Privacy Policy

Who we are

Pakman Project ("we") runs UK Live Traffic: this website, and the UK Live Traffic Android app, which shows the same site and adds a screen for Android Auto. We decide how the personal data described here is used, which makes us its "controller" under UK data protection law. You can reach us at pakmanproject@gmail.com.

The short version

• There are no accounts, no adverts, no analytics and no cookies, and we never sell data.
• Your exact position stays on your device unless you ask for something that needs it: directions, a shared trip or a driver report.
• We keep very little: driver reports and shared trips until they end plus about a day, and a short error log.
• UK Live Traffic Plus, the optional subscription in the Android app, is bought through Google Play: we receive no payment details, and the app keeps on the phone only whether Plus is on and when it last checked.

Using the map

Your device asks our server for the data for the part of the UK in view: roads, cameras, buses, trains, ships, aircraft, weather and so on. Like any website, our server can see the network (IP) address and the browser details of each request, and uses them to answer it and to stop misuse.

All of this is public data, fetched by our server for everyone. The organisations that publish it receive requests from our server, not from you, and are not told who you are. For road closures and parking rules in traffic orders, our server uses an account of its own with the Department for Transport's Digital Traffic Regulation Orders service (dtro.dft.gov.uk). Our server runs on Oracle Cloud Infrastructure in London.

The newer feeds work the same way: flood warnings from the Environment Agency and Natural Resources Wales; live road closures, incidents, temporary speed limits and road signs from National Highways' Digital Lab; the rain forecast pictures from the Met Office's Weather DataHub (Map Images, asked for about once an hour); the weather forecast and cloud cover from MET Norway (api.met.no), whose requests carry our site's address and our contact as it asks; the air quality forecast from Defra's UK-AIR (uk-air.defra.gov.uk); and the bank holiday dates from GOV.UK. The flight routes come from a copy of Virtual Radar Server's standing data kept on our server. The collision hotspots (from the Department for Transport's road collision statistics, STATS19) and the level crossings and schools (from OpenStreetMap) are copies kept on our server. None of these organisations is sent anything about you.

A little of it is sent to our server instead of fetched: the Department for Transport's Street Manager sends the roads that councils and utility companies are closing for works through Amazon's notification service. Our server checks each message with Amazon's signing certificate, which it fetches from sns.eu-west-2.amazonaws.com. These messages are about works at places and nothing about you, and our server sends nothing about you in return.

A number plate, when you look up a vehicle's MOT and road tax dates in Trip options, is sent through our server to the Driver and Vehicle Licensing Agency's Vehicle Enquiry Service, which answers with the vehicle's dates, fuel and year. The Agency gets the plate and our server's address, not yours. Our server does not store or log the plate, and keeps no copy of the answer; the dates, fuel and year are kept in your browser with your vehicle.

Logs

Our web server keeps no log of ordinary visits. If a request fails part-way (a connection drops before the answer is finished, say), the server's error log can record that request: the network address it came from, the page or data asked for, and your browser's details. When your browser reports an error (see below) the site writes one line about it.

These lines go to the server's system log, which is limited by size rather than by date, so the oldest lines are discarded as new ones arrive. They are read only to find and fix faults.

Your location

If you press the locate button or start navigation, your phone or browser asks your permission first. Your exact position is then used on your device to show where you are and to guide you. It is not sent to us unless you ask for directions from where you are, share a trip or send a driver report, as described below. You can switch location off at any time in your browser's or phone's settings.

The part of the map you are looking at is used to fetch what is there, and the weather and air quality for it, rounded to about 10 km.

Directions and trips

When you ask for directions, the places (the start, the end and any stops, which can be where you are) and the way of travelling go to our server, which asks our own routing server, Valhalla, running on the same machine. Public transport trips are also sent, with the time, to Transport for London's Journey Planner (api.tfl.gov.uk); where our own timetable planner is switched on it answers them on our machine. Where our routing server cannot answer, and for some drive-time estimates, the two places may go to TomTom (api.tomtom.com).

For a drive that leaves within a day, our server also asks MET Norway (api.met.no) for the forecast at the middle of the route, rounded to about 25 km, and reads the cloud cover for the hour you will be there, so that the low-sun warning is not given under thick cloud; nothing about you goes with it, and the forecast is held in the server's memory, not on disk.

