Privacy policy
What the gtfs.media website and managed service collect, what happens to your agency's feed data, and why there is nothing here that tracks riders. We do not sell data or logs, to anyone, ever.
Effective August 18, 2026
1. Who we are
gtfs.media is operated by FivePaths, LLC. This policy covers the gtfs.media website and the managed hosting service we run for transit agencies. Reach us at hello@gtfs.media.
2. This website
The pages on gtfs.media are static. They set no cookies and run no analytics, trackers, or third-party scripts, so a visit here leaves no profile of you anywhere. Fonts, the stylesheet, and logos load from cdn.fivepaths.com, which FivePaths also runs. Cloudflare hosts the site and processes requests at its network edge, as any host does.
3. Email
Mail to hello@gtfs.media is forwarded through Cloudflare Email Routing to FivePaths staff. We keep correspondence as an ordinary business record and use it only to work with you.
4. The managed service
The managed service ingests the GTFS and GTFS-Realtime feeds your agency already publishes: routes, stops, schedules, vehicle positions, and service alerts. That is public transit data, not personal information, and it is continuously replaced as your feeds update. When an engagement ends, we delete your instance and its data.
Rider-facing surfaces (departure displays, maps, timetables, and the JSON API) serve without accounts, sign-ins, cookies, or tracking. We do not collect rider locations, build audiences, or profile anyone who looks at a screen.
Agency staff who administer a managed site have accounts there; those hold the name and email address needed to sign in, and nothing else. Server logs exist for operations and troubleshooting and are not used for any other purpose.
5. Self-hosted installations
The module suite is open source, and if you run it on your own infrastructure, we receive nothing: no telemetry, no phone-home, no copy of your data.
6. Where your data goes, and where it doesn't
We do not sell your data, your feed content, or our logs. We do not share them with advertisers or data brokers. Data is handled by Cloudflare as our host, and by FivePaths staff operating the service. Authorities get data only if the law requires it, and it never has.
7. Changes
Material changes to this policy will be posted here with a new effective date.
8. Contact
Questions or deletion requests: hello@gtfs.media.