YellowBus Privacy Policy
Effective date: 20 October 2026 Website: https://yellowbusapp.com Contact: info@yellowbusapp.com
YellowBus (“we”, “us”) provides a school-bus tracking service. It has a mobile app for parents and bus supervisors, and a website for schools and transport companies. This policy explains what personal data the service handles, why, who can see it, how long it is kept, and the choices you have.
1. Who is responsible for the data
- Your child’s school (or the transport company that runs the bus) decides whose data is entered into YellowBus. It manages the student, parent and supervisor records, so it is the main party responsible for that data.
- YellowBus operates the service on the school’s behalf, and keeps the data only to provide it.
- Operator: YellowBus. You can reach us at info@yellowbusapp.com.
- For questions about a child’s record, contact the school first. You can also contact us at info@yellowbusapp.com.
2. The data we handle
Entered by the school or transport company:
- Students:
- full name, grade and class, an optional student number and address notes;
- an optional photo;
- the pickup and drop-off points used to plan bus stops.
- Parents: name, email address or phone number, relationship to the child, preferred language.
- Bus supervisors: name, phone number, optional photo.
- Buses and runs: plate number, capacity, driver name and phone number, routes, stops and schedules.
Created when the service is used:
- Trip records: when a trip started and ended, and whether each child boarded, was dropped off, was absent or did not show up.
- Bus location during a trip. See section 3.
- Absences reported by parents or the school, with an optional note.
- Pickup-point requests a parent sends to the school (a proposed point on the map).
- Notifications and announcements sent to parents.
- Alerts a supervisor sends, such as a delay or an emergency.
- Speeding records for a trip: when the bus was over the school’s speed limit, for how long and the top speed. No location is stored with them.
- Account and security data: sign-in sessions, a device token so we can send notifications to your phone, and security logs (including the IP address and device type used to sign in).
We do not collect:
- contacts, messages, files or photos from your phone (beyond a photo you choose to upload);
- advertising IDs;
- any data from children directly. Children do not use YellowBus; parents and school staff do.
3. Location data
-
The bus’s location comes from the supervisor’s phone, only while a trip is in progress. Sharing stops when the trip ends, and it ends automatically after 4 hours at the latest.
-
A parent sees the bus’s live location only:
- for a trip that carries their own child;
- while that trip is in progress;
- and only if the school has turned the parent map on.
Parents never see other children’s homes or stops.
-
School staff (the school’s administrators) see their own school’s buses and trips.
-
On a parent’s phone, the app may use the phone’s location once, to centre the map when you choose a pickup point. That location is not sent to us or to the school. Only the point you place and send is shared.
-
On a supervisor’s phone, the map may show the phone’s own position (the “blue dot”). It is drawn by the phone’s map and is not stored by us.
4. Why we use the data
- To run the service:
- show trips, stops and the bus on the map;
- estimate arrival times;
- record who boarded and who was dropped off;
- notify parents;
- let schools manage buses, runs, students and staff.
- To keep accounts secure and prevent misuse.
- To send service emails, such as invitations, password resets and emergency alerts to school staff, and notifications in the language each person chose.
- To produce reports for the school, such as trip history and attendance.
We do not sell personal data. We do not use it for advertising, and we do not build marketing profiles.
5. Who can see the data
- The school or transport company: its own records only. Schools cannot see each other’s data.
- Parents: their own children’s information, and the bus location as described in section 3.
- Supervisors: the children and stops of the trips assigned to them. A parent’s phone number is shown to a supervisor only when the supervisor taps “call a parent”, and each such access is recorded.
- Service providers, who process data for us under contract and only to run the service:
- Amazon Web Services (AWS): hosting and databases, in the Middle East region; emails through Amazon SES.
- Google: maps in the app and website. For route and arrival-time calculations, only stop coordinates are sent, without names.
- Google Firebase: delivering push notifications to phones.
- Authorities, where the law requires it.
Some providers may process data outside Egypt. Where the law requires it, we put in place the safeguards required by Egypt’s Personal Data Protection Law (Law No. 151 of 2020).
6. How long we keep the data
We keep data only as long as the service needs it, then delete or anonymise it automatically:
| Data | Kept for |
|---|---|
| Bus positions recorded during trips | 30 days |
| Stop points copied into each day’s trip | 30 days |
| A simplified line of the route a finished trip took (no times or speeds) | about 6 months |
| Trip records, attendance marks, absences and speeding records | 400 days |
| Notifications in the parent’s inbox | 30 days |
| School announcements | 400 days |
| Decided pickup-point requests | 90 days |
| Home and drop-off points and address notes of a student marked inactive | deleted 400 days after the student became inactive |
| IP address and device type in security logs | 400 days, then removed from the log |
| Ended sign-in sessions and old password-reset links | 30 days |
Records stay while the school uses the service. When a school leaves, its data is deleted within 90 days of the end of its subscription, or sooner if the school asks.
7. Security
- Passwords are stored only as a strong one-way hash.
- Connections are encrypted (HTTPS).
- Every school’s data is kept separate, and each request is checked so that one school can never reach another’s data.
- Access tokens expire. Signing out, a password change or a deactivated account stops access, and stops notifications to that phone.
- We log only identifiers, never names, phone numbers or locations, in our technical logs.
8. Your rights
You may ask to access, correct or delete your personal data, or object to its use, as the law allows. Because the school manages student, parent and supervisor records, please contact your school first. We will help the school answer you, and you can also write to info@yellowbusapp.com. In the app you can already:
- change your language and name;
- change your profile photo;
- choose which notifications you receive (safety alerts from the school are always sent);
- sign out of all devices.
9. Children
YellowBus handles children’s data only because their school uses it to transport them safely. The data is entered and managed by the school, and seen by the child’s own parents and the school’s staff. Children do not create accounts or use the app.
10. Changes
We may update this policy. We will post the new version on this page with its effective date and, for important changes, tell schools and users in the app or by email.