Privacy Policy

1. Who is responsible

OK LETS GO LTD operates Train Track & Alarm, this website and the app’s connected service, and is the controller of personal information we decide how to use. Our contact for privacy questions and requests is really@dilligaf.fyi.

This notice covers the iPhone app, Friends, railway monitoring, our product website and support enquiries. It supplements our company privacy policy. For the Train Track & Alarm processing described here, this specific notice takes priority. Other products’ advertising or analytics arrangements do not automatically apply to this app.

2. What stays on your iPhone

Your full journey journal, completed history, private notes, alarm destinations, recorded GPS routes, travel statistics and preferences are kept on your device. They can be included in Apple or computer device backups according to your settings. Friends sign-in does not back up or synchronise the full journal between devices. Optional Calendar tools create separate schedule copies as described below.

Arrival alarms and optional route recording use your iPhone’s location, including in the background if permitted. We do not upload your phone’s GPS coordinates, recorded routes or private notes to our rail backend or share them with friends. Apple supplies the maps used by the app and processes map requests under its own terms. Place searches can send the search text and map search area to Apple through MapKit; that is separate from our rail backend and Friends.

You can decline or change location permissions in iPhone Settings. That affects location-based features without making a Friends account compulsory. We do not read your iPhone address book. A friend connection in our service does not mean we have accessed your phone contacts.

3. Information used for online features

Finding trains & keeping them updated

Station searches and train refreshes send the selected station codes and railway service identifiers to our backend and railway data providers. Your local recent-station search history is not uploaded as a history list.

When you request server-backed monitoring, notifications or Live Activities, the service stores the relevant train identifier and date, stations, scheduled times, railway update snapshot, expiry and notification preferences. It also uses an account or guest identifier, installation identifier, push or Live Activity tokens and delivery status. Private monitoring can use a guest session without Apple sign-in.

Your Friends profile

Sign in with Apple supplies an Apple account identifier and, when available, the name you choose to provide. We store that identifier, an internal account identifier, display name, preset avatar, friend code, requests, invitations, accepted connections and authentication information. We request your name rather than your email address or Apple password. Retained Apple refresh tokens are encrypted.

Signed-in people who have your code or profile link can see your display name and avatar and send a friend request. The public profile-link page does not expose your name or journey details. There is no public name directory. You can replace your friend code or disable new requests in Your profile.

Automatic journey sharing

Once a friend request is accepted, you automatically see each other’s saved upcoming and active journeys. While signed in, the app uploads the stations, scheduled times and service identifiers for those journeys, including relevant journeys saved before the connection and ones you save later. Friends see your name and avatar alongside available railway delays, platforms and the train’s last reported station. Manual entries show scheduled details.

A pending request or profile view does not grant access to journeys. Notes, completed history, recorded routes and phone GPS are not shared. Removing a friend ends server access both ways. Deleting a saved journey removes its sharing when your phone next synchronises online. Signing out does not withdraw journeys already shared. Someone may retain details they have already seen or copied, or an older notification or offline widget snapshot.

Widgets, support & purchases

Widgets, notifications and Live Activities can display a name and journey details on the Home Screen or Lock Screen. Shared widgets use limited access for a selected journey, rather than exposing the full account session. Device preview settings determine who can see this information on your screen.

If you contact support, we receive your email address and the contents and attachments you send. Apple handles App Store billing. StoreKit verifies purchase entitlements on the device; we do not send your card details or purchase history to our rail backend.

3A. Weather, Calendar & journey imports

Weather at your destination

Destination forecasts use Apple Weather through WeatherKit. The app sends your destination station’s latitude and longitude to Apple and selects the forecast around your expected arrival. This request does not send your phone’s current GPS position, private notes or friend connections to our rail backend or to Apple as part of the forecast request. Forecasts, their update times and Apple attribution information are cached on your iPhone.

Rain advice and the pre-arrival weather reminder are optional local iPhone notifications, separate from your GPS arrival alarm and server-backed train alerts. They use your saved journey, available arrival updates and the latest forecast obtained by the app. A notification appearing while the app is closed does not mean a fresh forecast was fetched at that moment. It can show destination and weather information on your screen. Change these reminders in Settings → Destination weather or change notification permissions in iPhone Settings.

Optional Pro Calendar sync

With verified Pro access, you can enable Calendar sync and grant Calendar permission. The app creates or uses a dedicated Train Track & Alarm calendar for up to 100 of your own upcoming or active saved journeys. It copies station names, saved timetable times, available operator/train labels and an app journey link and ownership identifier so it can update its own events. Personal journey notes, GPS routes, friend profiles and friends’ journeys are not copied.

