Traintrackr
Privacy policy
Traintrackr answers questions about public train times. It keeps as little about you as it can.
Last updated: 13 October 2026.
Who is responsible
Traintrackr is run by Hugo Rodger-Brown, who is the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact: support@traintrackr.live.
What is processed
| Data | Why | Kept for |
|---|---|---|
| Your email address | It is your account: to send you sign-in codes and links, to recognise you when you sign in, and to apply the fair-use limit | 180 days after the account was last used |
| The dates the account was created and last signed in to | To delete accounts that are no longer used | With the account |
| Passkeys you add: the passkey's public key, the name you give it, and when it was last used | To let you sign in without a code | With the account, or until you remove the passkey |
| A sign-in request: your email address, with the code and link sent to it stored as hashes | To check the code or link when you use it | 15 minutes to use it, then deleted within a day |
| Access tokens, stored as hashes, with your account | To keep your assistant connected | Access tokens 1 hour. A refresh token until it has gone unused for 30 days; one that has been replaced is kept for 30 days, to notice a copy of it being used. A daily clean-up deletes them after that. |
| A session, while you are signed in to this website's sign-in and account pages | To keep you signed in on those pages | 90 days, or until you sign out |
| The name and return addresses of the app that connects (such as Claude) | To run the sign-in. This describes the app, not you. | Until removed |
| Your IP address, with the time and address of each request | Request logs kept by the hosting provider, used to investigate faults and abuse | 14 days |
| A count of your recent requests, held in memory: against your account, or against your IP address or email address before you have signed in | The fair-use limit, and limits on how often sign-in codes can be asked for and tried | Minutes; cleared on restart |
| On this website: each page you open, the page you came from, your browser, device type and country, and when you make a new board. Counted by fivebar, which sets no cookies | To see how many people use the website, and which pages | Daily totals only, which can't be traced back to you. Your IP address and browser details are used to tell visitors apart for one day, and not kept |
| Emails you send to support, and the replies | To answer your question | 12 months after the conversation ends, unless you ask for earlier deletion |
The questions your assistant sends to Traintrackr, such as a station name and a time, are used to produce the answer. They are not stored and not written to logs. Station codes are sent to the Rail Data Marketplace's Darwin service to fetch live times, with nothing that identifies you.
Traintrackr does not see your conversation with the assistant, only the requests the assistant makes to it.
What Traintrackr doesn't do
- It sets cookies only on its sign-in and account pages: one keeps you signed in there, and one protects their forms. Neither tracks you, and the rest of the website sets none.
- It uses no advertising, and its visitor counts can't identify you.
- It does not sell or share your data for marketing.
- It sends no email other than the sign-in codes you ask for, and replies to email you send to support.
Lawful basis
The data is processed on the basis of legitimate interests: providing the service you asked for, and protecting it from abuse.
Who processes it, and where
- Render hosts the service and its database in Frankfurt, Germany, and keeps the request logs.
- Resend delivers the sign-in email, and receives your email address, the code and the sign-in link to do so. Resend is based in the United States and stores data there. Transfers from the UK are covered by the UK Extension to the EU-U.S. Data Privacy Framework, under which Resend is certified.
- fivebar counts visits to this website. Its counts are kept in Germany, with backups in Western Europe. See fivebar's privacy policy.
- Google (Google Workspace) receives and stores email sent to support@traintrackr.live, and the replies to it. Transfers from the UK are covered by the UK Extension to the EU-U.S. Data Privacy Framework, under which Google is certified.
The assistant you use, such as Claude or ChatGPT, is provided by another company under its own privacy policy.
Your rights
You can ask for a copy of the data held about you, for it to be corrected or deleted, or for its use to be restricted, and you can object to its use. Email support@traintrackr.live from the address you sign in with. Deleting an account removes its email address, passkeys and tokens, and disconnects your assistant.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
Changes
Changes to this policy are published on this page, with the date.