Privacy Policy

Who operates the app

The Roaming Bean operates The Roaming Bean app. Privacy questions can be sent to [email protected].

Location

Location access is optional. The web, Android, and iPhone apps use location to sort nearby stops and estimate distance. The Roaming Bean notification service does not receive precise or approximate coordinates. The web app calculates its distance estimates in the browser.

Embedded map tiles and a map or directions app selected by the user may process a viewed map area, destination, or current location under that provider's own privacy policy. The Android app uses OpenFreeMap/MapLibre for its embedded map. The iPhone app uses Apple MapKit. Google Maps and Waze are opened only when selected.

Saved stops and preferences

Saved stop identifiers, menu favorites, reminder choices, map preferences, and interface preferences are stored locally on the device or in browser storage. They are not associated with an account because the app does not provide accounts.

Notifications

The native Android and iPhone apps schedule saved-stop reminders locally on the device. They do not currently upload Firebase or APNs device tokens.

If web notifications are enabled, the browser sends a Web Push subscription endpoint and encryption keys, a random app-generated device ID, a one-way hash of a random device secret, saved-stop reminder details, and notification delivery state to the notification service. These records are used only to schedule, deliver, display, synchronize, and dismiss requested reminders.

Schedule and network requests

The apps download the public weekly schedule from thebeantracker.com. Hosting, security, and notification infrastructure provided by Cloudflare may process network metadata such as IP address, request time, requested path, response status, and user agent. This information is used to deliver and protect the service, troubleshoot failures, and monitor reliability.

Calendar, sharing, maps, social, shop, and payment links

Calendar, sharing, maps, social-media, website, shop, and optional payment links are user-initiated. Information shown in the handoff, such as a stop name, time, address, or destination, is provided to the app or service the user chooses. Those services have their own privacy practices. The Roaming Bean app does not read calendar history or route history.

Analytics, advertising, and tracking

The native apps contain no advertising SDK, cross-app tracking SDK, analytics SDK, or crash-reporting SDK. The app does not sell personal information and does not use personal information for targeted advertising.

Retention and deletion

Local preferences remain until they are removed in the app, browser data is cleared, or the app is uninstalled. Cached schedules are replaced by newer schedules and can be removed by clearing app data or uninstalling.

The Web Push service removes inactive device records after 30 days and removes sent, failed, expired, and notification-history records after 14 days. Invalid or expired push subscriptions are removed when a push provider rejects them. A user can disable web notifications to request removal of that browser's subscription. Infrastructure security logs follow the retention configured in the Cloudflare account.

Because there are no accounts, there is no account-deletion process. A privacy deletion request may be sent to the contact above for server-side notification data that can be identified from information supplied by the requester.

Security and children

Network requests use HTTPS. Notification credentials are validated, rate limited, and stored as hashes where practical. No service can be guaranteed completely secure.

The app is a general-audience schedule utility and is not directed to children under 13. It does not knowingly request a child's name, contact details, or account information.

Changes

This policy may be updated when app behavior, service providers, or legal requirements change. The effective date above will be revised when a material update is published.