Privacy notice
Effective 6 October 2026. Last updated 6 October 2026.
Who processes the data
The controller is Ilya Fedorov, a natural person, Vysokoškolákov 8215/18, 010 08 Žilina, Slovakia ("we"), who runs the punkto.sk service. You can reach us by e-mail at [email protected]; more on the Operator and contact page.
This notice meets the information duty of Art. 13 of Regulation (EU) 2016/679 (GDPR) and section 19 of the Slovak Personal Data Protection Act 18/2018.
Overview: what, why, legal basis, who receives it, how long
The table lists everything we process when you use Punkto. We collect nothing else.
| Data | Purpose | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Server logs: IP address, user agent, time, requested address (URL including query, so also the text you typed into a search) and status code | Security, operation and troubleshooting | Legitimate interest, Art. 6(1)(f) GDPR | Cloudflare and Contabo GmbH, server hosting (processors); the server we operate | Up to about 5 weeks (35 days) |
| Location and coordinates: in the request address when you plan a journey, a walking or cycling route, look up departures nearby or find the address of a point | Answering your request | Consent, Art. 6(1)(a) GDPR, given through your browser's location permission; for a point picked by hand on the map, legitimate interest, point (f) | Cloudflare (processor) while it transmits the request; nobody else, except the address lookup (below) | Not stored beyond server logs (up to about 5 weeks) |
| Address lookup: coordinates are sent from our server to Photon (Komoot GmbH, Germany), without your IP address | Showing an address instead of coordinates | Consent (device location), point (a); point picked by hand: point (f) | Komoot GmbH | With us only in the cache below; at Komoot per its policy |
| Address cache: coordinates rounded to three decimals (about 100 m), the address label found and the time it was stored; no IP address and nothing about who asked | Faster answers and fewer requests to Photon | Legitimate interest, point (f) | Nobody | At most 30 days |
| Carrier journey search at RegioJet and FlixBus: a station or city identifier for the start and end and the travel date, sent from our server; no coordinates, no IP address of yours and no account | Showing these carriers' connections and prices | Legitimate interest, point (f) | RegioJet, FlixBus (independent controllers) | With us only in server logs; at the carriers per their policies |
| Data on your device (localStorage and service-worker cache): language, appearance, saved places, kept trips, ticket and map settings, install-prompt state, city timetables downloaded for offline use | Functions you asked for, including offline mode | Strictly necessary for the requested service (section 109 of the Slovak Electronic Communications Act 452/2021); it does not reach us | Nobody, the data never leaves your device | Until you delete it (browser settings) |
| Map: your browser itself fetches tiles from CARTO and, when you turn them on, satellite imagery from Esri and the rain radar from RainViewer. They see your IP address, user agent and the map area you view | Displaying the map you opened | Legitimate interest, point (f): the map cannot be shown without these requests | CARTO, Esri, RainViewer (independent controllers) | Per their policies, see below |
| Correspondence: your e-mail address and the content of a message you send us | Handling your message | Legitimate interest, point (f), or fulfilling your rights request, point (c) | E-mail provider (Google) | While handling it, then at most 12 months |
Legitimate interests: keeping the service secure and working (logs help detect abuse and faults), answering quickly (the cache) and showing the map you opened. These interests are narrow, the data is used only for the stated purpose and the impact on you is low because we keep no accounts or profiles. If you have a reason why this does not hold in your case, you can object (see Your rights).
Location in more detail
Your browser asks you whether it may share your position. Without your permission we do not get it, and the app keeps working, only without nearby stops. You can withdraw the permission at any time in the browser settings.
Providing data is neither a statutory nor a contractual requirement, and you need none of it to use the service. If you do not share your position, nearby stops are not shown and planning from your position, routes from it and nearby departures will not work. You can still search for a journey, route or departures by entering a place by hand.
The position is used in the browser to show nearby stops. When you plan a journey or a route or look up nearby departures, the coordinates are sent to our server in the request address so that it can answer. They are not tied to an account or a name, because there are no accounts.
