1. Data controller
The controller is Nicola Lupariello, a private individual, based in Altamura (BA), Italy, who publishes his apps under the name Lykode. For any request about this policy or your data, write to hello@lykode.com or use the support form, choosing «Privacy and data». We reply within 30 days.
Muevt has not appointed a data protection officer (DPO), because it does not process data on a large scale or special categories of data.
2. In short
- There is no account: no email, password or phone number.
- Everything you enter stays in your phone’s storage, in the space reserved for the app.
- Muevt has no server of its own receiving your data: the controller sees neither your name, nor your movements, nor your addresses.
- No ads, no statistics or analytics tools, no third-party tracking SDKs, no sale or transfer of data.
- Some features contact external services that receive only what they need to respond (section 6).
3. Data saved on the phone
This data is created by you while using the app and stays only on the device, in Muevt’s private storage, which other apps cannot read. The controller has no access to it.
| Data | Where it comes from | What it’s for |
|---|---|---|
| Name | You type it at first launch or in your profile | To greet you («Hi Marta»). It’s required but can be a nickname. |
| Profile photo (optional) | You take it or choose it from the gallery | To show it in your profile. It’s copied into the app’s storage; the original stays where it was. |
| Home, work and named addresses | You save them | To plan a route in one tap. |
| Recent searches, favourite stops, lines and places | Your searches and favourites | To find them again quickly. |
| Bus reminders | You set them | To schedule notifications before trips. |
| Check-ins, place visits, points, levels and achievements | Generated when you check in | The achievements game and the «My activity» screen. Each check-in contains line, stop, time and points, not a track of your route. |
| Recent stop entries | Only with automatic check-in on | To recognise when you board a bus. They are discarded after 2 hours. |
| Notices already read and notifications already sent | Generated by the app | Not to repeat the same notice and to count the unread ones. |
| Settings | You choose them | Language, theme, guidance with the screen off, automatic check-in, tutorial. |
| Last app error | Generated if the app crashes | To show you what happened. It leaves the phone only if you tap «Report» (section 9). |
| Timetables, stops, notices, events and places | Downloaded from Muevt’s public data | To work even offline. They are not personal data. |
You can view and take all your personal data with you from Settings › Manage data › Export: you get a text file (JSON) to share wherever you like. You can delete it all from Settings › Reset app: this removes profile, photo, addresses, favourites, reminders, check-ins, achievements and settings, cancels scheduled notifications and turns off stop monitoring. Uninstalling the app also deletes everything.
4. Location
Location is optional. If you allow it «while using the app», Muevt uses it on the phone to show you nearby stops and the next bus, calculate routes from where you are, guide you in the navigator and check that a check-in really happens within 250 metres of the stop. Your location is not sent to anyone, except when you ask to turn it into an address (section 6), and Muevt does not save a history of your movements.
Only if you turn on one of these two features yourself (Settings › On the go) and grant location «always», Muevt also uses it with the app closed:
- Guidance with the screen off: during a trip started in the navigator, to follow you to your destination. Android shows a persistent notification while guidance is active; it stops when you arrive or end the trip.
- Automatic check-in: using the operating system’s geofences, the phone monitors at most the 20 stops you use most, with an 80-metre radius. If you stay at a stop for at least 30 seconds and then move away at bus speed, Muevt records the check-in. To measure speed it reads two positions 10 seconds apart, on the phone.
You can revoke the permission at any time from the phone’s settings: the app keeps working, using the centre of Altamura as a reference.
5. Other phone permissions
| Permission | When we ask for it | Why |
|---|---|---|
| Notifications | First launch or when you create a reminder | Bus reminders, line service notices, «get off at the next stop» and automatic check-in confirmations. They are local notifications, scheduled by the phone: they don’t go through a server and don’t use a device identifier. |
| Camera | Only if you choose to take a profile photo | To take the profile photo. |
| Photos and gallery | Only if you choose a photo from the gallery | To choose the profile photo. Only the image you select is read. |
| Location | First launch, or when you use a feature that needs it | See section 4. |
Muevt does not ask for access to the microphone, contacts, calendar, Bluetooth or other phone data; on Android the microphone and drawing over other apps are explicitly excluded. The navigator’s voice uses the phone’s text-to-speech and records nothing.
6. External services
Some features need internet. When you use them, the app contacts the services below directly: like any web request, they receive the device’s IP address and basic technical information (for example the type of system). They process it as independent controllers, according to their own policies. Muevt does not send them your name or any other saved data.
| Service | When | What it receives | Privacy policy |
|---|---|---|---|
| GitHub, by Microsoft (United States) | When the app opens, at most every 3 hours, to download updated timetables and notices | The request for the public data files | github.com |
| Photon, by komoot (Germany) | When you search for an address, or when you save an address starting from your location | The text you search for, or the coordinates to turn into street and number | komoot.com |
| OpenFreeMap | When you open the map, a line’s route or the navigator | The map tiles of the area you’re looking at | openfreemap.org |
| Ferrovie Appulo Lucane | When you open the FAL trains and buses screen | The request for arrivals and departures at Altamura station | ferrovieappulolucane.it |
| Operator and third-party websites | When you tap a link: PDF notices, ticket office, place cards, events | Whatever the site you open collects | That of the site you open |
| App Store and Google Play | When you download the app or, at most once a week, if the system invites you to leave a review | What the stores collect on their own behalf | Apple’s or Google’s |
External links open in the phone’s browser (Safari or Chrome), which applies its own privacy settings and cookies. For sites we don’t know, Muevt asks you to confirm before opening them.
