Privacy Policy

Last updated 25 October 2026.

Who we are

Brisbane Ferry is a community-built, unofficial app that displays live and scheduled departures for Brisbane's CityCat and CityHopper ferry services. The app is independent of and not affiliated with TransLink, Queensland Transport, Translink Transit Authority, the Brisbane City Council, or any ferry operator. Live data is sourced from TransLink's publicly published General Transit Feed Specification (GTFS) and GTFS-Realtime feeds.

This policy explains what personal information the app collects, why it collects it, how it's used, and the choices you have. If anything here is unclear, use the feedback button in the app to reach out.

What we collect and why

Location (iOS app only, on-device)

If you tap the Use my location button in the stop selector or the locate-me control on the map, the app requests your device's current location via the iOS location-services prompt. Your location is used only in-memory, only while that screen is open, and only to compute the nearest ferry terminal. Your location is never transmitted off your device and is not stored anywhere.

Location access is opt-in. You can decline the system prompt, revoke permission in iOS Settings at any time, or simply not tap the button. The rest of the app works without it.

Feedback form

If you submit the in-app feedback form, we receive the message you type. You can optionally include your name and email — both fields are optional and empty by default. Along with your submission we log the URL you submitted from, a timestamp, and your browser/OS user-agent string (this is routinely available to any web server).

Feedback is posted to a private channel on Discord (Discord Inc.) through a webhook, so the maintainer is notified. What is sent: your message, your name and email if you gave them, the page URL you submitted from, your user-agent string and a timestamp. Your IP address is not sent to Discord. Our server uses it only to limit how many submissions one address can make in a few minutes: it is held briefly in memory (or in our hosting provider's rate-limit counters) for that purpose and is not written to our logs or kept with your feedback. The content you type is not used for any purpose other than responding to your feedback.

On the website (not in the iOS app), the feedback form uses Cloudflare Turnstile to tell people from spam bots. It loads only when you open the form, usually runs without asking you anything, and sometimes shows a check to tick. Turnstile collects technical signals from your browser (such as its type and how the page was loaded) to make that decision, and it does not set advertising cookies. Our server sends the resulting one-time token and your IP address to Cloudflare to confirm the check; neither is stored with your feedback. See Cloudflare's Turnstile privacy addendum.

Analytics

We use two analytics services so we can understand general usage and keep the app performing well:

• Google Analytics 4 — counts visits and a few events: page views, an "engaged visit" (the page stayed open for a short while and you looked at a departure board or used it), a "return visit" (the first page of a visit from a browser that has been here before, worked out from a flag on your device), and saving a stop pair with Remember selection, which sends the origin terminal's public stop ID. Google also records session length, device and browser class, and an approximate city that Google works out from your IP address. Google Analytics sets cookies in your browser (_ga and _ga_*), plus Google Ads click cookies if you arrive from one of our ads. We don't send Google your location, the names of the stops you save, what you search for, or any personal details. Google signals and ad personalisation are turned off. Data retention follows GA4's default of 14 months. See how Google uses information from sites that use its services, or install the Google Analytics opt-out browser add-on.
• Vercel Analytics + Speed Insights — anonymous page-view counts and Web Vitals (page-load timings). No cookies; request-counted only.

The same Google Analytics property covers our sister sites too: brisbanebus.com, brisbanetrain.com, brisbanetransit.com and next.brisbaneferry.com, so a visit that moves between them counts as one. On those sites, saving a stop, station or terminal (the star on a board, or adding stops to My Transit) sends its public stop ID in the same way, and never its name.

You can block either service with any standard ad-blocker, Safari's intelligent tracking prevention, or your browser's Do Not Track setting (we honour it for Vercel Analytics; Google Analytics ignores DNT by default per its own policy).

