Station Agent

Privacy Policy

Station Agent ("we", "us", "our") is an AI-powered transit companion app developed by Terror Bot Labs. This Privacy Policy explains what information the app handles, what Station Agent stores, and what is processed by service providers when you choose to use AI, voice, location, or map features.

You can open Station Agent, use local trip features, and keep saved trips without an account. AI chat and voice require a separate AI-consent choice, Sign in with Apple, and a payment method because those features are billed by usage. You can change AI consent or delete your billing account later in Settings.

Information We Collect

Location Data

• Precise and approximate location: If you grant permission and ask to use your current location, the app first requests a lower-accuracy fix and may then refine it. The app sends the available coordinates to Station Agent's server to find nearby transit, plan a trip, and create a readable location label.
• A trip with a named starting point does not require GPS. You may deny or revoke location permission and continue using named origins.
• Station Agent does not create a permanent trip-location history. Short-lived in-memory geocoding caches may retain rounded coordinates and derived place labels for up to one hour to service repeated requests. Location context may also be sent to the third-party processors listed below when it is needed for the feature you requested.

Chat Messages

• Typed messages and accepted voice transcripts are transmitted to our server and processed by OpenAI GPT-5.6 Sol through the Responses API.
• When you are signed in, OpenAI requests include a stable one-way safety identifier derived from your app-specific Apple user ID. This supports abuse prevention and means request content, searches, and location context may be linkable to your Station Agent account while processed or retained by a provider.
• Transit routes, stops, schedules, fares, and alerts come from Station Agent's available transit-data proof pipeline rather than model memory. Current non-transit questions may use OpenAI web search and display the returned sources.
• Station Agent itself does not save a server-side conversation history. This statement describes Station Agent's storage only; OpenAI is a separate processor with the limited retention described under Third-Party Processing below.

Microphone and Voice

• During microphone dictation or voice chat, the iPhone records a short in-memory audio clip. OpenAI provides the transcript; Apple speech recognition is not used.
• A short, bounded audio clip is sent through our server to OpenAI's transcription service. Only an accepted high-confidence transcript is sent to GPT-5.6.
• Station Agent holds the audio only long enough to transcribe that turn and does not add it to a conversation history. Spoken replies are generated from the same approved text shown in the app. OpenAI's separate processing terms still apply.

Saved Trips and Widget

• Saved itineraries and the upcoming-trip widget projection are stored locally on this iPhone, including in the private App Group shared by Station Agent and its widget.
• You can delete this local trip data in Station Agent Settings or by uninstalling the app. Community stop reporting is disabled in this release.

Sign in with Apple and Billing

• When you choose paid AI chat or voice, Apple provides a stable app-specific user identifier and may provide your name or email/private relay address. Station Agent stores the app-specific identifier, an optional display name, and an encrypted Apple refresh token used only to support secure sign-in and account revocation. An Apple-provided email or relay address may also remain in the signed account session saved on this iPhone until sign-out, account deletion, session expiry, or app deletion; it is not used for marketing.
• Apple may send signed server-to-server notifications if you revoke consent or delete your Apple account while Station Agent is closed. Station Agent uses the app-specific subject only long enough to derive the same keyed one-way account digest, then closes the affected account generation and invalidates its earlier sessions. We retain the Apple-signed authorization generation time so a delayed older notification cannot close a newer authorization.
• Stripe processes your payment method and returns customer, payment-method, setup, and charge identifiers. Station Agent stores those identifiers and billing status, but never receives or stores your full card number or security code.
• Station Agent retains a linked usage ledger containing the AI provider, model, feature type, token counts, actual provider cost, the 15% service/server fee, timestamps, payment status, and Stripe charge identifier. It does not contain your prompt, response, precise location, or voice clip.
• Billing data is used only to provide paid AI features, calculate and collect usage charges, prevent abuse, support disputes, and satisfy financial and legal obligations. It is not used for advertising or tracking.

Operational Usage Data

• We may retain limited service-operation records such as model name, token counts, provider cost, request outcome, latency, and redacted error codes. When billing is active, priced usage records are linked to the rider's billing account so the correct person is charged. Station Agent production logs are designed not to contain prompts, responses, precise locations, voice clips, full payment details, or Apple identity values.
• Our hosting provider automatically retains web-request logs that can include source network address, browser or app user-agent, requested route, response status, error details, and request timing. We use these records only to secure, operate, and troubleshoot Station Agent. They are not used for advertising or cross-app tracking.
• For abuse protection, Station Agent's server immediately converts the client network address supplied by the hosting provider into a keyed one-way digest. Only that digest, the rate-limit window, and an aggregate request count are stored in the rate-limit counters; raw network addresses are not stored in those counters. The digest is not tied to an account or other identity data and is not used for advertising or tracking. Counter rows more than two days old are deleted on the next allowed rate-limited request.
• We do not collect device identifiers for advertising purposes.

Service Cost and Charge Information

• Station Agent is free to download. The in-app meter estimates your rider charge: actual AI-provider cost plus a 15% service/server fee.
• We store token counts, provider costs, calculated rider costs, and charge status to operate metered billing. Your balance is normally charged at $5, while eligible smaller balances settle monthly and sub-50-cent balances roll forward.
• These billing records are linked to your account but are not a saved transcript.

