What Dwell holds, where, and who can reach it

Where it runs

Dwell runs on Google Cloud in the United States (the us-central1 region): the prediction engine on Cloud Run, the agency data in Firestore, and the accuracy record in BigQuery. Public feeds are served through Cloudflare. The website is static and holds no data of its own. Data is encrypted in transit (TLS everywhere) and at rest by the platform's default encryption.

What data there is

The GTFS feed

Stops, routes, shapes, calendars and trips. Public by design: Google Maps, Apple Maps, Transit App and the campus apps read it, and the same is true of the GTFS-Realtime feeds Dwell publishes from it.

Bus positions

From the agency's vehicle tracker, or from the feed an existing vendor already publishes. Live data only: Dwell keeps the latest position per vehicle and overwrites it with the next one. Nothing is archived. Where the driver app is in use, a bus's assignment carries the operator id chosen at sign-on so the console can show who is on which bus during the shift; that id is not stored with any history.

Timing and accuracy

Aggregates: how long buses take between stops by time of day, and, for each predicted arrival, when the bus actually arrived. They carry vehicle and trip ids, never a person, and are what the public accuracy page is computed from.

Riders

No accounts. The rider apps and the live map read the public feeds; the only thing they store is the route filter and saved stops, on the device. No analytics or advertising identifiers.

Editor accounts

An email address, a password hash and the GTFS drafts saved to the account. Nothing else, and the account page deletes all of it in one step.

Agency staff

An email address and a password, the agency the account belongs to, and an audit trail of console actions (who published or ended an alert or detour, and when).

Who can reach what

Anyone can create a free account, and it reaches exactly one thing: its own drafts, once the email address is verified. Agency access is granted by Dwell to a named account and is never self-assigned. Both are enforced by the database's security rules on every read and write, so a browser cannot be talked into seeing or changing another account's drafts or another agency's data. Publishing runs on the server against the same checks the console shows. Administrative access to the platform is limited to Dwell's operator; there are no shared passwords.

Subprocessors

Google Cloud (hosting, database, analytics warehouse, authentication) and Cloudflare (edge delivery of the public feeds). The privacy policy lists the same two and what each receives.

Student records and FERPA

Dwell holds no student records and nothing that identifies a rider, so no education record is created or processed. The only people identified to Dwell are the agency's own staff, by their work email.

Accessibility

The site and the console are built to WCAG 2.1 AA contrast, with keyboard access, focus indication, reduced-motion support and screen-reader labels on every control. A formal accessibility audit has not been commissioned; an agency that needs a VPAT should ask.

Reporting a security problem

Write to dwelltransit@gmail.com. Reports go to the person who builds and runs the platform, and are answered in person.