Browser storage

The app uses your browser's localStorage and sessionStorage to remember preferences. Specifically:

• brisbane-ferry-selected-stops — the ferry stops you pick as origin/destination.
• brisbane-ferry-remember-selection — whether you opted in to remember your selection across visits.
• brisbane-ferry-schedule-cache-v2 — a cached copy of the daily ferry schedule (up to ~50 KB) so the app loads quickly.
• brisbane-ferry-selected-stops-session — temporary stop selections that only last for the current browser tab.
• brisbane-ferry-departure-time — the "depart from" time filter for this session only.
• bft-ga-engaged — notes for this browser tab session that the "engaged visit" analytics event has already been counted, so it is counted once.
• bft-ga-returning — notes that this browser has visited before, so the next visit counts as a "return visit" in analytics. It holds only the value 1, not an ID.
• bft-ga-session — notes for this browser tab session that the "return visit" check has been done, so it is counted once.

These keys stay on your device. Clearing browser data removes them. None of them are transmitted to our servers. (Google Analytics' own cookies are described under Analytics below.)

What we don't collect

• No account. No login. No password.
• No personally identifying information is required to use the app.
• No ads shown in the app and no third-party ad networks. We advertise the site on Google Ads and use Google Analytics to measure visits from those ads, with ad personalisation and Google signals turned off.
• No sale or sharing of your data with data brokers.
• No push notifications at present.
• No background location tracking.

Who your data is shared with

The app is a small piece of software talking to a few third-party services. The relevant flows are:

• TransLink — the app fetches public schedule and real-time feeds from TransLink's servers via our API proxy. No user-identifying information is sent to TransLink.
• Discord (Discord Inc.) — only receives your feedback (message, optional name and email, page URL and user-agent) if you submit the form. See Discord's privacy policy.
• Cloudflare Turnstile (Cloudflare Inc.) — runs the anti-spam check on the website's feedback form, and receives the check's token and your IP address when you submit it. See Cloudflare's Turnstile privacy addendum.
• Google Analytics (Google LLC) — receives the analytics events described above. No location, saved stop names, searches or personal details. See Google's privacy policy.
• Vercel (Vercel Inc., our hosting provider) — hosts the app and receives anonymous analytics events. See Vercel's privacy policy.
• Apple — if you downloaded the iOS app from the App Store, Apple provides crash reports back to us via App Store Connect (aggregated, no personal information). See Apple's privacy policy.

How long data is kept

• Feedback submissions are retained by the maintainer indefinitely unless you ask for them to be removed.
• Google Analytics: 14 months (default retention).
• Vercel Analytics: per Vercel's retention defaults.
• Browser storage: until you clear site data from your browser, or the schedule cache naturally expires after 24 hours.

Your rights

Depending on where you live, you may have the right to:

• Ask what personal information we hold about you.
• Ask for it to be corrected or deleted.
• Withdraw consent for analytics (block the scripts with your browser or ad-blocker).

Because the app collects so little (we don't know who you are), the most common request is "please delete my feedback submission". To make any request, use the in-app feedback button and include enough context (rough date, content, email you used) so we can find and remove it.

Children

Brisbane Ferry is not directed at children under 13 and does not knowingly collect personal information from anyone under 13. If you believe a child has submitted information, contact us and we will delete it.

Security

The app is served over HTTPS with a strict Content Security Policy and standard security headers (HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). The feedback webhook is authenticated with a shared secret that is never exposed to the browser.

International users

The app is hosted on Vercel's global edge network. Analytics providers (Google, Vercel) may process data in data centres outside Australia. If you use the app, your data may be transferred to and processed in countries other than your own in line with those providers' terms.

Changes to this policy

When this policy changes in a material way, the "last updated" date at the top will change and, if the change affects data collection, we'll note it in a short visible banner on the app. Continued use of the app after an update constitutes acceptance of the revised policy.

Contact

The quickest way to reach the maintainer is the feedback button inside the app. For privacy-specific questions, include "privacy" or "data" in your message so it's easy to find.