Privacy Policy
Citybike Helsinki is an unofficial iOS app for the Helsinki and Espoo city bikes, made by ALeOps. It is not made by, endorsed by or affiliated with HSL (Helsingin seudun liikenne).
The short version
The app has no server. Nothing you do in it is sent to us, because there is nowhere for it to be sent. We collect nothing, store nothing about you, and there is no analytics, no advertising and no tracking of any kind.
What is stored, and where
Everything the app keeps lives on your iPhone or iPad and nowhere else.
- Your HSL session. When you sign in, the sign-in happens on HSL’s own web page inside the app. The resulting session cookies are stored by iOS in the app’s own website data store so that you do not have to sign in again every time.
- Your cyclist ID and season pass details. Saved in the iOS Keychain, marked as available on this device only, so that you can read the number off the screen in front of a bike even without a network connection. HSL does not send the PIN itself — it arrives masked — so the app never holds your PIN at all.
- Your recent rides and charges. Cached on the device so the app has something to show before the network answers.
Your HSL password is never stored, read or transmitted by this app. It is typed only into HSL’s own sign-in page, which runs inside a web view exactly as it would in Safari. The app has no access to what you type there.
Location
If you allow it, the app uses your location to centre the map on you and to sort stations by how far away they are. This happens entirely on the device. Your location is never transmitted anywhere, never stored between launches, and the app works without the permission — you simply have to pan the map yourself.
What the app connects to
- HSL (
hsl.fi,id.hsl.fi) — only when you sign in or when the app refreshes your own account data. These are requests to your own account, made on your behalf, the same ones HSL’s own website makes. What HSL sees is governed by HSL’s privacy policy. - The city bike open data feed (
gbfs.theta.fifteen.eu) — station locations and bike counts, published as open data under the Open Database License (ODbL) 1.0. These requests carry no identifying information about you. - Apple Maps or Google Maps — only if you tap “Directions” and choose one. The station’s coordinates are handed to the app you chose, and from that point their own privacy policy applies.
Deleting your data
Signing out inside the app clears the HSL session and erases the cyclist ID, PIN and cached rides from the Keychain. Deleting the app removes all of it as well. There is nothing left behind on any server of ours, because there is no server of ours.
To delete the HSL account itself, or the ride history HSL holds, contact HSL — that data belongs to your HSL account, not to this app.
Children
The app is not directed at children and collects no data from anyone.
Changes
If this policy changes, the date at the top changes with it.
Contact
Questions about this policy: [email protected]