Privacy Policy — BAAS

Developer: Milk Krate App: BAAS (iOS and Android) Effective date: 24 July 2026 Last updated: 24 July 2026

1. Summary

• No account, no personal profile. No email, phone number, password, or login. Nothing to sign into.
• On‑device first. Your places, routine trips, schedules, favorites, trip log, savings goal, and settings live only on your phone.
• Proxy to government APIs. Bus times, timetables, and routes come from Singapore’s LTA DataMall and OneMap, reached through our server, which does not store your requests as personal data.
• One temporary identifier. If you tap the bell to get a server‑sent bus‑arrival alert, a temporary Expo push token is stored just long enough to deliver that alert (auto‑expires within 30 minutes).
• No selling of data, no advertising. We do not sell your data or use it for ads.

2. Data Collection Summary

This table maps each type of data to its purpose, where it goes, and how long it is kept. It is aligned to the Apple App Privacy and Google Play Data Safety categories to make store disclosures straightforward.

We collect no advertising identifiers, contacts, photos, health, financial, or biometric data, and we do not track you across other apps or websites.

Some limited data we or our providers process — such as your IP address (received by Sentry), the anonymous device‑generated IDs used for crash and analytics, and masked session replays — may be considered personal data under laws such as the GDPR, even though it is not linked to your name or account. We minimize this data, keep it separate from your on‑device commute contents, and never use it to build a personal profile.

3. Information Stored on Your Device

The following is saved locally on your phone (in the app’s on‑device storage) and is never sent to any server:

• Places — the emoji, name, and (if you add one) location for each place, including home/work. A place location may include latitude/longitude and, if you searched for it, an address and postal code, plus any bus stops you pin to that place.
• Routine trips — a boarding stop, preferred bus services, departure schedules, and optional references to your saved “from”/“to” places.
• Favorite bus stops
• Trip log — the transport mode, estimated cost, and timestamp of each logged trip (capped at 500 entries).
• Savings goal and your estimated average Grab cost.
• Settings — notification, alight‑alert, and Commute Saver preferences.
• Local flags — anonymous on‑device state such as whether you’ve finished onboarding, and short‑lived records that prevent duplicate notifications and alerts (these auto‑expire within a few minutes).

This data stays entirely on your device. Uninstalling the app, or using the reset option in Settings, deletes it.

4. Information Sent to Our Server

Our backend acts as a stateless proxy for Singapore government transport APIs. It forwards your request, returns the answer, and does not persist these requests as personal data.

What we don’t send: no names, emails, phone numbers, or account identifiers (there are none). Bus arrival results may be briefly cached on our server to reduce load on LTA — this cache contains bus timing data only, no personal data.

External services reached through the proxy:

• LTA DataMall (datamall2.mytransport.sg) — live bus arrivals; receives bus stop codes only, no personal data.
• OneMap (onemap.gov.sg, a Singapore government service) — address search, geocoding, and route comparison; receives the search text, postal codes, or Compare coordinates described above.

5. Bus‑Arrival Push Alerts (server‑sent)

Most alerts in BAAS are generated on your device (see Section 10). One feature is different: when you tap the bell on a bus stop to be notified before a specific bus arrives, we set up a server‑sent push alert so it can reach you even if the app is closed.

• Your device generates an Expo push token — an anonymous delivery address for push notifications, not your identity.
• The app sends that token plus the alert details to our backend, which stores a single record (hosted in Singapore) containing: the push token, the stop code, stop name, bus number, your chosen threshold in minutes, and timestamps.
• Our backend checks live arrivals and, when your bus is near, sends the push through Expo’s push service to Apple (APNs) or Google (FCM), which delivers it to your phone.
• The record auto‑deletes as soon as the alert fires or when it expires — typically within 30 minutes. We do not keep a history of your alerts.

By contrast, alight alerts (“your stop is coming up”) and departure reminders are entirely on‑device and involve no server or push token (see Sections 6 and 10).

6. Location Data

BAAS uses location for a few specific commute features. The permission purpose strings shown to you are:

• When‑in‑use (iOS NSLocationWhenInUseUsageDescription): “Your location helps calculate commute cost comparisons and notify you when your stop is approaching.”
• Always / Background (iOS NSLocationAlwaysAndWhenInUseUsageDescription, and the Android background‑location prompt): “Your location is used to notify you when your bus stop is approaching, even when the app is closed.”

On iOS the app declares the location background mode. On Android it requests ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION, and ACCESS_BACKGROUND_LOCATION (plus SCHEDULE_EXACT_ALARM for timely reminders).

How your location is actually used:

• On your device only (never sent to us):
  • Alight alerts — an on‑device geofence buzzes you roughly one stop before your chosen alight point. This can run while the app is closed, which is why background location is requested. It fires once and clears itself.
  • Nearby bus stops — when you add a place or use “current location,” the nearest stops are computed on your device; only the resulting stop codes (not your coordinates) are used to fetch arrival times.
• Sent to our server only on the Compare tab: the map coordinates for your origin/destination are sent to OneMap (through our proxy) to compare driving vs public‑transport routes. These coordinates are used to answer the request and are not stored as personal data.

