Privacy Policy

Effective August 19, 2026

Overview

Stratus Transit ("Stratus," "we," "our") is operated by CloudPath, LLC. We built Stratus with privacy as a core principle. We collect the absolute minimum data needed to show you nearby bus and train departures.

Stratus is currently available on iOS.

Location Data

Stratus uses your device's location to find nearby CTA stations and bus stops, Metra stations, and calculate travel times. Here's what's important:

  • Location stays on your device. Your GPS coordinates are never transmitted to our servers or any third party.
  • We only request foreground location permission ("When In Use"). Stratus never tracks your location in the background.
  • When fetching departure times, we send only the stop or station ID to our API — not your coordinates.
  • You can use Stratus without granting location permission, though nearby stop and station detection will be unavailable.

Data We Collect

Stratus does not collect personally identifiable information (PII). We do not collect your name, email address, phone number, or any account information.

Your app settings, favorites, and preferences are stored locally on your device and in your iCloud account (via App Group storage). This data stays under your control and we cannot access it.

Arrival Tracking

When you tap a departure to track it, Stratus uses a server-side service to keep your lock-screen countdown and departure alarms accurate even while your phone is locked or backgrounded. For each tracked trip, we send to our servers:

  • A random trip identifier generated on your device
  • A route or run identifier, the line or bus pattern, and the boarding and destination stop IDs
  • The push tokens Apple provides for your phone and Live Activity, used only to deliver updates to your device while you're tracking

These records are stored temporarily in our server-side database, automatically deleted when the trip ends, and in any case expire within two hours. We do not combine them with any other data, and none of the fields above identify you as a person. Your GPS coordinates are still never transmitted.

When you stop tracking, the record is deleted immediately.

Trip Sharing

Trip sharing is optional and off unless you start it. When you share a trip, Stratus creates a link with a random token in it. Anyone who opens that link sees a live page showing the line you are riding, the vehicle's position on a map, the stops remaining, and the stop where you are getting off. They do not need the app, and they do not need an account.

The page does not show your location. The position on the map is the vehicle's, reported by CTA or Metra — your GPS coordinates are never transmitted, when sharing or at any other time. The page carries no name, email, phone number, or any other identifier, because we do not hold any.

Treat the link as you would any link: whoever has it can watch the trip, including where you get off. You can stop sharing at any time, which deletes the record and leaves anyone holding the link with a page reading “This trip has ended.” A share link also stops working on its own two hours after you start sharing, whether or not you stop it yourself. Sharing the same trip again extends that two hours from the moment you share.

Crash and Usage Data

We use TelemetryDeck to collect three kinds of fully anonymous data:

  • Anonymous crash reports — so we can find and fix bugs.
  • Anonymous performance signals — session-level counts that help us find bugs.
  • Anonymous product-interaction counts — feature-usage tallies so we know which features actually get used.

TelemetryDeck is a privacy-first analytics provider that:

  • Does not collect or store IP addresses
  • Does not use advertising identifiers
  • Does not create user profiles or track individuals
  • Generates anonymous, aggregated statistics only

No personal information is included in any of these reports.

Third-Party Services

Stratus interacts with the following external services:

  • CTA Train Tracker API (via our cloud API) — to fetch real-time rail departure data. We send station IDs only; no personal data is transmitted.
  • CTA Bus Tracker API (via our cloud API) — to fetch real-time bus departure data. We send stop IDs only; no personal data is transmitted.
  • CTA Service Alerts API (via our cloud API) — to fetch system alerts (delays, reroutes, elevator outages). We send only the line or route identifier needed to scope the request; no personal data is transmitted.
  • Metra GTFS Realtime API (via our cloud API) — to fetch real-time Metra commuter rail schedule and trip data. We send station or trip identifiers only; no personal data is transmitted.
  • Apple StoreKit — to process subscription purchases. All payment information is handled entirely by Apple. We never see or store your payment details.
  • TelemetryDeck — anonymous crash and usage data as described above.

Subscriptions

Stratus offers optional premium subscriptions managed through the Apple App Store. Payment processing, billing, and subscription management are handled entirely by Apple. CloudPath, LLC does not have access to your payment information. You can manage or cancel your subscription at any time through your device's Settings > Subscriptions.

Children's Privacy

Stratus is intended for general audiences (rated 4+ on the App Store) and does not knowingly collect any personal information from children. Since we do not collect personal information from any user, there is no age-specific data collection concern.

Your Rights (GDPR and International Users)

If you are located in the European Economic Area, United Kingdom, or other jurisdiction with data protection laws, you have the following rights:

  • Right to access: You can request information about what data we process. Since we do not collect PII, there is no personal data to provide.
  • Right to deletion: You can delete all locally stored app data by uninstalling Stratus from your device.

Legal basis for processing: We process anonymous crash data under legitimate interest (maintaining app stability). No consent is required for anonymized, non-personal data under GDPR.

Data Security

All communication between Stratus and our servers uses HTTPS encryption. Departure data is cached briefly (15 seconds) on our CDN to improve performance and is not stored permanently.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of Stratus after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy, contact us at:
support@ridestratus.com

CloudPath, LLC
Chicago, Illinois