GoSEQ privacy policy

Last updated 25 October 2026

GoSEQ is a public-transport app for South East Queensland, made by E&D Collective. You can use it without an account. This policy explains what happens if you create one, and which other companies handle any of it.

The short version

• No ads, no selling your data, no tracking across other apps or websites.
• Your location is used on your phone to plan trips. GoSEQ keeps a path only for trips you start. It shares your exact position with other people only when you press Help.
• Companies that handle some of your data for us are listed under Who else handles data, with what each one gets.
• GoSEQ is not an emergency service. If you’re in danger, call 000.

What we store

• Account: your name and email address. Your password is never sent to us or stored. Your phone scrambles it first, and we keep only a one-way hash of that. You must be 13 or over. When you sign in, we keep a scrambled copy of your sign-in token, which lasts up to 90 days.
• Email codes: when you create an account, sign in with an email code, or open a support chat, we email you a 6-digit code to prove the address is yours. A password reset code works for 1 hour. We keep only a scrambled copy of each code, until it runs out or you use it. Emails are sent through Resend.
• When you last used the app: the time your account last used the Android or iPhone app while signed in, noted at most once an hour. It’s how we know who is still testing the app, because testers get GoSEQ Pro free while they’re testing. No location and nothing about your phone comes with it.
• Two-step verification, if you turn it on: which kind you chose, the secret your authenticator app uses to make codes (stored encrypted), and scrambled copies of your backup codes. Turning it off deletes them.
• Optional profile photo, if you add one.
• Your settings, so they sync between devices: saved places (like Home or School), saved stops, routines (like “be there by 8:30”) and app preferences.
• Trip history: for each trip you start, finished or not: the routes, the stops you got on and off at, the planned and actual times, how it ended, and the place you were going (the one you picked, not where you were). It lets you look back at your trips, plan one again on any phone, and see your own trip stats. We keep up to 3,000 trips on your account, and the oldest drop off first. Deleting your account deletes all of it.
• Trip paths: while a trip you started is running, and only then, GoSEQ records the way you went with your phone’s GPS, for the trip’s speeds and its map. Your phone keeps your last 60 trips’ paths. Your account keeps a thinned copy (a point about every 40 m, up to 2,500 points a trip) for up to your last 500 trips. While a trip is going, your account also holds what the app needs to carry on with it (the plan, and whether you’re on board), so it can pick up again if your phone closes GoSEQ. That is cleared when the trip ends. On Android the path keeps recording in the background while the trip’s notification is up. On iPhone, iOS shows its location indicator. Switch it off any time in Me → Your trips → Record trip paths. If you turn on Record trip paths, the times your bus reached each stop (never your location) may also be used, without your name, to improve GoSEQ’s arrival predictions. You can turn this off any time in Me → Privacy.
• Making arrival times better (Sage): from 21 October 2026, with no name, account or contact details attached, GoSEQ uses the paths and on-board timings of trips to check and improve its own arrival-time predictions, called Sage. Only the bus part of a trip is used (where it went and when it reached each stop); walking parts, your start and your destination are left out. Turn this off any time in Me → Privacy → “Help improve arrival times”, and trips from then on aren’t used.
• If you create an account or sign in later, GoSEQ adds trip history, saved stops, places and settings already on this phone to that account. It adds past trip paths only if you explicitly turned on Record trip paths on this phone. A calendar reminder you downloaded stays in your calendar; GoSEQ does not add that event to another phone.
• Trip pages: when you choose to get a link for a trip, a page anyone with the link can see (goseq.app/t/…): your first name, the routes, the stops you got on and off at, the times, your speeds and the trip’s picture, and its path without its first and last 300 m. It never shows where you started, where you were going, or the name of that place. It stays up until you take it down (on the trip in the app) or delete your account. It isn’t listed in search engines.
• Shared trips (live): when you choose to share a live trip, the plan and progress can be seen by anyone with the link until the trip ends (at most 12 hours). When it ends, the stop names and positions are erased within about 15 minutes. The link then says only that the trip has ended, and the empty record is deleted a day later.
• Heads-up for your usual bus, if you switch it on: for your next few days of routine trips (like School or Work), the stop you catch the bus from, which service it is, when it leaves, and a few other services that also get you there. We use them to warn you if it’s cancelled, late or detoured. We also keep your phone’s notification address. Not your home address or where you are, and your own place names (like “Gran’s”) stay on your phone. Each trip is deleted a day after it’s gone. Switching it off, or deleting your account, deletes them all.
• Mates, if you add any: who your mates are, requests waiting for a yes (up to a week), your invite code, and whether you switched on Invisible. Invite codes and links change every 5 minutes. Your mates see your first name only: not your email, surname or photo. When you tap “I’m pulling up!”, the mates you pick get one notification with your first name, how many minutes away you are and the stop you’re getting off at. It isn’t a location. We note that it was sent for 2 days, so it can’t be used to spam anyone. Expired requests and pull-ups are deleted by a scheduled clean-up. Removing a mate, or deleting your account, deletes them.

