Data Protection Impact Assessment (DPIA)
1. Controller
- Entity: Trilho (single-founder project; legal entity to be incorporated).
- Contact: feedback@trilhoapp.com.
- Data protection officer: not designated at this stage (below the Art. 37(1) thresholds). To be reassessed when monthly active users exceed 250,000.
2. Description of the processing
Trilho is a multimodal mobile app for planning journeys on Portuguese public transport. To improve the product we collect anonymous, aggregated events — no personal identifier is processed.
Data collected
| Category | Item | Source | Purpose |
|---|---|---|---|
| Anonymous identifier | anon_device_id (UUID v4 generated on the device) | App | De-duplicating events per device, with no link to identity |
| Geographic | sim_country (2-letter ISO code, e.g. “PT”) | Operating system | Distinguishing resident vs. visitor use in the aggregate |
| Temporal | day_bucket_iso (YYYY-MM-DD, Europe/Lisbon) | Device clock | Aggregated daily trends |
| Behavioural | event_type (fixed vocabulary: app_open, search, chain_selected, ticket_buy_tap, push_received, push_opened, saved_route_created, onboarding_completed) + props (low-cardinality buckets: operator code, persona, fare option) | App | Understanding which features are used |
Data not collected (explicit commitment)
- Precise GPS location. The app uses precise GPS on the device for “stops near you”, but coordinates are not collected: requests are processed ephemerally on the server and
lat/lonare redacted from logs. - Specific stop identifiers (
stop_id). - Text typed by the user (searches, saved-route labels, comments).
- Operating-system device identifiers (Android ID, IDFA, IDFV).
- IP address beyond what the server records for operational logs (kept 7 days).
- Trip history (stays exclusively on the device).
3. Legal basis (GDPR Art. 6)
Consent (Art. 6(1)(a)), by opt-in: collection is off by default and only starts if the user turns on the “Share anonymous usage statistics” switch on the initial setup screen or in Settings → “Anonymous · share usage”. Revocable at any time: the local event queue is deleted immediately and no new events are generated. Choosing consent over legitimate interest is deliberate: we prefer a clear opt-in even if it reduces telemetry coverage.
4. Principles applied (GDPR Art. 5)
| Principle | How we comply |
|---|---|
| Lawfulness | Explicit consent and one-tap opt-out. |
| Purpose limitation | Events serve internal product analysis only. No resale of individual events. Any aggregated export to third parties respects a minimum of 25 devices per cell. |
| Data minimisation | Fixed event vocabulary, low-cardinality buckets, no free text, no specific identifiers. |
| Accuracy | Not applicable — anonymised data cannot be reviewed by the data subject. |
| Storage limitation | Events aggregated once a cell reaches 25 devices; raw records deleted after 90 days; server technical logs after 7 days. |
| Integrity and confidentiality | TLS in transit. The server is hosted by Hetzner Online GmbH (Nuremberg, Germany, EU). No persistent database of personal data: aggregations live in memory only until the 25-device threshold. Aggregated export, when enabled, goes to PostHog EU Cloud (Frankfurt), where raw data is deleted after 90 days. |
| Accountability | This DPIA, the consent state kept locally, and server-side audit logs. |
5. Processors
| Processor | Role | Location | Status |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting | Nuremberg, DE | Active |
| Cloudflare, Inc. | DNS, hosting of trilhoapp.com, e-mail forwarding | EU / global | Active (does not see app traffic) |
| Sentry (Functional Software, Inc.) | Crash reports | Frankfurt, DE (EU region) | When enabled; no PII, no location |
| PostHog Inc. | Aggregated analytics | Frankfurt, DE (EU Cloud) | When enabled; DPA available |
6. Risk assessment
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Re-identification by cross-referencing other sources | Low | Medium | No PII, no GPS, no precise time, no stop identifiers. The tuple (anon_device_id, day_bucket, event_type) cannot identify an individual without access to the physical device. |
| Leak through server logs | Low | Low | HTTP logs kept only 7 days; the identifier is logged truncated (8 characters), with no reversibility. |
| Re-identification by grouping rare operators | Very low | Low | 25-device threshold before any aggregation is exported; cells with fewer data are suppressed. |
| Analytics processor (PostHog EU) | Low | Medium | Data-processing agreement; data in the EU; declared in this DPIA. |
Residual risk: low. The processing profile is classified as “not high-risk” under the CNPD framework — this DPIA is documented as good practice, not by obligation.
7. Data-subject rights (GDPR Arts. 15–22)
By design, there is no identifiable personal data linked to a specific user. Consequently: access, rectification and portability have no object (no identity to reconcile); erasure and objection are exercised locally — turning the toggle off in Settings deletes the local queue immediately and suspends processing. Questions: feedback@trilhoapp.com, answered within 30 days at most (Art. 12(3)). Complaints: CNPD.
8. Commitments
- Republish this DPIA whenever the event vocabulary grows or a processor is added.
- Notify the CNPD only if a breach affects the
anon_device_idtogether with another datum enabling re-identification — considered unlikely given the minimisation. - Keep this document at trilhoapp.com/en/privacy/dpia while the app is available, in Portuguese and English.
History
- 1.1 — 2026-09-11: consent made explicitly opt-in (off by default in the app); hosting moved to Hetzner (EU); processors listed; contact changed to feedback@trilhoapp.com.
- 1.0 — 2026-05-24: initial version.