For a drive, our server also checks the routes against its own copies of the level crossings, schools, collision hotspots, flood warnings, road closures and National Highways incidents, to warn you of them on the way; the routes are not sent to the organisations those lists come from. While you follow a drive, your device asks our server once a minute for the National Highways road signs in a box round the next 10 km of the route; they come from our server's copy of the national list, so nothing about your trip goes to National Highways.

When you ask for a walk or ride after dark with *Prefer well-lit streets* on, our server may also ask Ordnance Survey's data service (api.os.uk) which roads and paths along the routes have street lights. It sends the map squares of about 370 metres that the routes pass through, with our own key, not the routes themselves or anything about you; the answers are held in the server's memory for up to six hours and not written to disk.

These requests carry no name, account or device identifier, and they come from our server, so the services above see our server's address, not yours. Answers are held briefly in the server's memory so that a repeat is quick, are not written to disk and are not linked to you.

Searching for places

The words you type in the search box (three characters or more) go to our server and on to Photon (photon.komoot.io, run by komoot), a search service built on OpenStreetMap, together with the middle of the map, rounded to about 11 km, so that nearby places come first. When you press Enter, the words go the same way to Nominatim (nominatim.openstreetmap.org), OpenStreetMap's own search service. Pressing and holding the map sends that spot, rounded to about 10 metres, to Nominatim to find its name and address, or to Photon when Nominatim cannot answer. Our server remembers an answer for up to a day (a search as you type, or a spot's name) or a week (a full search after Enter), so that the same request is not asked twice; it holds the words searched, not who searched. Nearby shops and restaurants come from our own copy of OpenStreetMap, so nothing about where you are goes to another service for them. Plus Codes are worked out on your device.

When what you type looks like a UK postcode, your device asks postcodes.io directly (see below).

Driver reports

If you send a driver report (police, crash, hazard, closed road, mobile speed camera, jam or breakdown), or say that one is still there or gone, we store its kind, its position (to about a metre), the time, and a random identifier your browser made the first time you used the feature. The identifier is not linked to your name, account, phone number or network address. It is there so that one device cannot flood the map and cannot confirm its own report.

Reports are shown to everyone. A report lasts between 45 minutes and 6 hours depending on its kind (up to twice as long if others confirm it), and is deleted from our database, with the votes on it, about a day after it ends. At most 8 reports an hour from one device and 60 from one network are accepted. To count them, our server turns your network address into a short code using a random salt that changes whenever the server restarts; the code lives in memory and is never written down.

Sharing a trip live

If you choose to share a trip, we store the name you typed (30 characters at most), the destination and expected arrival if there are any, and only your latest position, heading and speed, updated as you travel, never the places you have been. Anyone with the link can see it. The link is long and random and is not listed anywhere.

Sharing ends when you stop it (your position is deleted at once), when you arrive (it stays on show for ten minutes), or half an hour after the expected arrival; no trip is shared for more than twelve hours. The record is deleted from our database about a day after it ends. The key that lets only you update your trip is kept as a hash.

Error reports

If part of the app breaks, your browser may tell our server in one short message: the error text, the first lines of its technical trace, which part of the app it was, the page address (without anything after the ?), the build number, and the make of your browser and system, such as Chrome on Android. It is meant to hold the fault, not what you were doing. Our server writes it as one line in its log (above) and keeps it nowhere else. At most 10 an hour are accepted from one network.

What stays on your device

Your settings, Home and Work, saved places, recent searches, saved routes, vehicle details, trip options, the last trip, the map layers you chose, whether the 3D map is on and the random identifier for driver reports are kept in your browser's storage on your device, and the map along a trip you follow is kept until the trip ends (the Cookies Policy lists them). They reach us only when you ask for something that needs them, for example directions from Home. Clear data on this device in Settings removes them.

Other organisations your device talks to directly

A few things load straight from other organisations rather than through our server. They can see your network address and browser details, as any website you visit would, and their own privacy policies apply, not this one.

• OpenFreeMap (tiles.openfreemap.org) supplies the map pictures, labels and fonts. It sees which map tiles you load, which shows roughly the area you look at. While you follow a trip, your device also fetches the tiles along the route ahead of time (on mobile data only if you allow it), so OpenFreeMap sees roughly the area of the route.
• Esri supplies the satellite map through its ArcGIS Location Platform: the pictures from ibasemaps-api.arcgis.com and the place names over them from static-map-tiles-api.arcgis.com. Your browser may open a connection to it as the page loads, to be ready, and asks it for pictures, with our site's key, when you choose the satellite map; they are not kept on your device.
• Amazon Web Services (s3.amazonaws.com) supplies the ground heights of the 3D map's hills (the Terrain Tiles) while the 3D button is on. It sees which tiles you load, which shows roughly the area you look at.
• postcodes.io (api.postcodes.io) is asked, from your device, for any UK postcode you type in the search box.
• Traffic camera pictures load from the camera's publisher when you open a camera: Transport for London's picture host, or North East Traffic Cameras (www.netrafficcams.co.uk).

