Privacy

What happens to the data in a request - for your own privacy notice, or if you simply want to know.

Answered here. The API answers from its own copy of the national timetable (see Source). The parameters of a request - for /locations with x and y, the coordinates - are not passed on to anyone. The timetable, its real-time data and the shared-mobility data are fetched by the server on its own schedule, never with anything from a request.
Access log. The server logs each request: the time, the IP address, the full request URL with its parameters (coordinates included), the status and the User-Agent. The log is kept for 30 days and used only to run the service: to find faults, to spot abuse and to judge the load.
Statistics. The public statistics count requests, errors and kinds of client, and list the station boards and connections asked for as they were written, without any link to a caller; these lists are deleted after 35 days. Distinct callers per day are counted as hashes of the IP address under a key that changes every day; once the day is over, only their number remains. Coordinates are not part of the statistics.
Example pages. The map example loads its map from swisstopo (wmts.geo.admin.ch), and the example pages load their scripts and styles from cdnjs.cloudflare.com; your browser contacts these directly. The API itself does not.
Nothing else. The API has no accounts, sets no cookies and does no tracking. Nothing is sold. The service is hosted in Switzerland.