Meetups and rider reports

When you create a meetup, we store the meeting places, the time and your account as host. Anyone with its random link can join and see participants’ first names and any arrival times they choose to share. Participants can optionally share travel minutes to compare meeting points. Starting locations are not shared. Each participant has a separate private credential to update or remove their entry. Arrival times become stale after two minutes without updates. Signed-in members can opt in to phone alerts for arrivals, large delays and meeting-point changes. These use the account’s registered notification devices and don’t include anyone’s live location. The host can end the meetup. The link expires three hours after the meeting time, and expired meetups are deleted by the next clean-up. Deleting the host’s account deletes its meetups. Guests can leave using the browser where they joined.

Optional community reports describe crowding on a service or a possibly moved stop. They are unverified rider observations, labelled as such, and never change routing automatically. They are tied to a random device ID, held in memory for at most ten minutes, and can be removed from the journey screen. Journey preferences and planning allowances are stored on your device.

Family

Family is optional, free, and needs an account (13 and over). A family is up to 6 people who can share the trips they start with each other. You can be in up to 4 families at once (for example Mum’s and Dad’s), and each one has its own name, people and sharing. It is not a way to see where someone is during the day, and it is not a safety service.

• Joining takes two yeses. The person joining opens an invite (a short code or link that changes every 5 minutes), chooses what to share and asks. An organiser or guardian then says yes. A request waits up to 7 days. Nobody can be added by email or phone number, and there is no search. You can be in up to 4 families. Each family is separate: its members don’t see which other families you’re in, and leaving one doesn’t change the others.
• What we store: who is in the family and their role (organiser, guardian or member), the age group each person chose when joining (13 to 14, 15 to 17, or 18 and over; no date of birth), first names, and each person’s own choices. Those are: who may see their trips (nothing is shared until that person switches it on, person by person), whether Help reaches the family, whether guardians are told if a trip hasn’t checked in, and a pause switch. These choices are kept per family, except pause, which pauses all your families at once. You also choose, per family, how trips are shared: every trip automatically (the default), ask me each time (the app asks when a trip starts; the trip doesn’t wait for your answer), or only when I tap Share. If you don’t share every trip, the people you share with are shown that you choose which trips to share (not which ones you didn’t). Nothing about a trip goes to a family until it is shared with them. While a trip is going we also store which of your families it is shared with. A history of changes (who joined, left, was removed or reported) is kept 90 days.
• What other members see: when you share trips with someone, they see your first name and the trip’s route, stops, times and status (waiting, on board, arrived, late or cancelled) while it is going. They also get a short notification at each step (“boarded”, “arrived”, “running late”, “cancelled”). Those notifications are kept 7 days. Trip cards are removed soon after the trip ends: about 15 minutes after you arrive, or within 6 hours of the last update at the latest.
• School run only shares a trip only if your phone says it is a school run.
• Following on the web, without an account. Someone you invite (someone you trust, say) can open the invite link in a web browser and ask to follow your family’s trips without the app or an account. They type a first name. Someone who looks after the family must say yes in the app, after checking the 4-digit number on both screens. We store the name they typed, which family, the invite’s role, when they asked and were let in, when they last opened the page, and a scrambled copy (a hash) of a secret key kept in their browser; nothing else about them, and no position. They see only the trips of people who switched them on, while those trips are going (the same route, stops, times and the bus on a map as other members), and they get no notifications. An unanswered request is deleted after 7 days, and a follower who hasn’t opened the page for 90 days is removed. They can stop following at any time, and the organiser can remove them. If they later make a GoSEQ account on the same phone, they can turn the follow into membership of that family.
• Help and Get home safe. If you turn on “Tell my family when I press Help”, the family members you choose are notified, with the live Help link, when you press Help. If you turn on “Tell my guardians if I haven’t checked in”, guardians get the same alert your emergency contacts would. That includes where you were last seen, in words, and your live trip link if you are sharing one. Both are off until you turn them on.
• Sharing your location, places and “I’m OK” (only once GoSEQ has turned on location sharing for Family; until then none of this exists). It is your choice and only yours: nobody can switch it on for you. You choose how long (until you turn it off, for 1 hour, or until you get home) and which family members can see you, and you can stop at any time. While you share, and only while GoSEQ is open on your phone, we keep your latest point only (latitude, longitude, how accurate it is, when it was taken, and your battery percentage), replaced each time; there is no history. When you stop, the point is erased and only the time is kept, so family see “Last seen 3:40 pm”. A place (Home, School, Training or your own) is a name you type, a point you pick on the map and a radius of 100 to 300 metres; we never store an address. When you get to or leave a place, the family members you chose are sent a notification (and a text, only if you turned on texts for it, which count towards GoSEQ’s text limits); nothing is sent between 9 pm and 5 am. These arrive and leave notes, “I’m OK” check-ins (your first name and a public suburb or station name, never a street) and “Where are you?” asks are listed for the people involved for 7 days, then deleted. Pausing, ending a share and not choosing someone all look the same to them: “Not sharing right now”. Leaving a family or deleting your account removes your place choices and any latest point. We don’t run ads, don’t sell this and don’t use it for anything but showing it to the people you chose.
• Setting up an account for someone, places and the usual week, asks to share, locks, and texts (only once GoSEQ has turned on Family set-up and controls). An organiser or guardian can make an account for a person who does not have one: GoSEQ keeps their first name, the age group if given, and a one-time set-up link, stored only as a hash, that works once for 24 hours. The person opens it on their own phone and chooses their own email and password; until then nothing about them is shared, and an account nobody sets up within 7 days is deleted. Once they have set it up it is theirs and only they can delete it. For a member, an organiser or guardian can set a place (a name, a point and a radius, never an address; the member sees “Set by” and is told), add things to their usual week (a label, a place and a usual finish time), ask them to share their location (they choose Accept or Not now; it never switches sharing on, and “Not now” is not reported back) and lock pausing and leaving the family. Members always see these controls and locks, in Family and in Settings, and are told when they change; each is recorded in the family’s log (kept 90 days). Help, “I’m OK”, switching off location sharing and deleting your own account are never locked. On the Family plan (and its free 30 days), if a notification cannot reach a person who has a verified mobile and has texts on, they get a short text, from a pool of 60 per family per month; we keep a count, not the words. Each person can turn their own texts off, and STOP always works. A usual week is shown only to people a person is sharing their location with, and only while they share, together with their Home point so the app can work out “home about 6:15 pm”.
• Leaving is immediate and silent. Being removed sends the person removed one quiet notification. The organiser can close the family. Closing a family removes its sharing records. Leaving one family removes your sharing records in that family only. A deleted account leaves all its families automatically.
• Reporting a family or a member sends a report to GoSEQ Support: what you wrote, who and which family, and the family’s members with their roles and age groups. Team members can close a family, remove a member or stop an account using Family.
• Children: Family holds only what is listed here. We don’t run ads, and we don’t use family data for anything except showing it to the people you chose.