7. Legal bases
| Processing | Legal basis |
|---|---|
| Data saved on the phone | Not processed by the controller: you manage it on your device. |
| Requests to external services (section 6) | Performance of the service you request by using the app (Art. 6(1)(b) GDPR). |
| Use of location and other permissions | Your consent, given through the operating system when you grant the permission and revocable at any time (Art. 6(1)(a) GDPR). |
| Support requests and ideas | Replying to your request (Art. 6(1)(b)) and improving the app, which is our legitimate interest (Art. 6(1)(f) GDPR). |
| Handling of any breaches and legal defence | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f) GDPR). |
8. How long
| Data | Retention |
|---|---|
| Data on the phone | Until you delete it, reset the app or uninstall it. |
| Recent stop entries | 2 hours, then automatically discarded. |
| Support messages and ideas | As long as needed to handle them, and in any case no longer than 12 months after the last reply. |
| Website technical logs | Those kept by the hosting provider for security and operation, according to its privacy policy. |
9. Support, reports and ideas
When you press «Send», the message goes through the server that hosts the site, run by Cloudflare, which immediately forwards it as an email to a Gmail inbox of the controller. The site does not store it. If sending fails, your email app opens with the message already written and you send it yourself.
The message contains the type of request, the text you write, the line if you choose one and, if you leave it, the email to reply to you. If you open support from the app, the form also receives the Muevt version, the system (iOS or Android), the language and, if the app had crashed, a short description of the error, which are sent together with the message.
10. Providers and transfers outside the EU
Cloudflare, Inc. hosts the site and forwards form messages and emails written to hello@lykode.com. To receive them the controller uses Gmail, by Google Ireland Ltd. GitHub, by Microsoft, hosts the public timetable and notice data. These providers may process data in the United States too: transfers are based on the EU-US Data Privacy Framework adequacy decision or on the standard contractual clauses approved by the European Commission. No other provider processes personal data on behalf of the controller.
11. Website, cookies and storage
The site uses no cookies, neither technical nor profiling, uses no statistics tools and embeds no third-party content (no videos, fonts, maps or external scripts). It only saves a few technical values in the browser: in session storage one that avoids repeating the opening animation, which deletes itself when you close the tab; in local storage the language and the light or dark theme you choose, to show them to you on your next visit. They are not used to recognise you and they never leave your device. That’s why no cookie consent banner is needed.
The provider hosting the site may log the IP address, the requested page and the time to ensure its security and operation.
12. Communications and marketing
Muevt sends no newsletters, promotional emails, offers or advertising notifications, and does not use your data to profile you. The app’s notifications are only the reminders you set, line service notices and travel directions; you can turn them off at any time from the app or the phone’s settings. The email you leave in a form is only used to reply to you.
13. Security
- Data stays in the app’s private storage, protected by the operating system and the phone lock.
- Timetables and notices arrive with a digital signature (Ed25519) and a fingerprint for each file: the app discards altered or incomplete data.
- All connections of the app and the site use HTTPS.
- External links are checked before opening; those to unknown sites ask for confirmation.
- The site uses strict security headers (Content Security Policy, HSTS, blocking embedding in other sites) and loads no third-party code.
14. In case of a data breach
Should a breach occur involving data sent through the forms, the controller documents it, notifies the Italian Data Protection Authority (Garante) within 72 hours of becoming aware of it if it may pose a risk to people, and informs the people involved without delay if the risk is high, as required by Articles 33 and 34 of the GDPR. A security problem in the app is fixed with an update on the stores and, if needed, reported on the What’s new page.
15. Backup and changing phone
If backup is on (iCloud on iPhone, Google Backup on Android), the system may include Muevt’s data in your account’s encrypted copy, so you find it again on a new phone. Backup is managed by Apple or Google according to their policies: the controller has no access to it. You can turn it off from the phone’s settings.
16. Your rights
You have the right to request access to your data, rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest (Articles 15-21 GDPR). If processing is based on consent, you can withdraw it at any time without affecting processing already carried out.
For data that stays on the phone you can exercise these rights yourself, from the app (export and delete, section 3). For messages you’ve sent us, write to hello@lykode.com. You can also lodge a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome (garanteprivacy.it).
17. Minors
Muevt can be used by students, for example for the school lines, and asks for no mandatory data that identifies a person. Anyone under 14 may send a form with their own email only with the consent of a parent or guardian (Art. 2-quinquies of the Italian Privacy Code).
18. Automated decisions
Muevt makes no decisions producing legal effects on you based on automated processing. Routes, points and achievements are calculated on the phone and are only for you.
19. Changes to this policy
If the app or the site change in a way that affects your data, we update this page and the date at the top before publishing the new version. If the change is significant, we also announce it on the What’s new page and in the app.