Privacy Policy

Effective May 28, 2026

Overview

Stratus Transit ("Stratus," "we," "our") is operated by CloudPath, LLC. We built Stratus with privacy as a core principle. We collect the absolute minimum data needed to show you nearby bus and train departures.

Stratus is available on iOS and Android. This policy covers both apps; where a feature exists on only one platform, we say so.

Location Data

Stratus uses your device's location to find nearby CTA stations and bus stops and calculate travel times. Here's what's important:

  • Location stays on your device. Your GPS coordinates are never transmitted to our servers or any third party.
  • We only request foreground location permission ("When In Use" on iOS, "While using the app" on Android). Stratus never tracks your location in the background.
  • When fetching departure times, we send only the stop or station ID to our API — not your coordinates.
  • You can use Stratus without granting location permission, though nearby stop and station detection will be unavailable.

Data We Collect

Stratus does not collect personally identifiable information (PII). We do not collect your name, email address, phone number, or any account information.

On iOS, your app settings, pinned routes, saved locations, and preferences are stored locally on your device and in your iCloud account (via App Group storage). On Android, the app does not currently support pinned routes or saved locations; your app settings and preferences are stored locally on your device only. In all cases this data stays under your control and we cannot access it.

Arrival Tracking

Arrival tracking is currently available only on iOS. When you tap a departure to track it, Stratus uses a server-side service to keep your lock-screen countdown and departure alarms accurate even while your phone is locked or backgrounded. For each tracked trip, we send to our servers:

  • A random trip identifier generated on your device
  • A route or run identifier, the line or bus pattern, and the boarding and destination stop IDs
  • The push tokens Apple provides for your phone and Live Activity, used only to deliver updates to your device while you're tracking

These records are stored temporarily in our server-side database, automatically deleted when the trip ends, and in any case expire within two hours. We do not combine them with any other data, and none of the fields above identify you as a person. Your GPS coordinates are still never transmitted.

When you stop tracking, the record is deleted immediately.

Crash and Usage Data

We use TelemetryDeck to collect three kinds of fully anonymous data:

  • Anonymous crash reports — so we can find and fix bugs.
  • Anonymous performance signals — session-level counts that help us find bugs.
  • Anonymous product-interaction counts — feature-usage tallies so we know which features actually get used.

TelemetryDeck is a privacy-first analytics provider that:

  • Does not collect or store IP addresses
  • Does not use advertising identifiers
  • Does not create user profiles or track individuals
  • Generates anonymous, aggregated statistics only

No personal information is included in any of these reports.

Third-Party Services

Stratus interacts with the following external services:

  • CTA Train Tracker API (via our cloud API) — to fetch real-time rail departure data. We send station IDs only; no personal data is transmitted.
  • CTA Bus Tracker API (via our cloud API) — to fetch real-time bus departure data. We send stop IDs only; no personal data is transmitted.
  • CTA Service Alerts API (via our cloud API) — to fetch system alerts (delays, reroutes, elevator outages). We send only the line or route identifier needed to scope the request; no personal data is transmitted.
  • Apple StoreKit (iOS only) — to process subscription purchases. All payment information is handled entirely by Apple. We never see or store your payment details. The Android app does not currently offer in-app purchases.
  • TelemetryDeck — anonymous crash and usage data as described above.

Subscriptions

On iOS, Stratus offers optional premium subscriptions managed through the Apple App Store. Payment processing, billing, and subscription management are handled entirely by Apple. CloudPath, LLC does not have access to your payment information. You can manage or cancel your subscription at any time through your device's Settings > Subscriptions. The Android app does not currently offer subscriptions or any in-app purchases.

Children's Privacy

Stratus is intended for general audiences (rated 4+ on the App Store and Everyone on Google Play) and does not knowingly collect any personal information from children. Since we do not collect personal information from any user, there is no age-specific data collection concern.

Your Rights (GDPR and International Users)

If you are located in the European Economic Area, United Kingdom, or other jurisdiction with data protection laws, you have the following rights:

  • Right to access: You can request information about what data we process. Since we do not collect PII, there is no personal data to provide.
  • Right to deletion: You can delete all locally stored app data by uninstalling Stratus from your device.

Legal basis for processing: We process anonymous crash data under legitimate interest (maintaining app stability). No consent is required for anonymized, non-personal data under GDPR.

Data Security

All communication between Stratus and our servers uses HTTPS encryption. Departure data is cached briefly (15 seconds) on our CDN to improve performance and is not stored permanently.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of Stratus after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy, contact us at:
support@ridestratus.com

CloudPath, LLC
Chicago, Illinois