Pick me up

When you use “Pick me up” at a stop, GoSEQ makes a page at a secret link (goseq.app/pk/…) for the person coming to get you. For up to 75 minutes we store your first name, the stop’s name and position, which bus you expect and when it is due, an optional label, and the car’s arrival time. The driver’s page sends the driver’s phone position to our server about every 30 seconds, only while that page is open and they have said they’re on their way. We use it once to ask HERE for a drive time (rounded to about 110 m) and we don’t keep it. You never see it, only the minutes. When it ends, the stop and your name are cleared at once, and the record is deleted an hour later. Deleting your account deletes any pick-up still going.

“My bus was late” cards

If you make a card, we store the route, the stop, the timetabled and actual times, whether the evidence was the live feed or the bus’s position, when your phone saw you board, and whether TransLink’s live feed agreed when you made it. The card is a page at a link with a short random id (goseq.app/late/…). It shows those facts and no name, account or location trail. It is a GoSEQ record made from your phone’s data and checked by our server where it could be. It is not an official TransLink record. A card is deleted 90 days after it is made, or when you delete it, or when you delete your account.

School buses and arrival times

• School bus recorder: on school afternoons, GoSEQ records where TransLink’s live feed says some school buses are (vehicle position, stop, delay and speed: about vehicles, never riders). It keeps this for 30 days, to learn which stops each bus serves. It also asks HERE for traffic along those routes. That has no personal data in it.
• Traffic-aware arrival times: for any route, our server may ask HERE how traffic is flowing around the route, and adjust the times. No rider information is sent.

