Privacy Policy

Rail ("the App") is developed and operated by Sammy Sergi ("we", "us", or "our"). The App tracks a UK train journey you choose and notifies you of platform changes, delays and cancellations. To do that it needs a small amount of data on a server, and this page lists all of it. We are committed to collecting nothing beyond what the notifications require.

The App never collects your location, and it contains no analytics SDK, no advertising and no tracking of any kind. It does hold the following on our server, because notifications cannot be sent without it:

• Your account: When you sign in, Apple gives us a Sign in with Apple identifier that is unique to you and this App. That identifier is your account. Your email address is stored only if you choose to share it with the App at sign-in; if you use Apple's Hide My Email, we receive the relay address instead. We never see your Apple ID password.
• The journeys you track: For each journey, the identifier of the train service, the station you board at, the station you alight at, and an optional connecting service. This is what the server watches on your behalf. It is deleted when you remove the journey, and in any case after the journey has ended.
• Notification tokens: The push notification token Apple issues to your device for this App, and the Live Activity token for any journey you have on your lock screen. These let our server hand a message to Apple for delivery to your phone and identify nothing else about you. They are removed when you sign out.
• A log of notifications sent to you: For each notification, what it was about (for example a platform change on a given service), when the feed message that caused it arrived, and when it was dispatched. We keep this so we can measure how fast and reliable the App is, and so we can investigate if you tell us an alert was wrong or late.

The App does not ask for access to your contacts, photos, calendar, microphone, camera or location. It does not read your clipboard.

The train information shown in the App comes from National Rail Enquiries (Darwin) and Network Rail Open Data, used under their licences. We keep an archive of the raw feed messages we receive so that any alert can be traced back to its source. That archive describes trains, not people: it contains no user data and is never linked to your account.

Account, journey, token and notification-log data is stored in a database hosted by Railway, currently in the United States. It is retained for as long as your account exists. Journeys are removed when you delete them or when they end; tokens are removed when you sign out; the notification log is retained for reliability measurement while your account exists and is deleted with it.

Data is transmitted between the App and our server over HTTPS. Access to the database is limited to us and to the hosting provider's infrastructure.

You are in control of everything we hold. You can:

• Stop tracking any journey in the App, which deletes that journey from your account.
• Sign out, which removes your device's push notification and Live Activity tokens from our server so it can no longer send anything to that phone.
• Use Delete account in the App's settings, which removes your account and all of your tracked journeys.
• Contact us from the email address linked to your account, and we will delete it for you, or provide a copy of the data we hold about you.

Push notifications and Live Activities are the core function of the App, but you can turn either off at any time in iOS Settings, under Notifications, then Rail.

The App relies on the following third parties:

• Apple: Sign in with Apple provides your account identifier, and the Apple Push Notification service delivers notifications and Live Activity updates to your device. Apple's handling of that data is described in Apple's privacy policy.
• Railway: Hosts our server and database. Railway processes the data listed above on our behalf as our infrastructure provider. See Railway's privacy policy.
• National Rail Enquiries and Network Rail: Supply the live rail data. No information about you is sent to them; the App's server consumes their feeds, and your device never contacts them directly.

We do not use any analytics, crash-reporting, advertising or attribution SDK in the App, and we do not sell or share your data with anyone.

This website sets no cookies, runs no analytics and includes no third-party scripts. Outbound links carry campaign parameters so the sites we link to can tell the visit came from here; that tells them nothing about you.

The App does not knowingly collect personal information from children under 13 (or the applicable age in your jurisdiction). Sign in with Apple requires an Apple ID, and the data we hold about any account is limited to the items listed above. If you believe a child has provided personal information through the App, please contact us and we will delete it. For a plain-language account of what the App does and does not contain, and why it is rated 4+, see our age suitability page.

The App is about UK trains, so many of its users are in the United Kingdom, while our server is hosted in the United States and we are based in Australia. Your account, journey and token data is therefore transferred to and processed in the United States. For users in the United Kingdom and the European Economic Area, that transfer relies on our hosting provider's Standard Contractual Clauses, and we process your data because it is necessary to provide the service you asked for. Users in the United Kingdom, the EEA, Australia, California and other jurisdictions retain all rights afforded to them under applicable local privacy laws, including the rights to access, correct and delete their data, which you can exercise from inside the App or by contacting us.

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated date. We encourage you to review this page periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

If you have questions about this privacy policy, please contact us at sam@sammysergi.com.