Transit

Is the Transit app safe?

Yes. Transit, the Montréal-built app for buses, trains and bikeshare in more than 1,500 cities, is the most privacy-minded transit planner we have reviewed. Apple's label lists nothing used to track you, the app shows no third-party ads, and Transit says it never shares data with advertisers or data brokers. We found no breach and no fine. It scores 76/100, ahead of Citymapper (70) and well ahead of Moovit (57), which shares location with ad networks.

The trade-offs are smaller. Your trips feed pseudonymised data sets that go to transit agencies and researchers, and accounts have only a password for protection.

What Transit collects and keeps apart

Apple's label lists precise location, a user ID, a device ID, how you use the app, crash data and support messages, all linked to you. None is listed as used to track you across other companies' apps. The user ID and app use do feed Transit's own marketing, analytics and personalisation. Google Play goes a little further: it lists device IDs, purchase history, app interactions and installed apps among data used for advertising or marketing, and approximate location shared for analytics. The privacy policy names the tools behind that, including Amplitude for analytics, nGrow and Mailchimp for marketing, and Firebase for saved places and alerts.

The design choice that matters is separation. Transit's policy says it keeps location coordinates "secure, separate and disconnected" from your email and profile. Account data such as your name, email and payment details is held encrypted on servers in Canada, with backups in the EU. Pseudonymised location data sits on Google Cloud servers in the US. Support staff link the two only with your consent, to fix a problem you report.

Who sees your trips

Transit's business depends on transit agencies. It sells fares for them through partners such as Masabi and Token Transit, and some agencies pay for its Royale subscription for all their riders: TransLink did so in June 2026, when it named Transit its recommended trip-planning app for Metro Vancouver. The privacy policy says agencies, cities and researchers receive pseudonymised data: where the app was opened, origins and destinations, and the legs of each trip. Transit says it cuts coordinates to the level of a city block, removes internal identifiers and uses stop positions instead of your location where it can.

That is a reasonable approach, but trip origins and destinations are among the hardest data to keep anonymous. One more point: when you delete your account, the pseudonymised data is not deleted. Transit says it becomes anonymous because nothing links it to you any more.

GO, ratings and the 13+ rule

GO is Transit's step-by-step mode. While it runs, the app uses your location in the background and shows other riders your vehicle on the map, which helps fill gaps where agencies publish no live data. Transit's help centre says your exact position is never shown, GO switches off at your destination, and GO data is anonymous. The same applies to Rate-My-Ride, where you can answer questions about crowding, cleanliness or safety. Some agencies add their own follow-up questions, which you can decline.

There is no chat or messaging, so there is little room for scams or harassment. The terms require users to be at least 13, while the App Store rates the app 4+. We take two points off for that gap.

Account security

Transit says no single employee can decrypt account data and that its data protection officer is the Montréal security firm GoSecure. We found no breach, no CVE and no public bug bounty. Sign-in uses an email and password, with no two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary option. If you store a payment card in Transit, use a unique password. Note that resetting your password removes the saved card.

How to use Transit privately

1. Use the app without an account unless you buy fares or want settings backed up.
2. Allow location "While Using the App"; background access is only needed for GO.
3. Skip GO if you do not want your trips in agency data sets, or use it only on routes without live data.
4. Use a unique password if you save a payment card.
5. To delete your account, tap the gear icon, then Accounts, Transit account and Delete account. Fare accounts created with partner services must be deleted separately.

How we scored it

Regulatory record (87) is the strongest factor, with no fine, order or investigation found. Privacy (70) is the weakest, because the app links IDs and usage to you for its own marketing and shares pseudonymised trip data with agencies. Transparency and control (80) is high for this category: features are off until you opt in and the policy lists its processors by name. Security (72) reflects no known breach, held back by password-only accounts.