Privacy policy

Last updated November 11, 2026

Riders’ Watch lets TTC riders share and confirm fare inspector sightings. We collect as little as we can, keep it briefly, and never sell it or use it for advertising.

What we collect

• Your email address, only to confirm your account and let you reset your password. It is never shown to other riders.
• Your password, stored only as a one-way scrambled hash. Nobody, including us, can read it.
• Your username, which is public and appears next to your alerts.
• Your alerts: the stop or station, route, how many inspectors, how they were dressed, the time, and any optional details you add about where they are.
• Your starred stops and routes, so we can show and notify you about them. Only you can see them.
• A notification address for your device, only if you turn on notifications. It lets us send alerts about your starred stops, and is deleted when you turn notifications off.
• Your votes (“I see them too” and “Not there”). Other riders see only the totals, never who voted.

We don’t collect photos, your location, contacts, or names or descriptions of anyone you see. We don’t use analytics, ads or tracking cookies.

How long we keep it

• Alerts are deleted automatically about 6 hours after they’re posted.
• Votes are deleted after 30 days. They’re kept that long only to calculate trust ranks.
• Your account, email and username are kept until you delete your account.

Who processes it

Our database and sign-in system are run by Supabase. The website is hosted by Cloudflare, which may also run a CAPTCHA check (Cloudflare Turnstile) on sign-in forms to block bots. These providers may process technical data such as IP addresses to keep their services secure, and their servers may be outside Canada.

Stored on your device

When you sign in, your browser stores a sign-in token so you stay signed in. The app also saves a copy of the TTC map so it opens quickly. Signing out removes the token.

How we protect it

All traffic is encrypted with HTTPS. Database rules let riders change only their own data, and the site sends strict security headers.

Your choices

You can delete your account at any time from the You tab. That removes your email, username, alerts and votes. To ask what we hold about you, correct it, or make a privacy complaint, email riderswatchsupport@gmail.com. You can also contact the Office of the Privacy Commissioner of Canada.

Changes

If this policy changes, we’ll update the date at the top and note major changes on the site.