Privacy notice

Who is responsible

The controller is the maintainer of transito-analyzer, reachable through the project's GitHub repository (open an issue or use the contact there). The project is a small-scale operator under ANPD Resolution 2/2022, so it has no appointed data protection officer; that channel is the way to exercise your rights.

What is processed and why

Processing is limited to running the service and understanding how it is used in aggregate:

• Operating the service: your browser sends the server the Region you load (a centre and a radius) and the place names you search. The server keeps the built Road Network in a cache for up to 30 days, keyed by the Region, not by who asked. Standard server logs with your IP address are kept for up to 30 days for security and capacity.
• Aggregate usage statistics, under legitimate interest (LGPD art. 7 IX; GDPR art. 6(1)(f)): which pages are viewed, which features are used (a simulation started, warmed up or run for ten minutes; Flows, Signals or the ranking touched; a link copied; the language switched), the radius bucket of a Region (up to 1 km, 1–2 km, over 2 km), how long it took to load and whether it came from the cache, in buckets, and the approximate country. Coordinates, search terms and addresses are never sent to the statistics.
• Running the service rests on the service you request; the statistics rest on our legitimate interest in knowing whether the simulator works and is used. We balanced that interest against your rights by keeping the data cookieless, aggregate and first-party, and by offering the opt-out below.

As the controller we answer for this processing; the hosting and statistics providers act on our instructions as operators, and the map-data providers are independent controllers of the requests they receive.

Usage statistics and opt-out

Statistics are collected with a self-hosted instance of Umami, cookieless: a visit is counted under a hash of your IP address, browser and a salt that changes daily, after which no identifier remains. Reports are aggregate and kept for up to 25 months; nothing is sold, shared with advertisers or combined with other data.

You can turn the statistics off for this browser. The switch stores one flag in your browser's local storage and sends nothing.

Who else receives data

To build and show a Region, data goes to these providers under their own policies:

• Overpass API (Overpass.ch, Switzerland, in production): receives the Region's centre and radius from our server, not your IP address.
• Photon by komoot (Germany): receives the place names you search, from our server.
• Nominatim (OpenStreetMap Foundation, United Kingdom): receives a rounded Region centre once per Region to find its country, from our server.
• OpenFreeMap (Hungary): your browser fetches the base-map tiles directly, so it sees your IP address and the map area you look at, like any map site.
• Our hosting provider stores the server logs and the cache, and the statistics instance runs beside them. Both are placed in Brazil or the European Union, recognised as adequate for transfers in either direction, and no other international transfer takes place; the provider is named here once the deployment is fixed.

Cookies and local storage

The site sets no advertising or tracking cookies. It uses:

• NEXT_LOCALE: a session cookie set when you pick a language that differs from your browser's preference, so the next page opens in it. Functional, deleted when the browser closes.
• umami.disabled: a local-storage flag set only if you opt out of the statistics above. Clear your browser data to remove it.
• The Region, radius and seed live in the page address, not on your device. They end up in your browser history and in our server logs like any address you visit.

Your rights

Under LGPD art. 18 you may ask to confirm whether we process your data, to access, correct, anonymise, block or delete it, to know whom it was shared with, to oppose processing based on legitimate interest (art. 18 §2) and to petition the ANPD. Under GDPR art. 13 and 15–22 you may request access, rectification, erasure, restriction, portability and object to processing, and lodge a complaint with your supervisory authority.

Because visits are counted under a daily hash that cannot be linked back to you, we cannot single out your rows in the statistics; the opt-out above is how to stop them. Requests about server logs or anything else go through the repository contact and are answered within 15 days.

Providing data is not required: the site works without searching, with a Region typed into the address. There is no automated decision-making or profiling.

Changes

This notice changes when the processing changes; the date at the end of the page is the last revision. The notice is available in Portuguese, English and Spanish, and the Portuguese text prevails for Brazilian users.