

We retain personal data only for as long as the described feature, security, a legal obligation, or a legal claim requires. The following limits and criteria apply:

• Account, profile, Terms acceptance, and Kollektivknappen access remain while the passenger account or relevant access exists. The information is deleted or updated after a valid deletion or access change, except for necessary legal and security records. Local Bluetooth pairing follows the phone's and button provider's local storage and is not a server-stored account link.
• Current selected departures on the device are removed on manual ending, exact destination/journey transition, invalid state, logout, or account change; planned journeys and legacy compatibility selections may also expire under their own deadlines. The active onboard record remains for guidance when sharing is turned off and ends when the onboard session ends. The latest minimized synchronization state, session generation, and completion reason may remain and be replaced by later state while the account and feature continue, so an old request cannot restore an ended session. A fresh location sample is not stored as a continuous location history. Temporary location information associated with an active onboard journey is deleted with the onboard record when onboard state ends.
• Private product-, installation-, and generation-bound speech notices for ended or invalid selected departures and automatic offboarding remain for no more than 24 hours with event type, safe reason code, public labels, and delivery state. They contain no coordinates, raw Kollektivknappen identifiers, credentials, or full spoken text. Hashed control state distinguishing existing, passed, or pending boarding readiness from confirmed absence remains for no more than 48 hours. Short-lived departure browsing may store an opaque candidate token, revision, and speech-completion, response-deadline, and resolution timestamps.
• An active signal event has a safety limit of no more than 15 minutes. Detailed active rows and any notification dispatch are cleaned up shortly after completion or expiry. Minimized, coordinate-free lifecycle summaries may remain for up to 90 days; some pseudonymous duplicate-prevention data remains for no more than 24 hours.
• Pseudonymous events used for operations, support, and troubleshooting are automatically deleted after 90 days. They do not contain precise or rounded user or vehicle coordinates, spoken or notification text, driver messages, raw Kollektivknappen identifiers, access tokens, or screen-reader state.
• Notification preferences and current installation state remain until changed, replaced, the installation is disabled, or the account is deleted. OneSignal and operating-system providers also apply their documented retention rules.
• Support correspondence and security records remain until the matter is resolved and for as long as needed for follow-up, misuse prevention, legal duties, or claims. Technical website logs follow the hosting service's configured, limited log window.

Use the contact form to request deletion of the passenger account, access, correction, or export. We may ask for information needed to verify your identity before handling the request.

Open the contact form

11. Your rights

Depending on the processing and the legal conditions, you may request information and access, correction, erasure, restriction, or portability, or object to processing based on legitimate interests. You may withdraw consent where consent is the basis, and you may complain to the Norwegian Data Protection Authority.

• Describe the account and right your request concerns.
• We respond without undue delay and normally within one month. The law may allow an extension for complex or numerous requests.
• A right may have exceptions, for example where retention is needed for a legal duty, security, or a legal claim. We explain any refusal.
• A valid request for permanent deletion removes the passenger account and linked data, except where lawful retention remains necessary.

Send a privacy request

Complain to the Norwegian Data Protection Authority — You may contact us first, but this is not required before making a complaint.

12. Website and secure account links

The Kollektivknappen website does not use analytics, advertising pixels, or tracking cookies. When you submit the contact form, your name, email address, message, selected language, and limited technical request information are used to deliver the request, send an acknowledgement email, and prevent abuse. The request itself is not stored in a separate database, but is processed by email and operations providers as described elsewhere in this policy. Language is part of the URL and does not require a tracking profile.

At /auth/callback, the browser checks the format of the sign-in link and attempts to open the app. Depending on the link type, the authentication service verifies it before handoff, or the app redeems it after handoff. The page removes the query and fragment from visible browser history and does not display account credentials. The hosting service may still receive ordinary request information, and the email or operating-system provider may process the link under its own rules.

Do not forward an account link. Request a new link in the app if it is invalid, expired, used, or opened on the wrong device.

13. Changes to this policy

When processing or legal requirements change, we update this policy, its document version, and effective date. Material changes will be communicated clearly before taking effect where the law requires it.

The current Norwegian and English versions are published from the same Kollektivknappen source to the app and website. If a linguistic ambiguity arises, the texts should be read to provide the same privacy protection. Use the contact form to request clarification.

Open the contact form