Other things GoSEQ sends and does

• One reminder before your free GoSEQ Pro ends: about three days before the free 14 days end, we send one reminder with the date: a notification on your phone or, if no phone is signed in, one email to your confirmed address. It’s sent once, and never to anyone already subscribed. We keep whether it was sent and whether you switched it off. Turn it off any time in the app under Me → GoSEQ Pro → Remind me before my free Pro ends, or with the link in the email.
• A daily count: once a day the app tells our server “one more phone used GoSEQ today”, whether it’s the first time this month, and whether it’s Android or iPhone. There’s no ID and no location in it, so we can tell how many people use GoSEQ but not who, or which phone.
• Update checks: when the app opens, it asks our server whether there is a newer version of the app’s screens. It sends the platform, the app build and update number, and a random number from 0 to 99 that your phone made up (so updates can go to a few phones first). Once a day it is counted as “one more phone on update N”, with no ID. Those counts are kept 30 days. GoSEQ signs its updates, so the app can check they really are ours.
• Timetable: the app downloads GoSEQ’s copy of TransLink’s public timetable from our server. It’s the same files for everyone, with no personal data. A daily check compares our copy with TransLink’s newest.
• Crash reports: if the app hits an error, it sends the error message, a short stack trace (up to 800 characters), the screen name, the app version and the update number. Email addresses, mobile numbers and anything that looks like a coordinate are removed before it is saved. We keep the newest 2,000, and none for more than 30 days. Your name, places and location are never sent on purpose.
• Ask GoSEQ: requests like “to the city by 5pm” are understood on your phone. Only if it can’t work one out (and the AI helper is switched on) is that sentence sent to OpenAI to understand it. We send it with the names of your saved places (like “Home” or “School”, not their addresses) and, for some questions, a list of services near you.
• Check my stop, only when you tap it: the photo you take of a bus stop’s sign is sent, through our server, to OpenAI to read the stop number, name and routes on it. Only the photo goes to the AI: not your location, account or trip. Your phone also tells our server which stops are around you, so it can count whether the sign was one of them. That list goes no further and isn’t kept. Neither GoSEQ nor our server keeps the photo. We count only how often it’s used and whether the sign could be read.
• Voice: if you tap the microphone, your phone’s speech service turns what you say into text (Apple Speech on iPhone, usually Google’s service on Android). iPhone asks for microphone and speech-recognition permission when you tap the mic. GoSEQ never records or receives audio. It gets only the text, which is treated exactly like a typed question.
• Live trip on your lock screen: while a trip is running, your phone asks our server where that bus is. It sends only the TransLink trip ID, not your location.
• Your walking pace and lift times: measured on your phone while a trip is running. Only the result is kept (for example “4.9 km/h”), on your phone and, if you have an account, in your synced settings.
• Walking and driving directions: your phone sends the start and end points, rounded to about 10 m, to our server. Our server asks a routing service: HERE (for walking) or OpenStreetMap’s FOSSGIS service. Results from OpenStreetMap are cached by the rounded points for up to a day. HERE results are never shared between people. They are never linked to you or your account.
• Where to get off, by car (if you use it): your position (rounded to about 110 m) and the candidate stops go to HERE through our server for a drive time. They are not kept.
• Sharing your bus’s position, only if you say yes (GoSEQ asks once when you open it; change it any time in Me): while you’re on a bus, train or ferry, every 10 seconds your phone sends where it is (your GPS moved onto its route), how fast it’s going and which way, and how late or early it is. It sends it with the TransLink trip ID, which timetable run and stop that’s measured against, and a random number your phone made up. Other people’s apps use that to show better arrival times. It isn’t linked to your account, name or trips. Our server keeps each report for about a minute and a half, in memory only, and throws it away when you get off. What it does keep is two things. One is how many people saw a bus you were sharing (the “You’ve helped” number, stored against the random number, with no expiry). The other is how fast buses go along each ~150 m of road, by direction, day type and hour, as totals with no trip, time or rider in them. Turn it off in Me any time.
• How full it is, only if you answer when GoSEQ asks as you get on: your answer, the TransLink trip ID, the stop you got on at, and the same random number. Everyone on that service sees the answers for 10 minutes. Our server keeps them in memory only, for at most 10 minutes, and never uses them to plan trips. You can remove your answer from the trip screen.
• Address search: what you type, and your rough area (about 1 km), go to our server. It asks Photon (OpenStreetMap search, run by Komoot; Nominatim is a back-up) and, for house addresses, the Queensland Government’s address service. If those don’t find it (a shop, clinic or business name), the search text and the same rough area may also go to HERE, a maps company. If we ever use a different business-search company, we’ll name it here first. These services see the search text, not who you are. Pasting a Google Maps link makes our server look up that one link on Google’s own map site.
• Weather: a rough area (about 10 km) is sent via our server to HERE for the forecast, and one forecast is shared by everyone in that area.
• Maps: map images come through our server from HERE (our main map provider) or MapTiler (with OpenStreetMap data). MapTiler is also used instead when HERE’s daily allowance has run out. Maps show which area is being looked at. The map providers see our server, not your phone or account.
• Abuse protection and internet addresses: to stop anyone overloading or misusing GoSEQ, our server counts requests per internet address in short windows (a minute up to a day): sign-in attempts, email codes, searches, reports and similar. For some limits the count is kept against an email address instead. To count, our database holds the address (for IPv6, its first half) inside a counter for up to two days, then deletes it. We don’t keep a log of which addresses asked for what. Cloudflare, which runs our servers, handles every request and may keep its own short technical logs. GoSEQ’s own request logging is switched off. The team console’s audit log (which team member did what) keeps a scrambled form of the team member’s address for about 13 months.

GoSEQ Pro and payments

GoSEQ Pro has a 14-day account trial on Android and the web, then costs A$2.99 a month or A$19.99 a year. In the iPhone 1.0 app, the extras are included free, with no purchase or automatic renewal.

