Traintrackr
Sign in
Privacy policy
Traintrackr answers questions about public train times. It keeps as little about you as it can.
Last updated: 18 October 2026.
Who is responsible
Traintrackr is run by Hugo Rodger-Brown, who is the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact: support@traintrackr.live.
What is processed
| Data | Why | Kept for |
|---|---|---|
| A one-way hash of your email address. The address itself is never stored: it is held in memory only while your sign-in code is sent. The hash can't be turned back into the address: Traintrackr can only check whether an address it is given matches it | It is your account: to recognise you when you sign in, and to apply the fair-use limit | 180 days after the account was last used |
| A masked form of your email address: its first letter and its domain, such as h•••@example.com | To show which account you're signed in to | With the account |
| The dates the account was created and last signed in to | To delete accounts that are no longer used | With the account |
| Passkeys you add: the passkey's public key, the name you give it, and when it was last used | To let you sign in without a code | With the account, or until you remove the passkey |
| While you are signed in: the addresses of the last departure board you opened on this website and of up to 12 boards you made favourites, such as /board/LST/COL. Signed out, these are kept in your browser only and never sent to Traintrackr | To show your boards on the front page, on every device you sign in on | With the account, or until you remove the favourite or open another board. A copy in your browser is moved to your account when you sign in, or kept until you clear this website's data |
| A sign-in request: the hash and the masked form of your email address, with the code and link sent to it stored as hashes | To check the code or link when you use it | 15 minutes to use it, then deleted within a day |
| Access tokens, stored as hashes, with your account | To keep your assistant connected | Access tokens 1 hour. A refresh token until it has gone unused for 30 days; one that has been replaced is kept for 30 days, to notice a copy of it being used. A daily clean-up deletes them after that. |
| A session, while you are signed in to this website. Once you ask for a sign-in email, it also holds the masked form of your address until you finish signing in or the session ends | To keep you signed in, to show your saved boards, and to show where your code was sent | 90 days, or until you sign out |
| The name and return addresses of the app that connects (such as Claude) | To run the sign-in. This describes the app, not you. | Until removed |
| Your IP address, with the time and address of each request | Request logs kept by the hosting provider, used to investigate faults and abuse | 14 days |
| A count of your recent requests, held in memory: against your account, or against your IP address or email address before you have signed in | The fair-use limit, and limits on how often sign-in codes can be asked for and tried | Minutes; cleared on restart |
| On this website: each page you open and whether it loaded or ended in an error (such as "page not found"), the page you came from, your browser, device type and country, and when you make a new board. Counted by fivebar, which sets no cookies | To see how many people use the website, and which pages | Daily totals only, which can't be traced back to you. Your IP address and browser details are used to tell visitors apart for one day, and not kept |
| When your assistant uses one of Traintrackr's tools: the tool's name, whether it answered, the assistant's name (such as Claude) and a code that tells accounts apart without identifying yours; never what you asked or what came back. Counted by fivebar | To see how much each tool is used, and from which assistants | Daily totals only, which can't be traced back to you |
| Emails you send to support, and the replies | To answer your question | 12 months after the conversation ends, unless you ask for earlier deletion |
The questions your assistant sends to Traintrackr, such as a station name and a time, are used to produce the answer. They are not stored and not written to logs. Station codes are sent to the Rail Data Marketplace's Darwin service to fetch live times, with nothing that identifies you.
Traintrackr does not see your conversation with the assistant, only the requests the assistant makes to it.
What Traintrackr doesn't do
- It sets cookies only when you sign in: one keeps you signed in, and one protects its forms. Neither tracks you, and it sets none for anyone who hasn't signed in. Your saved boards, when you aren't signed in, are kept in your browser's storage for this website, which nothing else can read.
- It uses no advertising, and its visitor counts can't identify you.
- It does not keep your email address. Once the sign-in email is sent, only its hash and its masked form remain, so Traintrackr can't email you unless you write to support first. Email you send to support is kept as the table above says.
- It does not sell or share your data for marketing.
- It sends no email other than the sign-in codes you ask for, and replies to email you send to support.
Lawful basis
The data is processed on the basis of legitimate interests: providing the service you asked for, and protecting it from abuse.
Who processes it, and where
- Render hosts the service and its database in Frankfurt, Germany, and keeps the request logs.
- Resend delivers the sign-in email, and receives your email address, the code and the sign-in link to do so. Resend is based in the United States and stores data there. Transfers from the UK are covered by the UK Extension to the EU-U.S. Data Privacy Framework, under which Resend is certified.
- fivebar counts visits to this website, and the use of its tools by assistants. Its counts are kept in Germany, with backups in Western Europe. See fivebar's privacy policy.
- Google (Google Workspace) receives and stores email sent to support@traintrackr.live, and the replies to it. Transfers from the UK are covered by the UK Extension to the EU-U.S. Data Privacy Framework, under which Google is certified.
The assistant you use, such as Claude or ChatGPT, is provided by another company under its own privacy policy.
Your rights
You can ask for a copy of the data held about you, for it to be corrected or deleted, or for its use to be restricted, and you can object to its use. Email support@traintrackr.live from the address you sign in with: its hash finds your account. Deleting an account removes its hash, masked address, passkeys, saved boards and tokens, and disconnects your assistant.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
Changes
Changes to this policy are published on this page, with the date.