You can decline location and still use BAAS — you can search for bus stops by code or name instead. Alight alerts simply won’t be available without location permission.

7. Crash Reporting — Sentry

We use Sentry to diagnose crashes, in production builds only (fully disabled in development).

What Sentry receives:

• Error messages and stack traces
• Device information (model, OS version)
• Your IP address (Sentry’s default diagnostics include this)
• Session replay: roughly 10% of normal sessions and 100% of sessions where an error occurs, captured as a reconstructed screen recording with all text masked

What Sentry does not receive: no account or personal identity (there is none), and no commute contents such as your routine trips, places, or trip log.

Data region: European Union (Germany).

These sampling rates and retention periods reflect current settings and may change.

8. Product Analytics — PostHog

We use PostHog for anonymous product analytics, in production builds only.

What PostHog receives:

• An anonymous, device‑generated ID (not linked to any identity)
• Event names and non‑identifying properties — for example counts, a transport mode, or the name of a setting that changed. Representative events include: onboarding started/completed, place created/deleted, routine created/deleted, bus arrival checked, alight alert created/fired, Compare tab used, trip logged, blocker enabled/disabled, notification enabled/disabled, and settings changed.
• Autocapture of screen views, taps/touches (used for aggregate heatmaps), and app lifecycle events (opened/backgrounded)

What PostHog does not receive: no names, emails, or phone numbers; no location; and no bus stop codes, route details, or trip contents.

Data region: European Union.

You can request deletion of your anonymous analytics data by emailing us (see Contact).

9. Commute Saver

Commute Saver is an optional feature that discourages you from opening ride‑hailing apps (such as Grab, TADA, GoJek, Zig) during commute hours, nudging you toward public transport. Everything about this feature stays on your device — no blocking activity, app selection, or usage data is ever sent to us or any third party.

iOS — Screen Time

• Uses Apple’s FamilyControls / Screen Time framework to restrict apps you choose.
• BAAS stores only opaque tokens representing your selection — it cannot see or decode which specific apps you picked.
• Those tokens are stored on your device only.

Android — Accessibility Service

• Uses an AccessibilityService that listens only for the “window state changed” event to notice when a blocked app comes to the foreground, then shows a full‑screen reminder.
• It does not read your screen contents, text, form fields, or notifications.
• Supporting permissions cover the overlay reminder, detecting app launches, keeping the reminder service running, showing notifications, and timing the commute window.
• Your blocked‑app list and settings are stored on your device only.

10. Notifications

BAAS sends two kinds of notifications:

• On‑device (local) notifications — alight alerts (“your stop is coming up”) and departure reminders are composed and scheduled entirely on your phone. No server or push token is involved.
• Server‑sent push — only the bus‑arrival bell alert described in Section 5 uses a push token and our backend.

You can control notifications in the app’s Settings and in your OS settings at any time.

11. Data Retention

• On your device — kept until you uninstall the app or use the reset option in Settings.
• Our server — your proxied requests are not stored as personal data; live bus results may be briefly cached (transient, no personal data).
• Bus‑arrival alert subscriptions — deleted as soon as the alert fires or expires, typically within 30 minutes.
• Sentry — crash data retained per Sentry’s default policy (about 90 days).
• PostHog — anonymous event data retained until you request deletion.

12. Security

We use reasonable technical and organizational measures to protect the limited data we handle. Traffic between the app, our backend, and third‑party services uses encrypted connections (HTTPS/TLS). Your commute contents stay on your device and are never transmitted to us; our proxy is stateless and does not persist your requests as personal data. Our processors (Sentry, PostHog) maintain their own security programs. No method of transmission or storage is completely secure, but we work to protect your information and will handle any incident.

13. Cross‑Border Data Transfers

Your on‑device data never leaves your phone, and the Singapore government APIs we proxy (LTA DataMall, OneMap) are located in Singapore. Some limited operational data is processed outside Singapore by our providers:

• Sentry (crash diagnostics, incl. IP address and masked replay) — European Union (Germany).
• PostHog (anonymous analytics) — European Union.
• Push delivery — bus‑arrival push tokens are passed to Apple (APNs) and Google (FCM), which may process them in the United States or other regions, solely to deliver the notification.

14. Children’s Privacy

BAAS is not directed at children under 13, and it does not include any framework for collecting personal information from children. Because the app has no accounts and does not collect personal identity, the only data that could relate to a user is the limited, minimized operational data described in Section 2 — never used to profile anyone.

15. Your Choices and Rights

• Decline location — the app still works; search stops by code or name.
• Turn features on/off — notifications, alight alerts, and Commute Saver are all optional and controlled in Settings.
• Reset your data — the reset option in Settings clears your on‑device data.
• Analytics is production‑only and anonymous — to request deletion of your anonymous analytics data, email us.
• Consent and control — crash reporting and analytics run in production builds only; you can ask us to stop processing your device’s diagnostic/analytics data by contacting us.

16. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Continued use of the app after an update constitutes acceptance of the revised policy.

17. Contact Us

Questions about this policy? Email us at hello@mlkkrt.com