• On the web (goseq.app/pay): you enter your card in fields that Stripe draws inside our page. Your card details go to Stripe, never to GoSEQ. Stripe makes a customer record with your email, name and GoSEQ account id. We keep Stripe’s customer and subscription ids, the plan, the status, the renewal date and any cancellation. Stripe sends receipts. GoSEQ sends the subscription emails (confirmation, cancellation, and one reminder before the free period ends).
• On a phone: Android subscriptions are paid through Google Play. If iPhone subscriptions are offered in a later version, they will be paid through the App Store. They, and RevenueCat (our subscription service), receive the purchase and your GoSEQ account id, so Pro can follow you between devices. RevenueCat tells our server the status. We keep your account id, the store, the product, the status, the expiry and the store’s reference.
• Ask someone you trust to pay: a young rider can send a link (good for 7 days, for one payment) to whoever pays. The page shows the rider’s first name only. The person paying enters their own email (for their receipts and a link to manage the plan) and their card (to Stripe, on their own Stripe customer record). We keep that email with the link until the rider deletes their account or the link is deleted. The rider is told it was paid and can see that someone else pays, but not who or how.
• Students & staff offer (goseq.app/bgs): you sign in with your own personal email or mobile, then prove a school email with a 6-digit code. The school address is sent to our mail provider (Resend) only to deliver that code. Our database never stores it: we keep only a keyed, salted hash of it, so one school inbox can turn on the offer for one account, and we keep that hash even if you delete your account. The school address is never a login and is never shown. For an email at another school we keep only that school’s domain, linked to your account, so we know where the offer is wanted. The offer gives Pro until 1 Feb, with one optional reminder email about two weeks before.
• Testers: Android testers on Google Play, and invited web testers, get Pro free while testing. The web beta keeps the tester’s email, name and visit count.
• Deleting your account cancels a web subscription and asks Stripe to delete your customer record. A Google Play or App Store subscription is cancelled in that store, so please cancel it there too. Stripe, Google Play, the App Store and RevenueCat keep payment records they must keep for tax and accounting. Our own copy loses your account id.

Notifications

To send a notification, our server needs your phone’s push address. We keep it (up to 10 phones an account) until you sign out, it stops working, or you delete your account. Notifications go through Google’s Firebase Cloud Messaging and, for iPhones, Apple’s notification service. They carry the notification’s title and words, which can include a first name, a route or a stop. Anyone holding your locked phone can read what it shows. A notification never contains your exact location.

Mobile number and text messages

Using a mobile number is optional. If you choose phone sign-in, we send a six-digit code to an Australian mobile to confirm you control it. Codes expire after 10 minutes. Your verified number stays with your account until you remove it or delete the account; email and passkeys remain available.

If you have GoSEQ Pro, you can separately opt in to texts for saved trips. GoSEQ may send a leave reminder or a delay alert using the route, stop and times you saved. We respect quiet hours, send at most two trip texts per trip, and never move the recommended leave time later than the timetable time. Turn trip texts off in Me, remove your number, or reply STOP to stop all GoSEQ texts to that number. Reply START to allow texts again; trip alerts stay off until you turn them back on.

GoSEQ gives ClickSend your number and the message content to deliver the text. We keep delivery records for up to 45 days: time, type, status, trip-text content and only the last three digits of the destination number. Verification codes are redacted from these records. We keep a one-way fingerprint of numbers that sent STOP so we honour the opt-out. Texts can be delayed by mobile networks.

Get home safe and Help

Get home safe and Help are optional and need a GoSEQ account. They can fail because of poor signal, a flat phone, or a delayed or undelivered email or text. GoSEQ does not contact emergency services or send help. If you are in danger, call 000.

Your emergency contacts. You can choose up to two contacts. For each, choose Text (mobile) or Email. GoSEQ stores the name and the chosen mobile number or email address while the invitation is pending or the contact has accepted. We send that contact one invitation first. An email contact accepts through a link; a text contact replies YES. We send no safety alerts to that contact until they accept. A text contact can reply STOP at any time; an email contact can use the stop link in every email. Invitations expire after 14 days. You can remove a contact whenever you wish. We delete their address or number if you remove them, they decline or opt out, their invitation expires, or you delete your account. Afterward you see only their name and a shortened address or the last three digits of the number.

A Text contact’s mobile number is sent to GoSEQ and ClickSend to deliver the invitation and, after acceptance, Get home safe and Help texts. It is also shown as a Call button on your Help screen. ClickSend receives the number and message content to deliver each text. We may send up to three invitations to one contact, and limit repeated invitations across riders. If they reply STOP, we remove their number from your contact and keep a one-way fingerprint of the number to honour the opt-out. Replying START permits future texts but does not restore them as your contact: you must invite them again.

For an Email contact, you may separately add a mobile number only for your Help screen’s Call button. That optional number stays on your phone; it is not sent to GoSEQ or ClickSend. Signing out removes it from that phone. GoSEQ sends their email address and message content to Resend for delivery. Email invitations have Accept and Decline links. Every later email has a stop link. After someone uses the stop link, we keep a one-way scrambled code of their address (a hash, not the address), only so you can’t add them again. If they also tick “stop any other GoSEQ rider adding me”, the code blocks every GoSEQ user. They can undo it from the same link. The code is made without a secret key, so in theory someone with a list of addresses could test it against that list. We keep it only to honour their request.