The request address, including coordinates, is written to the server log and deleted after about 5 weeks at the latest (35 days). The address cache keeps only rounded coordinates and the address label, for at most 30 days.
Data stored on your device
Punkto sets no cookies. It stores on your device only what the functions you asked for need: your chosen language and appearance, saved places (such as home), kept trips, ticket and map settings, whether we have offered you installation, and downloaded city timetables for offline mode. If Cloudflare were to set a technical cookie to protect against abuse, it is a strictly necessary security cookie with no tracking.
This data is not sent anywhere. You delete it in your browser settings (site data) or by uninstalling the app. Because the storage is strictly necessary, we do not ask for consent (section 109 of Act 452/2021).
Services your browser contacts
When a map is shown, your browser connects directly to the services below. We are not their processor and cannot see what they record. See their notices for details. Cloudflare may instruct your browser to send a network-error report to a.nel.cloudflare.com after a failed connection; this happens only on an error.
- CARTO (base map): carto.com/privacy
- Esri (satellite imagery, only if you choose it): esri.com privacy statement
- RainViewer (rain radar, only if you turn it on): rainviewer.com/privacy.html
- Komoot GmbH (Photon, address lookup; it receives coordinates from our server, not your IP address): komoot.com/privacy
Fonts are served from punkto.sk itself, so we do not load them from third parties. Weather and air quality are fetched by our server from OpenWeather and WAQI: it sends them the coordinates of the centre of the city shown on screen (not your position or IP address), so the most the request reveals is which city you are looking at. When you search for connections, our server sends RegioJet and FlixBus a station or city identifier for the start and end and the travel date (not coordinates, your IP address or an account). The text you type into a place search is handled by our own server and stays only in its logs.
Processors and transfers outside the EU
Cloudflare, Inc. delivers punkto.sk as our processor: traffic passes through its network, so it sees visitors' IP addresses. A data processing agreement applies and, for transfers to the USA, the safeguards of Art. 46 GDPR: Cloudflare is certified under the EU-U.S. Data Privacy Framework and uses standard contractual clauses as a fallback (we will provide a copy of the safeguards on request). Cloudflare keeps its own logs under its own policy, whose periods we do not control. We run the server with the hosting provider Contabo GmbH (Munich, Germany) in its data centre in Nuremberg, that is inside the EEA; Contabo, as a processor, supplies only the infrastructure. Details: cloudflare.com/privacypolicy.
Some services from the previous section may also process data outside the EEA, in particular in the USA. Data reaches them when your browser requests the relevant map tile, and their operator sets the transfer terms. The same applies to the mailbox (Google LLC), which may process messages in the USA; Google is certified under the EU-U.S. Data Privacy Framework.
What we do not do
- We use no cookies, analytics, advertising or behavioural tracking.
- We do not profile you or take automated decisions with legal effects on you.
- We do not sell your data or share it for advertising.
The project is commercial and is planned to earn money later, for example through ads, analytics or partner links. If that happens, we will first update this notice and announce it on this page, and ask for your consent where the law requires it.
Your rights
You have the right of access to your personal data, to rectification, erasure, restriction of processing and data portability. You can withdraw your location consent at any time in the browser settings without affecting earlier processing.
Right to object: you can object at any time, on grounds relating to your situation, to processing based on legitimate interest, by e-mail to the address below. We will then stop, unless we show compelling legitimate grounds that override your interests.
To exercise your rights, write to [email protected]. Because there are no accounts, we can identify you only from what you send us, such as an IP address and a time range. Without them we may not be able to find a record. We answer within one month.
Complaint to the supervisory authority
If you think we process data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk. You can also contact the supervisory authority of the EU state where you live or work.
Children
Punkto is not directed at children under 16 and we do not knowingly collect their data. You share your position only when you allow it in the browser.
Changes to this notice
We may change this notice, for example when a new feature is added. The current version is always on this page with its effective date. We will announce material changes on this page at least 30 days in advance, and they will not apply retroactively.