The app requests full Calendar access to find and update the events it creates. The sync/export feature uses its dedicated calendar and stored event identifiers to locate its own events, and checks ownership before changing or deleting an event. It does not upload Calendar contents to our backend. Your selected calendar account, such as iCloud, can synchronise those copies to other devices under that provider’s terms. Updates happen during app use, not as a continuous background or live-delay feed.

Optional Pro Calendar import

When you connect Calendar import, the app lists calendar names, account names and identifiers so you can choose sources. When you ask it to scan, it checks up to 500 upcoming events in your selected calendars over the next 90 days, presenting up to 100 candidate train journeys for review. It uses titles, locations, dates, event/calendar identifiers, all-day status and event links, including to exclude its own exported journeys. The import model does not read event notes, attendees or attachments. Source selections and limited duplicate-import records are stored locally.

Booking text, PDFs & calendar files

With Pro, you can select a text-based PDF, plain-text booking or .ics calendar file, or paste booking text. Files and text are parsed on your iPhone, not uploaded to our servers for parsing. The importer does not sign into your inbox, accept forwarded email, follow links in a booking, or scan ticket QR codes. File and cloud-calendar providers may separately store or synchronise the originals.

You review and confirm a journey before saving. Scanning or parsing alone does not automatically save or share it. Once confirmed, the normalised stations, dates and times enter your journal and follow the ordinary rules: eligible upcoming journeys are automatically shared with accepted friends while signed in, and can be copied to Calendar if sync is enabled. Raw booking text and source-event titles are not uploaded through Friends. Imported journeys are scheduled entries, without an automatically verified live railway service.

4. This website, cookies & advertising

Our website is an information site, not an online copy of your Friends account. It does not request your phone’s location, read your app journal or set a real alarm. The on-page alarm switch and app previews use demonstration data.

When you visit, our hosting and security providers process connection details such as your IP address, requested URL, browser information, time of request and technical errors to deliver and protect the site. The public website at traintrackalarm.com is hosted by 20i and does not require an account or passcode to browse. A separate private development preview uses OpenAI’s Sites infrastructure and Cloudflare, with access controls handled by that platform. Hosting and security providers handle technical access records; your OpenAI password is not provided to us.

The site does not add advertising cookies, analytics scripts, session replay, tracking pixels or marketing forms. Fonts and app images are served from this site. Demo selections are held only while the page is open, rather than saved as a marketing profile. See our Cookie Notice for the distinction between site features and hosting access controls.

There are no ads in Train Track & Alarm or this website at present. We plan to introduce advertising in the future. Before doing so, we will update the relevant notices to identify the advertising providers, information involved and your choices. Where law requires consent for advertising cookies, device access or tracking, those tools will not operate until the necessary consent is obtained. This statement does not give advance consent to future advertising.

The app currently contains no advertising SDK or third-party behavioural analytics SDK. We do not sell personal information or share it for targeted advertising. Clicking an external link, including an App Store or email link, takes you to a separate provider with its own privacy practices.

5. Why information is used & the legal bases

Under UK data protection law, a legal basis is needed for personal information we process. The basis depends on the activity:

We do not treat accepting these Terms or granting one device permission as consent to unrelated advertising. We do not make decisions about you with legal or similarly significant effects using solely automated processing. Railway update calculations are not decisions about your eligibility for a service.

You do not have to create a Friends account. If you do not provide the identifiers or permissions needed for a particular feature, that feature may not work; you can still use unrelated features where possible.

6. Who receives information & international processing

• Your accepted friends: the profile and upcoming journey information described above.
• Cloudflare: hosting for the rail backend, account database, monitoring and security. Railway data requests contain train or station details, not your Friends profile or recorded GPS history.
• Apple: authentication, notifications, maps, App Store services and device backups you enable. Apple also supplies destination forecasts through WeatherKit. Calendar account and file-storage providers handle any copies you store or synchronise with them. Apple handles its own services under its applicable privacy terms.
• National Rail services via Rail Data Marketplace: railway searches and service data needed to answer your request.
• 20i and other website hosting and email providers: technical information to serve the site, essential private-preview access, and correspondence you send to support.

We may also disclose information where necessary to comply with law, protect people or investigate abuse. If the business is transferred, relevant information may transfer as part of that transaction with appropriate safeguards and notice where required. We do not grant buyers a right to use your data contrary to applicable law.