Watched trips. When you turn Get home safe on for a trip, or enable automatic night or every-trip watching, your phone sends GoSEQ your position rounded to about 100 m, route, direction, nearest stop, due time and whether you got off early, about once a minute. We use this to check for a late, stopped, cut-short or silent trip. Position is deleted when the trip ends; the rest is deleted within 12 hours. A watch lasts at most 12 hours.

What contacts are told. GoSEQ asks you “All good?” first. If you do not answer within 10 minutes, or within 15 minutes after an early-exit check, each accepted contact gets the chosen email or text. It can include your first name, where you were last seen in words, and a live trip link if you are sharing one and the text provider permits links. It does not include your exact location. If you then say you are OK, we tell contacts who were alerted. Contacts who asked for it may also get an arrival message.

Help. When you press and hold Help, your phone sends your exact location every few seconds to a private live page while Help is on. Accepted contacts receive that link by their chosen channel; mates and opted-in family get a notification. Email contacts can tap “I’ve got this” and may get reminders every 10 minutes for up to 2 hours. Text contacts may get “Still no answer” texts and calls until someone presses 1, you say you are OK, or the session ends. We limit repeat messages and calls. Help lasts 2 hours unless renewed, at most 8 hours total. When Help ends, sharing stops and the location points are deleted. The private page is not indexed by search engines.

Delivery records. For each safety email or text, we keep the time, type, delivery status, message content, and a shortened destination address or only the last three digits of the number for up to 45 days. We use these records to stop duplicates, enforce sending limits and investigate delivery. Deleting your account removes your association and message content from its records. The email consent and stop links are random, stored only as hashes, with the existing link expiry periods.

Support requests

If you message us at support.goseq.app, with the chat button on our website or from Me → Help & support in the app, no account is needed. To answer you, we keep:

• A checked email address: the first time, we email you a 6-digit code to check the address is yours (or you sign in with your GoSEQ account). After that, the device you used can open every chat sent from that address, open and closed, for 30 days, so you can pick up on any phone or computer. We keep only a scrambled copy of the code and of that sign-in. You can sign out any time.
• Your request: your email address, the first name you give (if any), the subject and category, what you write, and our replies. Screenshots or photos you attach are stored with the chat and deleted with it: 12 months after it closes, or within 30 days if you ask us to delete it. If a team member erases a chat for good, it goes at once. The console’s usual delete hides the chat at once and erases it after 30 days, so if you want it erased straight away, say so.
• App details, if you choose: from the app you can include the app version, whether it’s Android or iPhone, and the settings that matter for support (whether notifications, on-the-minute alarms and location permission are switched on, whether you’re signed in, and the timetable’s date). You see exactly what will be sent and can leave it out. It never includes your location.

Who replies: the first replies are written by Max, our AI helper. The conversation and those app details (not your email address) are sent to OpenAI to write each reply. Anything serious (safety, a child’s safety, privacy or security, your account, legal matters, payments, or anything the AI isn’t sure of), or any time you ask for a person, goes to a person on the GoSEQ team, who can read any request. If a message looks urgent, the chat always shows the 000 and TransLink advice, even when the AI is off. When a chat closes, the AI writes a short summary of it (sent to OpenAI the same way), which we email you with a link to rate the chat. The rating and anything you add to it are kept with the request. Emails about your request are sent through Resend.

Ask Max: the chat button on our website also lets you ask Max questions about GoSEQ straight away, with no email and no request. What you ask, and the conversation so far, is sent to OpenAI to write each answer. We don’t keep it. The conversation stays in that browser tab only, and is gone when you close it.

Your private link: each request also has a private link, kept on your device and in the emails we send you. Anyone with the link can read and reply to the request, so please don’t forward it. The links in older emails keep working while the request exists.

How long it’s kept: a resolved request closes after 7 days, and one waiting on your reply closes after 3 weeks. Closed requests and all their messages are deleted 12 months after they close. To have one deleted sooner, email info@eanddcollective.com with its reference (like GS-4F7K2).

Trip ratings

When you tap I’m here at the end of a trip, GoSEQ may ask “How was the trip?”. It asks at most once a trip and once a day. Answering is optional. Not now closes it, and you can turn it off in Me → Trip screen → Ask me to rate trips. Nothing is sent until you press Send.

When you press Send, we receive:

• Your rating and your words:
  • the face you picked, from 1 to 5;
  • anything you ticked under “What went wrong?”;
  • what you wrote under “What should we fix?” and “What would you like added?”;
  • the routes of the trip (like “60 > 380”);
  • the app’s version and whether it’s Android, iPhone or the web.
• Diagnostic logs (on unless you turn them off; “What’s included” shows the list before you send):
  • the app’s recent errors, and where in the code they happened;
  • the trip’s plan: its routes, the stops you got on and off at, and their times;
  • what happened on the trip, with times: when you got on and off, the changes, the alerts and full-screen screens shown, and when the app was in the background;
  • how accurate your phone’s GPS was during the trip: how many readings, how accurate they were, and any gaps. Never the readings themselves.
  The logs never include where you started or where you were going.
• Your trip’s path, only if you turn on “Include my trip’s path”: the GPS points your phone recorded on that one trip, with their times and accuracy. We keep it for 30 days, then delete it. In the support console, every time someone opens a path, it’s recorded in our admin audit log.
• Screenshots, if you add them: up to three pictures you choose. The app shrinks each one on your phone before it’s sent.