The Android app

The Android app is this website in an app, plus a screen for Android Auto. It asks for permission to use your precise and approximate location, and uses it only to show where you are and to guide you while you use the app. While you follow a trip the app keeps using your location, and speaking the directions, when the screen is locked or another app is in front, so that you can put the phone in your pocket; it says so in a notification that is shown for as long as the trip is followed, with a Stop button, and it stops when the trip ends or you stop it. Your position still stays on your phone, except as described above (a route asked for again from where you are, a trip you share). It contains no advertising, analytics or tracking code: the only libraries in it are Android's own, Google's Android for Cars App Library, Google's Play Billing Library (which sells UK Live Traffic Plus through Google Play) and MapLibre Native, which draws the car's map. The app adds its name and version to the browser details its pages send (OpenFreeMap asks for this).

UK Live Traffic Plus is bought, renewed and cancelled through Google Play, under Google's own terms and privacy policy. We receive no payment details, name or email address from it, and keep no record of purchases on our server. The app asks Google Play whether the Google account on the phone holds Plus, and keeps on the phone only whether Plus is on and when Google Play last said so (so that Plus keeps working for up to a week without a connection); the page in the app is told the same, with the prices Google Play shows, to display them.

On Android Auto the next turn, distances and map are drawn on the car's screen from your phone; they are not sent to us. The car's map loads its map pictures from OpenFreeMap (tiles.openfreemap.org) on your phone, as the site does. So that the car's screen can offer them in its Go list, the app keeps on the phone your Home, Work, saved places and the last few places you searched for; a trip started from that list asks our server for the route from where the car is, as directions do (above).

If you turn on a route alert in the app (Settings, Places and privacy), the app asks our server, for each alert that is on, 30 minutes before the time you set on the days you chose, for a drive between your Home and Work, as a drive is asked (with the options you chose in Trip options). That is at most twice a day. The answer is used on your phone only, to decide whether to tell you of a closure, incident, warning or crash report on the usual route; the route itself is held in the server's memory for up to a day, as any route is (see How long we keep things). The home-screen widget, if you add one, asks the same two drives (Home to Work and back) about every 30 minutes while it is on your home screen, to show their usual times; it never uses where your phone is. Nothing else is sent: the reminders for your vehicle's MOT, road tax, insurance and service dates are worked out on your phone, and the app keeps your alert settings and dates on the phone only.

How long we keep things

• Visits to the map: not recorded.
• Searches, places and routes: in the server's memory for up to a day, then dropped; a restart empties it.
• Log lines: until the system log's size limit pushes them out.
• Road closures for works, from Street Manager: until the works end, plus two days.
• Road closures in traffic orders, from D-TRO: until they end, plus a day.
• Driver reports and their votes: until they end, plus about a day.
• Shared trips: until they end, plus about a day.
• On your device: until you clear it. Whether Plus is on, in the Android app: until you uninstall the app or clear its data.

Everything travels over HTTPS.

Our grounds for using it

Legitimate interests: running a free map service, keeping it secure and working, and fixing faults. That covers the short codes used to limit requests and the error reports.

Consent: your device's location, which you give through your browser's or phone's permission prompt and can withdraw in its settings.

Contract: UK Live Traffic Plus, which you buy through Google Play. The app checks with Google Play that you hold it, so as to give you what you paid for.

When you ask for directions, a search, a driver report or a shared trip, we use what you send to answer it.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you, to correct or delete it, to restrict or object to how we use it, and to have it in a portable form. With no accounts, we can find data only if you can point to it: a shared-trip link, or the random identifier in your browser (stored as uk-live-traffic:device, which you can see in your browser's developer tools). Most of what we hold goes by itself within about a day.

Write to pakmanproject@gmail.com and we will reply within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Children

UK Live Traffic is not aimed at children, and we do not knowingly collect their data.

Changes

We will change this policy when what the app does changes. The date at the top says when it was last updated.