What do GPS and navigation apps do with your data?

GPS and navigation apps great for exploring a new city or getting around an already familiar one. Unfortunately, as they become more popular throughout the world, online mapping and travel apps are storing a lot of our personal information. What's more is that they often then share this data with third parties.

So you know what's happening with your personal data, we've looked at the following apps:

• Uber
• Bolt
• Citymapper
• Google Maps
• Apple Maps
• Lyft
• Waze
• TFL apps
• Santander Cycles app

We read their privacy policies, and asked three questions:

1. What data of yours do they collect?
2. Do they share this data with third parties?
3. And if so, who with?

Remember, when we list the data a company collects on you this doesn’t necessarily mean the company shares all of this data with third parties, they may only share some of it.

Uber

What data do they collect?

Some examples:

• Name
• Email
• Phone number
• Login name
• Password
• Address
• Profile picture
• Payment
• Banking information
• Government identification documents (birth date, gender and photos)
• Vehicle/insurance information
• Emergency contact information
• User settings
• Evidence of health or fitness
• Occupation

As a driver, they collect:

• Driver’s license
• User feedback and ratings

Do they share data with third parties?

Yes,

With who?

• Uber affiliates and subsidiaries
• Regulatory authorities
• Third parties
• Uber partners
• Vendors, consultants, marketing partners, research firms, and other service providers

Bolt

What information do they store?

Data collected can include:

• Name, email, phone number, place of residence
• Geolocation of drivers and driving routes
• Information about vehicles (including registration number)

As a driver, they collect:

• Efficiency ratings
• Driver’s license, photo, profession, and identify documents

Do they share data with third parties?

Yes

With who?

• Bolt Technology group companies and partners
• Service providers
• Affiliates
• Advertising partners
• Business partners

Citymapper

What data do they collect?

Some examples:

• Personal information (name, email address, home address, mobile phone number, date of birth, address, payment details)
• Location information
• Device information (operating system, the hardware model, software, file names, preferred language, time zone settings, and device motion information)
• Log and usage information
• Payment information
• Log-in information

Do they share data with third parties?

Yes

With who?

• Search Partners (Google, Apple and Foursquare)
• Deeplink Booking (Kapten and Uber)
• Native Booking providers
• Analytics vendors (Google Analytics, Mixpanel, andFlurry))
• Crash/error reporting vendors
• Messaging apps
• Passengers and drivers
• Communication platforms

Google Maps

What information do they collect?

Data stored can include:

• Unique identifiers (password, name, email address phone number, and payment information)
• Business information (company profiles, social profiles, websites, company name and address)
• Browser information and settings
• Device type
• Device setting
• Operating system
• Mobile network information
• Carrier name
• Phone number
• Apps version
• Browsing history
• IP address
• System activity
• Date
• Time
• Referrer URL
• User activities (terms searched for, videos watched, voice information, purchase activity, activity on third party sites)

Do they share data with third parties?

Yes

With who?

Google affiliates

Apple Maps

What information do they store?

Data collected can include:

• Time the map was used
• Device model and software version
• Input language
• Device location
• Boundaries of the map area
• Search terms used by users
• Current device location
• Destination
• Mode of transport
• EV routing

Do they share data with third parties?

Yes

With who?

Mapping partners

Lyft

What do they collect?

Some examples:

• Device’s precise location at all times
• Precise location of scooters and e-bikes at all times
• Mobile sensor data (such as speed, direction, height, acceleration, deceleration, and other technical data)
• Ride information like the date, time, destination, distance, route, payment
• Promotional or referral code
• Interactions with the Lyft Platform (content viewed etc.)
• Device information i.e. model, IP address, browser, operating system
• Contact lists

Do they share data with third parties?

Yes

With who?

Third party service providers

Waze

What data do they store?

Date stored can include:

• Name and username
• Email address and phone number
• Destinations you may travel to
• Search queries, calendar information
• Files you have uploaded to the service, including voice and audio files
• Detailed location, travel and route information
• payment information
• chat messages and interactions on the platform
• Phone contacts (find friends feature)
• Device data
• Views and interactions with content and ads
• Your voice and audio information when you use voice and audio features
• Communication or other content you chose to share with any third party, including Waze users through the Services
• Your activity on third-party sites and apps that you chose to link to your Waze account or that you interact with through the Service

As a driver, they collect:

• Users you interacted with
• Rating that you have received from other users

Do they share data with third parties?

Yes

With who?

Companies or organisations connected or affiliated with Waze i.e. subsidiaries, sister-companies and parent companies

TFL Go

What information do they collect?

Examples include:

• Device type, model and Operating system
• Unique ID - pseudonymised from the device ID / MAC address, but providing the ability to track usage on a specific device over time
• Session information - number, duration, time/date, location (mapped to a region, for example, London Borough)
• When and where accessed (this is based on IP address and is not taken from device GPS data)
• Screens viewed and interaction on screens, for example, zooming and panning on the map
• App interaction - including stations tapped on and stations entered into the 'to' and 'from' fields in Journey Planner
• Behaviour flows (journeys through the app - for example, where someone exits)
• App crashes

Do they share data with third parties?

Yes

With who?

Service providers

Google

Santander Cycles

What data do they gather?

Some examples:

• Name and contact information (e.g. home address and address history, email address, home and mobile telephone numbers)
• Date of birth
• Financial details (e.g. income and account details)
• Location data
• IP address, MAC address
• Biometric data (fingerprints and voice recordings for TouchID and voice recognition)
• Information from credit reference or fraud prevention agencies, electoral roll, court records of debt judgements and bankruptcies
• Family, lifestyle or social circumstances
• Education and employment details
• Personal data about other named individuals

Do they share data with third parties?

Yes

With who?

• The Santander group of companies and associated companies
• Sub-contractors
• Legal and other professional advisors, including auditors
• Law enforcement bodies
• Courts
• The Financial Services Ombudsman
• Market research organisations