Who it’s linked to: if you’re signed in, it’s linked to your GoSEQ account, so we can reply and you can see the reply on any phone. If you’re not signed in, it isn’t linked to you or to anything else. We don’t keep your address or a device ID with it. The app keeps a private link to it, so a reply reaches you on that phone.

Becoming a support request: a rating that has words, ticks or screenshots, or a rating of 1 or 2, becomes a support request so a person on the GoSEQ team can read it and reply. The reply appears in Me → Help & support. If you’re signed in, it’s also emailed to your account’s address.

• Its screenshots are stored with the request and deleted with it, like any other support request (see Support requests).
• Max, our AI helper, doesn’t answer trip ratings.
• If a team member uses the console’s AI helper on a rating’s request, only the words in the chat are sent to OpenAI, as for any support request. The diagnostic logs, path and screenshots aren’t sent.
• A rating of 1 or 2 is also emailed to our support inbox through Resend. That email includes what you ticked and wrote, but not the diagnostic logs, the path or the screenshots.

On your phone: to make the logs possible, the app keeps a short log of your current trip and your last one: the events, the plan and the GPS figures listed above, plus its last 20 errors. Like the rest of the app’s data, it’s stored on the phone and is never sent anywhere unless you press Send on a rating. Each new trip replaces the oldest of the two. Reset GoSEQ on this phone clears it.

How long it’s kept:

• A rating that became a support request is deleted with that request: 12 months after it closes, or sooner if you ask.
• A rating on its own (just the face, with diagnostic logs if you left them on) is deleted after 12 months.
• A path is deleted after 30 days.
• Deleting your account deletes the logs and paths of the ratings you sent while signed in.

To have a rating deleted sooner, email info@eanddcollective.com. Include its reference (like GS-4F7K2) if it has one.

Which bus is this?

While you’re on a bus, and when you tap a bus on the map, GoSEQ can show a card about the bus, not you: its fleet number, who runs it and, when we know it, its make, model and a photo of that model. The fleet number comes from TransLink’s live data. The models come from public sources, each named on our credits page along with every photographer and their licence.

• Looked up on your phone. The app downloads the whole fleet list (a few kilobytes, once a day) and finds your bus in it itself, so our server isn’t told which bus you’re on.
• “Is this right?” If you say the card got your bus wrong, we keep the bus (operator and fleet number), what the card said, what you said it is, the app version and when. No account, no location and no message. Your internet address is used only to stop repeated reports. It’s kept apart from the report, for a day at most.
• Bus fan (off unless you turn it on in Me → Trip screen) shows these details on departures and counts how many different buses you’ve ridden. That count, and the list of buses behind it, stays on your phone. It isn’t synced or sent to us, and Reset GoSEQ on this phone clears it.

Fleet and route pages

goseq.app/fleet and goseq.app/route/… are public pages about lines and vehicles, built from TransLink’s data and our own measurements (how on time a line is, which vehicle types run it). They contain no personal information.

The web app

The GoSEQ web app (goseq.app/beta) asks for your email and a 6-digit code. We keep your email, your name (if you give it) and when you last visited, in a tester list that our console can see. We also set a sign-in cookie for 30 days (HttpOnly). Opening it with a code from a friend (“mates”) works as in the app.

The “tell me when it’s out” list

If you put your name down on our website, we keep just your email address and the first name you typed, to send you one email when GoSEQ is released. It isn’t a newsletter, it’s never sold or passed to anyone, and it isn’t linked to an app account. Every email has a link that takes you off the list. We then keep only a note that you left, so you are never emailed again. If you want that note erased too, email info@eanddcollective.com. The email is sent through Resend, which handles delivery on our behalf.

The city waitlist

On goseq.app/cities, people who live outside South East Queensland can put their name down for the city they ride in. We store your email address, the city you chose, the town if you typed one, and the date. It isn’t linked to an app account, and it is for people 13 and over. We use it for one thing: to email you once when GoSEQ opens in your city. The page shows how many riders are waiting for a city only once that city has 10 or more, and never shows anyone’s address. Your address is never sold or shared. When we do write, the email goes out through our email provider, Resend, on our behalf, and every email will have a one-click unsubscribe link, and if you use it we keep only a note that you left so you are never emailed again. We delete your details 30 days after your city opens, or sooner if you ask: email info@eanddcollective.com.

What the GoSEQ team can see

GoSEQ is run by a very small team. Owners of GoSEQ can open a private support console to help people, fix problems and stop misuse. For an account, it shows:

• Who: your name, email address and whether it’s been checked.
• Where you use GoSEQ: Android, iPhone and/or the web app, and the app version.
• When: when you joined, and when you were last active and what that was (a trip, a sign-in, a settings sync, notifications).
• GoSEQ Pro: whether you have it, and whether it’s paid or a free period.
• Counts and lists: how many trips, mates, Get home safe contacts and support chats you have; your trip history; your family groups; and your support chats.

