The Local Bus
The Local Bus
What this site keeps about you, which is not much, and why. Last changed 10 October 2026 (you can save stops, routes and buses on your device without an account).
The site is operated under the trading name The Local Bus by its owner, an individual rather than a registered company, who is responsible for the details described here. If anything is unclear or wrong, the contact page reaches them directly.
One cookie, tlb_session, is set when you sign in. It holds a random session id and nothing else, it cannot be read by scripts, it is only sent over HTTPS, and it lasts 90 days or until you sign out. Without it you cannot stay signed in, which is the only thing it does. No cookie is set for visitors who do not sign in.
A few things are kept in your browser's own storage, on your device. All but two are never sent anywhere:
Your browser also keeps public answers from the site — timetables, reliability figures, operator lists — for a minute or two, as it does for any website, so that going back a page does not fetch it again. Nothing tied to your account is cached that way.
Because none of this is used to track you across sites, and the cookie is strictly needed for the thing you asked for, UK law does not require consent for it. The notice you see the first time is there so you know, not to ask.
The site counts how many people read each kind of page each hour, and for how long, so its owner knows what is used. It records the shape of the page, such as /route/:operator/:line, never the particular route, stop or bus you looked at. Your browser makes up a random code for the tab, so the count can tell twenty readers from one reader twenty times; the code is never connected to an account and is gone when the tab closes. The hourly counts are kept for 90 days.
To tell new readers from returning ones, your browser keeps the date of your last visit on your device. Once a day it sends that date with the first page you read, and the site adds one to a count for "today, last here this many days ago" (or "first visit"). That count is all that is kept: no code, no address and no list of dates, so the site cannot join one of your visits to another. Clearing your browser's storage, or a private window, makes you a new reader again. These counts are kept for 90 days.
The counts also say how readers found the site. With the first page a tab opens, your browser sends the name of the website that linked to it, such as www.google.com, which your browser passes to every site it links to; the address of the page you came from is not sent, and nor is anything you searched for there. If the link was tagged with a source, such as utm_source=facebook, that tag is sent instead. The site adds one to a daily count for that kind of source (a search engine, a social or messaging app, a shared journey, another website, or no link at all) and the website's name. Nothing else is kept with it, so it cannot be joined to you or to your other visits. These counts are kept for 90 days.
The counts also say roughly where readers are: the town your connection comes from, worked out from its network address using a copy of the DB-IP city database kept on our own server. The address is used for that lookup and then dropped; it is not stored, and it is not sent to anyone else to look up. What is kept is the town's name and the position of the town itself, never a position for you, and it is often the town where your network provider connects rather than where you are. Towns are counted per kind of page per day, kept for 90 days; the live map on the admin page shows the towns of the tabs open right now, kept for thirty minutes.
When you search for a stop, route or bus, or look up a place in the journey planner, the site counts what was searched for once the search has settled, so its owner can see what people look for and, most of all, what they look for and do not find. It records the words, which search box, whether you picked a result and what kind, the region of what it found (worked out from the stop, route or place, not from you), and the town your connection comes from as above. It does not record who searched, or link one search to another. A full postcode is counted as the word "postcode" and never kept as itself. Search counts are kept for 90 days.
The map only asks for your location when you tap the locate button, and your browser asks you first. The position is used on your device to centre the map and find nearby stops; it is not stored and not sent to us. If you type a postcode into a search, the postcode alone is sent to postcodes.io, a free service, to turn it into a place on the map. Place names are looked up on our own server.
An account is an email address. To sign in you are sent a link, which works once and expires after fifteen minutes; you can also set a password, which is stored as a salted hash and never in a form we can read. Sign-in links are sent from the site's own mail server, on the same machine as the site, so no other company sees your address to deliver them. Attempts to sign in are recorded with the network address they came from, so that guessing can be slowed down, and are deleted after 30 days; the record of a sign-in link is deleted a day after it expires.
Each signed-in browser is a session with the browser's description and the time it was last used, so the account page can show you where you are signed in and let you sign the others out. Sessions end after 90 days, or when you sign out.
You can add a username, a short bio, a picture of yourself and choose whether your profile is public. You can save favourite stops, routes and buses, pick a home region, and turn notifications on or off with quiet hours. All of this is optional, visible to you on your account page, and removed when you delete your account.
Corrections to a bus's details are kept with your account and shown to a reviewer, who accepts or declines them. Accepted corrections become part of the public fleet record; what was declined is between you and the reviewer.
Pictures you upload are re-encoded before they are stored, which removes the hidden data cameras add, including where the picture was taken. The caption, date and bus you give are kept with the picture. A reviewer looks at every picture before it goes public; once accepted it appears on the bus's page and in the bus gallery under your username.
Messages through the contact page are kept with the name and email address you give, the page you sent them from and the network address they came from, so that abuse can be dealt with. They are read by the site's staff and answered by email from contact@thelocalbus.uk, sent from the site's own mail server. They are kept until they are no longer needed for that.
If you turn notifications on, your browser gives the site a delivery address at the push service your browser uses, run by Apple, Google or Mozilla depending on the browser. We keep that address and the browser's description so we can send to it, and the notifications themselves for you to read on your account page. Turning notifications off, or deleting your account, removes the address. If you also ask for alerts by email, the same alerts go to your address from the site's own mail server, and stop when you untick it.
The web server keeps a log of requests: the time, the address requested, the response and its size, and the network address it came from. Headers, including cookies and the browser's description, are not logged. Log files are kept for at most a week, and are used to find faults and abuse.
The site is hosted by netcup on a server in the European Union. Bus positions, timetables and disruption notices come from the Department for Transport's Bus Open Data Service and from bustimes.org; they contain nothing about you.
Nothing is sold or shared for marketing. The people who run the site can see accounts, contributions and messages in order to run it. Beyond them, two services handle small pieces on our behalf: postcodes.io turns postcodes into map positions, and your browser's push service delivers notifications. Email is sent from our own mail server. No one else receives anything about you.
| Reading counts, by page shape and hour | 90 days |
|---|---|
| Reading counts, by page shape, town and day | 90 days |
| Search counts, by words, town and day | 90 days |
| Tabs open right now, by region and town | 30 minutes |
| Web server logs | up to 7 days |
| Sign-in sessions | 90 days, or until you sign out |
| Sign-in link records | 1 day after they expire |
| Sign-in attempts | 30 days |
| Account, favourites, profile, contributions | until you delete them |
| Contact messages | until no longer needed |
| Bus positions (not about you) | 14 days |
If this page changes in a way that matters, the date at the top changes with it and the notice shows again.