CityviaCityviaCityvia is an urban mobility and community app for Barcelona, developed and run by Khawar Hunny Hameed as an individual developer (not a company). Privacy contact: contacto@cityvia.es.
Cityvia is not an official app of the airport, Aena, AMB/IMET or any public authority. The public data it shows (flights, cruises, events, weather) comes from third-party sources.
Account: email and password (the password is handled by our authentication provider and we never see it in plain text), display name, user type (driver or passenger), city, language, profile photo (optional), taxi licence number (required for drivers; we only use the last digit to tell you when you work, rest and can pick up at the airport; may be reviewed for verification), phone (optional), your phone/email visibility choices, working hours, points.
Content you publish: ads (with photos), lost/found items, Community posts, comments, likes, quick alerts (e.g. “Taxis needed”), incident confirmations and content reports.
Private messages: the text of your conversations, timestamps and read status, plus blocks and reports. Your phone and email are never shown to the other person.
Voice messages (Hello): clips you record by pressing the talk button in a group, and your group memberships. Clips are deleted automatically after 30 days.
Location: your precise location only while you use a feature that needs it (alerts with the exact street, map, taxi ranks, My shift, incident confirmations). We turn it into a street name for the alert. The app does not request “always / background” location permission. While you have an active shift in My shift, the app keeps running with a visible notification (“Cityvia active · Shift in progress”) and sends an approximate position (about 100 m) every 5 minutes only to alert you about things nearby (taxis needed, event endings, incidents). It stops when the shift ends; you can turn each alert off in Settings.
Ride-based lost-item matching (optional, off by default): if you turn it on, your phone uses Bluetooth with anonymous IDs that rotate every 15 minutes, approximate location (~100 m) and “in vehicle” detection to recognise which taxi you rode in, to help recover lost items. Raw data is deleted after 24 hours and detected trips (encrypted, never shown to other users) after 30 days. You can withdraw consent at any time.
Airport times (taxi drivers): when you are in the T1/T2 waiting area or pickup (incorporación) zone, the app measures on your phone how long you spend in each zone. We only send the duration, the terminal and the time rounded to the minute — never your route or coordinates. Other drivers only see averages of several taxis (at least 3), never who you are. After 7 days we unlink the record from your account and after 90 days we delete it. You can turn it off in Alerts & settings › Airport clock. Basis: your location consent and our legitimate interest in anonymous statistics.
My shift (Mi turno): shifts, services (amount, payment method, tariff, supplements, notes) and expenses you enter. Receipt text is recognised on your own phone.
Voice dictation: if you dictate text, recognition is done by your phone’s speech service (e.g. Google), not by Cityvia.
Technical data: push notification token, an anonymous device identifier stored only as a hash (to count guest ad views), IP address stored only as a hash (abuse rate limits) and server logs.
To provide the service (account, posts, messages, voice groups, alerts, notifications, My shift), to moderate content and prevent abuse (including automatic photo checks), for security, and to calculate points/plans. We do not sell your data, use it for advertising or build marketing profiles.
Legal basis (GDPR): performing the service you request; your consent for location, microphone, notifications and ride matching; and our legitimate interest in security and moderation.
Your display name, photo, user type and the content you publish. Your licence number is never shown to others: at most it appears masked (e.g. “Lic. 1xxxx”). Phone and email only if you make them public. Private messages are seen only by the two people in the conversation (and an admin if the conversation is reported).
Cloudflare (server, photo and voice clip storage, automatic photo checks with Workers AI) · Neon (database and authentication, EU – Frankfurt) · Google Firebase Cloud Messaging (notifications) · Google Firebase Crashlytics (app crash reports: error stack trace, phone model, Android and app version and an anonymous installation id; no name, email, licence or location) · Google Firebase Analytics (anonymous usage statistics: which screens and features are used, account type taxi driver/user, language, phone model and version, with an anonymous installation id; no advertising id, no personalised ads, no name, email, licence or location) · Google Firebase Remote Config (turn app features on/off or tune them without an update; uses only the anonymous installation id) · Google Play (in-app rating and in-app updates, handled by Google Play; Cityvia does not receive your review or Google account data) · OpenStreetMap Nominatim / Photon (coordinates → street name) and OpenStreetMap map tiles · AeroDataBox (via API.market) for flight data, Open-Meteo for weather, and open-data portals (Port de Barcelona, Ajuntament, Generalitat): no personal data is sent to these last ones.
Some providers may process data outside the EU under GDPR safeguards (e.g. standard contractual clauses).
While you have an account. Exceptions: voice clips 30 days; raw ride-matching data 24 h and trips 30 days; quick alerts expire within hours. Deleting your account erases the data listed on the deletion page.
You can request access, correction, deletion, objection, restriction and portability by writing to contacto@cityvia.es. You can also complain to the Spanish Data Protection Agency (aepd.es).
To delete your account and data see /delete-account.
Cityvia is not directed at children under 16.
If we change this policy we will update the date above and notify you in the app if the change is significant.