It does not show where you are right now, your password or your card details. A trip’s GPS path only shows if you chose to include it with a trip rating (see Trip ratings). Only owners can open it, every list and account they look at is recorded in an audit log with their name, and it’s used only to support you and run GoSEQ, never for advertising or to sell.

Who else handles data

• Cloudflare: runs our servers and database, and stores app files. It sees every request.
• Resend: email delivery. It gets the address and the email.
• ClickSend: text delivery for phone sign-in codes, Pro trip texts you turn on, and contacts you choose to contact by Text. It receives the recipient number and message content. Its inbound service passes YES, STOP and related replies to GoSEQ.
• HERE: map tiles (the area asked for), business search (text and rough area), and walking and drive times and traffic (rounded points, no account).
• MapTiler, and OpenStreetMap services (Photon, FOSSGIS, Nominatim): map tiles, address search text and rough area, and walking and driving routes (rounded points).
• Queensland Government address service: house-address search text.
• TransLink (Queensland Government): the source of timetable and live data. It receives no rider information from us.
• Stripe: web payments: card details, your email and name, and subscription records.
• Google Play, the App Store and RevenueCat: phone payments and subscription status. RevenueCat gets your GoSEQ account id.
• Google (Firebase Cloud Messaging) and Apple: notification delivery: the push address and the words of the notification.
• OpenAI: our AI provider. It gets Max’s chats, “Ask GoSEQ” sentences, Check my stop photos and support summaries. It never gets your email address, location or account.

How long things are kept

• City waitlist: until 30 days after your city opens, or until you ask us to remove you. If you unsubscribe, only a note that you left is kept.
• Email codes: until they run out (10 minutes; a password reset code, 1 hour), or once used.
• Internet-address counters: up to 2 days.
• Live trip shares: until the trip ends. Stop names and positions are erased within about 15 minutes after, and the empty record a day later.
• Heads-up trips: a day after they are gone.
• Pull-up notes: 2 days. Family notifications: 7 days. Family history: 90 days.
• Pick-up: up to 75 minutes, then cleared. The record is deleted an hour later.
• Watched trip (Get home safe): the position is deleted at the end. The rest goes within 12 hours.
• Help: positions and points are deleted when it ends. The record goes 24 hours later.
• Email records: 45 days.
• “My bus was late” cards: 90 days.
• School-bus vehicle records: 30 days.
• Update counts: 30 days.
• Crash reports: 30 days (the newest 2,000).
• Trip history and paths: until you delete them or your account (up to 3,000 trips and 500 paths).
• Trip ratings: 12 months (paths 30 days).
• Support requests: 12 months after they close.
• Admin audit log: about 13 months.
• Backups of our database: Cloudflare keeps short-term backups, up to about 30 days. Something we delete can stay in a backup until it ages out.

What we don’t do

• No ads, no selling your data, no tracking across other apps or websites. The only outside services that see any of it are the ones listed on this page, and only to answer that one request.
• No request logs of our own: our server doesn’t record the addresses it’s asked for. The only place an internet address is held is the short-lived counter described under Abuse protection.
• No tracking outside your trips. Your location is used on your phone to plan trips from where you are, and only the points needed for a route or search are sent (see above). It is kept in a few places only: the path of a trip you started, while Record trip paths is on (see Trip paths); the path of one trip you chose to attach to a trip rating (see Trip ratings); and Get home safe and Help, as described above.

Where it’s kept

On Cloudflare’s servers (our database is in its Oceania region). Public transport data comes from TransLink (Queensland Government) open data. Addresses, walking and driving routes are looked up with OpenStreetMap services (Photon, FOSSGIS routing) and the Queensland Government’s address service (© State of Queensland, CC BY 4.0). Business names, some routes and traffic come from HERE (© HERE). Weather comes from HERE (© HERE). Maps come from HERE, MapTiler and OpenStreetMap.

Deleting your data

In the app: Me → your name → Delete account. This deletes straight away your account, settings, trip history and paths, the details of your trip ratings, shared trips and trip pages, emergency contacts and Get home safe or Help data, family and mate connections, pick-ups, “my bus was late” cards and push addresses. It also cancels a web subscription and asks Stripe to delete your customer record. Payment records that Stripe, the stores and RevenueCat must keep stay with them, and a Google Play or App Store subscription must be cancelled in that store. See how to delete your account, or email info@eanddcollective.com. Support requests aren’t part of an account. Email us and we’ll erase yours.

Children

GoSEQ is designed to be safe for students travelling to school. Anyone can use it without an account. Creating an account is for people 13 and over. Family (above) can be used by families with young people under 18, and it shares only trips the young person chooses to share. We collect only what’s listed on this page, and we never show ads.

Contact

Questions, corrections, or a request to see or delete what we hold: email info@eanddcollective.com. We’ll answer within a few days.

Back to GoSEQ