Trackside — Privacy Policy
Last updated 7 October 2026. Trackside is published by Trackside. Contact: gettrackside@gmail.com.
There's no account, and no real name anywhere
Trackside doesn't ask for your name, email address or a login. On first launch it generates a random
device ID and a random rail-themed username (like "PlatformRunner001") — neither is linked to your real
identity, and there is no way for us to work backwards from either one to who you are.
What we store, and why
- On your device — your tracked trains, recent journeys, Delay Repay claim history,
and app settings. This never leaves your phone except where described below.
- On our servers, tied to your random device ID — a points total, which contribution
badges you've unlocked, and your generated username reservation.
- A device check, on iPhone — so that reports and votes come from the real Trackside
app on a real device rather than from scripts, the app uses Apple's App Attest: it creates a key that stays
in your phone's secure hardware, and Apple confirms to us that the key belongs to a genuine copy of
Trackside. We then give your device a random passcode, which it sends with each report, vote and data
request. We keep only a scrambled (hashed) copy of that passcode, a scrambled copy of the key's identifier,
and the date of the check, against your random device ID. None of it identifies you or your phone outside
Trackside, and Apple isn't told who you are or what you report.
- Busy-ness and carriage reports you submit — stored anonymously against the station or
train you reported on. These are not linked back to your device ID in a way we can look up, export or
delete on request — see "What we can't do yet" below.
- Train links you share (Trackside Plus) — when you share a train's reported location,
we store the train (its operator, stops and times, as National Rail published them), which stop you said
you're getting off at, if any, when the link was made, your random device ID, and a scrambled (hashed) copy
of the link's secret code. Anyone you send the link to can see that train's position and those details in a
web browser, without the app or an account. The link says nothing about who you are or where you are: it
shows the train, from the railway's own reports.
- Live Activities for your next train (iPhone) — so the Lock Screen keeps up while
Trackside is closed, our server keeps a list of the trains that have a Live Activity showing: the train and
the stations being watched on it, not who is watching. Apple delivers each change to every phone following
that train.
- Your commute and the trains you track (iPhone, iOS 18 or later, with Live Activities
on) — so your next train appears on the Lock Screen by itself, as long before it leaves as you chose in
Settings (an hour unless changed), and the one after it once you've arrived, the app sends our server each
commute's station, booked time, days, the train's timetable code and where you get off, and for each tracked
train the train, where you get on and off and its booked times, with that choice and a random code Apple
issues for starting Live Activities on your phone. It isn't linked to your device ID or username, and the
code means nothing outside Apple's push service.
- Notifications for your tracked trains, if you switch them on (iPhone) — the app sends
our server the trains you're tracking (the train, your station, its booked time and its title, like
"14:50 to London Victoria"), what the app already shows for each, and a random code Apple issues so
notifications reach your phone. It isn't linked to your device ID or username.
- Your IP address — processed transiently by our server for abuse prevention (rate
limiting) and is not stored long-term or linked to your device ID.
How long we keep it
- On-device data and your server-side points/avatars/username, and the device check —
kept for as long as you use Trackside. Nothing expires automatically; nothing is deleted unless you use Delete account, or you
delete the app itself (which removes the on-device half).
- Busy-ness and carriage reports — each stops being shown to other passengers once it's
no longer current (typically within a few hours), but may be retained on our servers for longer than that
for service reliability purposes. As above, it isn't linked back to a device, so it isn't something we can
look up or delete on an individual request.
- Live train links stop working 15 minutes after the train reaches the last stop
shared, after 24 hours at most, or as soon as you tap Stop sharing. The record is deleted automatically about
a day after it stops working, or straight away if you use Delete account.
- Live Activity train lists — each train is removed when it finishes its journey, or
after 12 hours.
- Your commute and tracked trains for Live Activities — kept while you have commuter
trains set or trains tracked. They're replaced each time your trains change, and removed as soon as you
clear them all or use Delete account, the next time you open Trackside after switching its Live Activities
off, or when Apple stops accepting the code (for example after you delete the app).
- Trains for notifications — each one is removed when it finishes its journey, or after a
day and a half; all of them as soon as you switch Train notifications off or use Delete account, or when
Apple stops accepting the code.
- IP addresses processed for abuse prevention are not retained beyond the short window
needed to enforce rate limits.
Who else processes data, and what they see
Trackside is a small, one-person operation. We use these services to run it — each only sees what it
needs to do its specific job, and none of them are given your Trackside device ID. Apart from Google's adverts,
which work from your phone directly, none of them are told it's you asking:
- Cloudflare — hosts our server (Workers) and the data described above (Workers KV,
Durable Objects and D1). Cloudflare sees your IP address as part of handling the request, same as any web host.
- National Rail Enquiries / Rail Delivery Group (Darwin live departure boards, Historical
Service Performance, Darwin Push Port, Knowledgebase Stations & Incidents) — our server queries these
on your behalf; your device never contacts them directly.
- Transport for London (Tube, Elizabeth line, Overground and DLR status and closures,
lift outages, station busyness, step-free routes, Santander Cycles docks and bus times) — same as above,
proxied through our server. For bikes and buses near a station we send TfL that station's location, never
yours.
- Apple (App Attest) — the device check above. Apple's App Attest service confirms the
app is genuine; it isn't given your device ID or anything you do in Trackside.
- Apple (Apple Push Notification service) — delivers Live Activity updates and
notifications. We send it a train's times, platform and status, and the random codes above so a commute's
start or a notification reaches your phone. It isn't given your device ID or anything else about you.
- Apple — handles Trackside Plus subscription purchases entirely through the App Store;
see "Your subscription" below.
- Google (AdMob) — shows the advert at the bottom of the screen in the free version of
the app. Google's advertising software runs on your phone and, to choose an advert and count views and taps,
receives your IP address (which gives a rough location), information about your phone and the app, an
identifier limited to this app, and which adverts you see and tap. Adverts can be personalised: Google's
consent form asks for your choices first in the UK and EU, and Settings → Advert privacy choices lets you
change them. iOS then asks whether to allow tracking; only if you allow it is Google given your phone's
advertising identifier, which it can use to choose adverts based on your activity in other apps and
websites. You can change that at any time in iOS Settings → Privacy & Security → Tracking. Trackside Plus has no adverts, and Google's advertising software isn't started for
subscribers. Google isn't given your Trackside device ID, your stations or your trains. What Google does with
this data is covered by Google's privacy policy and
how Google uses information from apps that
use its services.
What we don't do
We don't track your location in the background or sell your data. Apart from Google's adverts in the
free version (above), none of the services above are given anything that identifies you — they see requests
for public data (a departure board or a tube line status), not a person.
Your subscription
If you subscribe to Trackside Plus, the purchase itself is handled entirely by Apple through the App
Store — we never see your payment details, and Apple's own privacy policy covers that transaction.
Download or delete your data
Settings → Account → Download my data gives you a copy of everything described above under "on your
device", "on our servers, tied to your random device ID" and your live train links. Delete account removes
all of it, stopping any live links and removing your commute and notification trains from our server, and resets
the app to a fresh, new device ID. It also removes the device check; the passcode itself isn't included in
the download, because it works like a password for your device ID.
What we can't do yet
Busy-ness and carriage reports you've submitted aren't included in the download or delete above. That's
a genuine current limitation of how they're stored, not a choice to exclude them — we're not able to look
up "everything device X reported" without a system we haven't built yet. If that changes, this section will
be updated to say so.
Questions
Contact gettrackside@gmail.com.