Providers operate internationally, and information may be processed outside the UK. Applicable provider data-protection terms describe transfer safeguards, which can include recognised adequacy decisions or approved contractual safeguards, such as the UK Addendum to standard contractual clauses. Contact us for information about the safeguards relevant to your data. We do not promise that all information stays in the UK.

Relevant provider information: 20i privacy, Cloudflare privacy, Cloudflare data protection terms, Apple privacy and OpenAI privacy.

7. How long information stays

Retention depends on the information and feature. Expiry stops access; periodic maintenance removes expired backend records, so expiry is not a promise of immediate physical erasure.

• Calendar copies: while sync, Pro access and permission remain enabled, removing or cancelling a journey removes its app-created future event when the app processes the change. Past and completed events are retained. Turning sync off, withdrawing permission or losing Pro access pauses updates without deleting existing Calendar entries. Deleting Friends or uninstalling the app does not independently delete Calendar copies; manage them in Calendar or with your account provider.
• Calendar import records: selected calendar identifiers and hashed event fingerprints linked to saved journey identifiers remain on-device. Import records are capped at 2,000 and records older than 366 days are pruned when import runs. Sync’s event-link bookkeeping is pruned for events more than 90 days in the past when sync runs; this does not delete the Calendar history.
• Weather cache and reminders: the cache holds up to 48 destination forecasts and excludes records older than 24 hours on subsequent cache loading or pruning. Stale files may remain until the app next processes them or its cache is cleared. Reminder preferences stay in app settings; duplicate-reminder records are pruned after 120 days when reminders are reconciled. Removing or completing a journey clears pending reminders when the app processes the change.
• Local journal and routes: until removed from your device. Backups and exported copies are controlled separately by you and your backup provider.
• Friends profile and connections: until removed or the account is deleted.
• Automatically shared journeys: can be saved up to a year ahead and expire two hours after scheduled arrival. Online synchronisation of removal or completion can remove them sooner.
• Private monitoring: legacy monitoring expires no more than 24 hours after creation or extension and no later than six hours after arrival.
• Requests and codes: friend requests expire after seven days. Declined requests can remain for 24 hours and cancelled requests for five minutes to limit repeated requests. Codes last until replaced, disabled or the account is deleted. Older single-use invitations expire after 24 hours.
• Sessions and devices: sessions expire after 30 days. Expired sessions and device registrations unused for 30 days are cleared by maintenance, followed by guest profiles with no sessions.
• Live Activities and delivery: ordinary registrations last at most eight hours; minimal cancellation records can remain for 24 hours to prevent delayed requests restarting an activity. Notification retries expire after five minutes; expired delivery records are cleared by maintenance.
• Account deletion: removes the profile, connections, trips and associated access and device records from the active service. An encrypted Apple token can remain for revocation retries for up to 30 days. Provider recovery copies may remain for the provider’s backup period and are not used to restore deleted access in normal operation.
• Support and technical records: kept for the time reasonably necessary to resolve the enquiry, maintain security and meet any legal requirements. The period depends on the issue and provider; contact us about records relevant to you.

8. Security & younger users

We use access controls, encrypted network connections and limited credentials to protect connected features. Application logs record limited error categories and notification delivery status rather than request bodies, Apple identity tokens or push token values. Hosting and network providers may keep their own technical security records. No system is completely secure.

We do not collect a date of birth to operate Friends. Anyone using it should understand that accepting a connection reveals upcoming travel plans. A parent or guardian supervising a younger user should review friends, permissions and screen previews with them. The app is not a child safeguarding or emergency monitoring service. Contact us if you believe a child’s information has been shared inappropriately.

9. Your choices & rights

You can manage friend connections and requests, replace your code, remove saved journeys, change notification and device permissions, manage optional Calendar tools and weather reminders, or delete a Friends account. Detailed steps are on Privacy choices & account deletion.

Subject to the conditions and exemptions in applicable law, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. Where consent is the basis, you can withdraw it without affecting the lawfulness of earlier processing. We may need proportionate evidence of your identity to protect your account.

Send requests to really@dilligaf.fyi. We respond without undue delay and normally within one calendar month, subject to the permitted rules for verification, clarification and extensions. If an extension is allowed and needed, we will explain it. Please do not send passwords or sign-in codes.

You can complain to us or to the UK Information Commissioner’s Office. Contacting us first does not remove your right to complain to the regulator.

10. Updates & contact

We will update this notice when the product or its information handling changes, including before advertising is introduced. We will provide an appropriate additional notice for material changes and seek consent where required, rather than treating a policy update as permission.

Privacy contact: really@dilligaf.fyi. Postal correspondence can be sent to OK LETS GO LTD at the registered office above.