How We Use Your Information

• To find nearby transit stops and plan requested trips
• To transcribe voice, interpret trip requests, and generate replies
• To open a trip in Apple Maps when you choose that action
• To secure, monitor, and improve service reliability

Third-Party Processing

These third parties process information for the feature you request. Data that Station Agent does not retain on its own server may still be processed or temporarily retained by a provider under that provider's terms.

• OpenAI: Transcribes bounded voice clips, processes chat and trip-language requests, generates spoken audio, and may perform current-information web searches. Station Agent sends voice recordings only to /v1/audio/transcriptions; OpenAI's current data-controls table lists no abuse-monitoring or application-state retention for that endpoint. Station Agent sets store: false on Responses API requests where supported. Other OpenAI API customer content, including text prompts and responses, may by default remain in abuse-monitoring logs for up to 30 days (or longer when legally required) unless stronger controls such as approved Zero Data Retention or Modified Abuse Monitoring are enabled for the project. OpenAI says API data is not used to train its models unless the API customer explicitly opts in. See OpenAI API Data Controls and the OpenAI Privacy Policy.
• TriMet Developer API: Provides live transit arrival data for Portland-area agencies.
• Apple Maps: Receives the trip places needed to open transit or walking directions only when you choose the Apple Maps action.
• Apple: Provides Sign in with Apple identity and authorization credentials when you create a billing account, plus signed server-to-server notifications for consent revocation or Apple-account deletion. Station Agent retains an encrypted revocation credential so deleting the account can revoke that authorization. After local account closure, the raw Apple identifier is removed. A keyed one-way subject digest, authorization generation time, and closure time remain to order delayed Apple events and reject sessions issued before deletion. While Apple revocation is pending, the encrypted credential, its one-way integrity fingerprint, and a retry timestamp also remain until Apple confirms revocation; failed provider requests are retried automatically.
• Stripe: Hosts the payment-method setup page, stores your payment details, and processes automatic usage charges. Stripe provides Station Agent with customer, payment-method, and charge identifiers rather than your full card number. See the Stripe Privacy Policy.
• Photon, Nominatim / OpenStreetMap, Mapbox, and Esri ArcGIS geocoding services: Depending on availability and configuration, one of these services may receive coordinates, a nearby search bias, or a place query to turn a location into a readable place name.
• AWS S3: Hosts cached public transit schedule data (GTFS feeds); it is not used as a conversation store.

Data Storage and Security

• On this iPhone: Saved trips, widget data, display preferences, AI-consent choice, and signed account session remain until you sign out, delete them, delete the account, or uninstall the app.
• On Station Agent servers: Full chat histories, voice clips, full card details, and ordinary trip GPS coordinates are not used as persistent conversation storage. Active Apple account identifiers, privacy-safe deletion/session boundaries, encrypted revocation credentials while pending, Stripe identifiers, and linked usage/charge records are retained as described above.
• At processors: OpenAI, mapping, and geocoding providers apply their own processing and retention practices described above. A request finishing on Station Agent's server does not itself delete a processor's permitted safety or abuse-monitoring record.
• Station Agent uses HTTPS for network transmission to its production server and providers.

Your Privacy Rights

• Access: You can request a copy of any personal data we hold about you.
• Local deletion: Use Settings > Delete Local Trip Data to remove saved trips and widget data from this iPhone.
• Account deletion: Use Settings > Delete My Account to attempt settlement of eligible outstanding usage, immediately close billing and remove Station Agent's active identity/payment links, delete the Stripe customer, request Sign in with Apple revocation, and erase local trip/widget data. A keyed one-way subject digest and closure time remain so sessions issued before deletion stay invalid without retaining the raw Apple identifier. If Apple is temporarily unavailable, the encrypted revocation credential, a one-way integrity fingerprint, and a pending timestamp are retained for bounded automatic retries; the deletion result also provides Apple's manual Sign in with Apple removal path. If the iPhone loses the response after confirming deletion, Station Agent still attempts local trip erasure and sign-out and tells you to verify with a fresh Apple sign-in or support. Deletion still completes if provider cleanup or a final usage charge cannot finish in that request. Historical transaction records may be retained when required for tax, accounting, fraud prevention, or dispute handling.
• Location control: You can revoke location permission at any time in iOS Settings → Station Agent → Location.
• AI control: You can decline AI processing or change your AI-consent choice in Station Agent Settings.
• Contact: You may contact us to ask about or request deletion of any personal data Station Agent holds about you.

To exercise any of these rights, contact us at the email below.

Data Retention

• Local saved trips and preferences: Until you delete them or uninstall the app
• Station Agent request content: Not kept as a server-side conversation history after the request completes
• Active account identity, optional Apple-provided email/private relay address in the signed session, and saved-payment identifiers: Until sign-out, account deletion, session expiry, or earlier removal as applicable. After account closure, a keyed one-way subject digest and closure time remain to invalidate earlier sessions. An encrypted Apple revocation credential, one-way integrity fingerprint, and pending timestamp remain only until Apple confirms revocation or operational cleanup confirms that no further automated revocation is possible.
• Linked usage and transaction records: Retained as reasonably required for billing, accounting, tax, fraud prevention, and payment disputes, then deleted or anonymized where permitted
• Other Station Agent operational records: Retained only as reasonably needed to operate, secure, and troubleshoot the service
• Third-party processing records: According to each provider's terms and configured controls, including OpenAI's default abuse-monitoring period described above

Children's Privacy

Station Agent is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

Contact Us

Last updated: August 21, 2026