Effective October 8, 2026

Privacy Policy

Train Tracker has no advertising, behavioral analytics, personal-data sales, or cross-app tracking. The data described below is used to provide requested features, protect the service, and maintain its reliability.

Tickets, Calendar, and other data on your device

Photos, screenshots, PDFs, pasted ticket text, email files, and Share sheet imports are read on your device, including text recognition and barcode extraction. Original files, extracted details, and unfinished reviews are saved locally so you can use them offline. Calendar import reads event titles, notes, locations, and times on your device after you grant permission and choose to use the feature. Original local ticket files and Calendar notes are not uploaded to Train Tracker by these imports.

A complete imported journey automatically uses its departure and arrival stations and departure time to find matching trains. Incomplete imports ask you to add or check the missing details before searching. Manual searches also send the station search text or selected route and time to the service and its rail-data providers. Nothing is tracked until you confirm the journey. Enabling alerts or a Live Activity then sends the selected train details described below.

Saved journeys and trips remain on your device. If you allow location access, the app uses your location to show you on the map; it does not send your device GPS location to Train Tracker's service.

Accounts and sign-in

If you sign in with Apple or Google, Train Tracker retains an account identifier, the sign-in provider's identifier, your email address and name when provided, and session records. These support sign-in and account features such as ticket forwarding. Credentials needed to maintain authorized access are stored encrypted or as one-way hashes, as appropriate. Signing in with Google does not itself authorize Gmail access; that requires separate read-only permission.

Voluntary ticket forwarding

Each signed-in account can generate a private forwarding address under gettraintracker.com. When you forward a rail confirmation to that address, Cloudflare Email Routing delivers it to the service for parsing. For accepted tickets, Train Tracker retains the message subject, sender, receipt date, and extracted details such as operator, route, service number, travel times, passenger name, seat, coach, and booking reference. It may also retain one PDF or image ticket attachment within the service's size limits. These records are linked to your account. The full raw email is processed to extract the ticket rather than kept as your ticket record. Messages that fail ticket, size, or sender-authentication checks are not imported as tickets.

Forwarding-address recognition uses a random alias nonce and a one-way token hash. The address is derived for authenticated account requests using a service secret. You can rotate the address to invalidate the previous one, or turn off forwarding to invalidate the alias while keeping previously imported tickets available.

Previously connected Gmail accounts

The app does not currently offer a new Gmail connection entry point. If you previously authorized read-only Gmail access and that connection remains active, the service may continue periodically searching for candidate rail confirmations and reading matching messages until the connection is disconnected or your Train Tracker account is deleted. This permission does not allow Train Tracker to send or modify mail.

For such connections, the service retains the connected email address, encrypted authorization credentials, connection and scan status, message identifiers, and extracted rail-ticket records. A ticket PDF or image may be fetched from Gmail when you request it. You can revoke Train Tracker's Gmail access through your Google Account, disconnect the connection where that control is available, delete your Train Tracker account, or contact us for help. Revoking access prevents further reads but does not itself erase ticket records already imported by Train Tracker.

Data protection and security

Train Tracker uses HTTPS/TLS for data sent to its service. Account, forwarding, imported-ticket, notification, and Live Activity records are stored in private Cloudflare infrastructure, which encrypts its storage at rest. Service secrets are managed separately from the app and source code. Account ticket requests require an authenticated session; device notification requests use separate installation credentials. Locally saved original tickets and cached attachments use iOS file protection.

Notifications and Live Activities

If you enable notifications and track a trip, the app sends a random installation identifier, an Apple Push Notification service token, device platform, selected train identifier, service date, boarding and destination station identifiers, and notification preferences. Live Activities also send their activity identifiers and push tokens, selected-stop and time-zone information, and the activity state needed for updates. The service retains these records, delivery attempts, and delivery status or errors to monitor your selected trips and provide requested alerts and Live Activity updates. These records are associated with your installation and are managed separately from your sign-in account.

Search, operational records, and historical logs

The service temporarily caches public station and journey results to answer searches efficiently. Operational metrics record request timing, provider, cache use, and outcome without ticket contents or account identifiers. Delivery diagnostics, connection errors, and security or rate-limit records may be associated with an account or installation identifier. They are used for reliability, access protection, and requested feature delivery, rather than advertising or behavioral analytics.

New per-request invocation logging is disabled, and infrastructure logs are configured to redact query strings. Historical infrastructure logs may still contain request URLs and query parameters, including station searches or sign-in parameters, and forwarding recipient addresses. Those records may remain until the platform's retention period expires. Changing logging settings or deleting an account does not immediately erase historical infrastructure logs.

Storage and deletion

You can delete locally saved tickets in the app. Turning off forwarding invalidates your address but leaves previously imported tickets available until you delete them individually or delete your account. When account deletion completes, the service removes your account profile, sign-in identities and sessions, forwarding alias, connected Gmail records, and account-scoped imported tickets and attachments from live storage. Cloudflare database recovery copies may retain earlier data for up to 30 days. Account deletion leaves locally saved journeys, trips, and tickets on your device; manage those separately in the app.

Stopping tracking deactivates that trip's server alert subscription. It does not immediately erase the installation, inactive subscriptions, Live Activity records, or associated delivery diagnostics. These device records are separate from your account and are not automatically deleted by account deletion. You may request deletion of inactive device, notification, or import records using the contact below. Historical infrastructure logs remain subject to the platform retention described above.

Third-party services

The Train Tracker service retrieves rail information from Amtraker, Transitous, iRail, Renfe, Fintraffic Digitraffic, Entur, SNCF, Deutsche Bahn, NS, ÖBB, the Swiss Open Transport Data platform, Iarnród Éireann, Translink, National Rail Darwin, Trafiklab, mobiliteit.lu, Elron, KTMB, Chepe Express, and their underlying public-transport data sources. VIA Rail schedule and route-geometry information is licensed under the Open Government Licence – Canada 2.0; source information is available from VIA Rail Developer Resources. Transwa schedule data is available free of charge from Transperth; Mexican schedule-only coverage is based on the official Chepe Express timetable. If licensed and enabled, the service may also retrieve rail information from Ekispert for Japan and TDX for Taiwan. The app may contact Amtraker or Transitous directly when the service is unavailable. Cloudflare provides service storage, request processing, and email routing. Apple and Google process their respective sign-in flows; Google also processes any separately authorized Gmail access. Apple processes push and Live Activity tokens and provides map services.

City photographs use public station coordinates with Apple's geocoder and city or image-file queries with Wikipedia and Wikimedia Commons. Images are downloaded from Wikimedia, cached on your device, and credited in the app. These network requests do not include local ticket contents or booking references, but providers receive ordinary network metadata such as your IP address. Image lookups use a session without stored cookies or credentials.

If you choose to open a ticket retailer, the app opens the retailer's general website in a browser. The current Omio handoff does not include your passenger details, booking reference, payment information, or selected itinerary in the link. The retailer handles its own browsing, booking, and payment data under its own privacy policy; Train Tracker does not collect your retailer payment details.

Sharing

A trip-share link contains a signed public train reference, service date, and optional boarding and destination station identifiers. It never includes forwarded message contents, ticket documents, passenger names, booking references, or barcodes. Anyone with the link can add the referenced train until the link expires. Train Tracker does not sell personal data or share it for advertising. Data is disclosed only to the infrastructure and rail-data providers needed to operate requested features, or when required by law.

Contact

Questions or deletion requests can be sent to jaguirre2192@gmail.com.