Skip to content

Privacy Policy

Last updated: 16 August 2026

Overview

Railly is funded by advertising. We show ads served by Google AdSense so you can use the service for free. Ads are always shown — opting out of the cookie banner does not remove them. What you control is whether those ads are generic (contextual, no cookies) or tailored to your interests (personalised, cookies). Personalised ads are opt-in. We do not sell your data.

Data controller

Railly Rail Buddy. Contact our Data Protection Officer at [email protected].

What we collect and why

App preferences (local storage)

Your browser stores preferences such as theme, saved stations, and dismissed banners. For anonymous users this never leaves your device. If you create an account, preferences sync to our servers so they are available across devices.

Train data requests

When you search or view a board, our API queries our database to return live train information. These requests are processed in real time and are not retained.

Feedback

If you submit feedback, we store the message and optional context you provide, plus your IP address and user agent for anti-spam.

Server logs

Our server processes IP addresses and request paths for rate limiting and security. These logs are rotated automatically and are not used for profiling.

Analytics

We use Cloudflare Web Analytics, a cookie-less service that provides aggregate visitor numbers and performance metrics. It does not track you across sites. You can opt out via the cookie banner or block it with an ad blocker.

Advertising (Google AdSense)

Railly shows ads served by Google AdSense. Two modes:

  • Contextual ads (default): AdSense reads basic request data (IP address, user agent, page content) to select ads relevant to the page you're viewing. No cookies are set, no profile is built, and consent is not required.
  • Personalised ads (opt-in): if you enable “Personalised ads” in the cookie banner, Google sets cookies and reads identifiers (browsing on this site) to select ads tailored to your interests. You can withdraw this at any time — ads will return to contextual.

Rejecting personalised ads does not remove ads; you will still see contextual ads. See Google's privacy policy for the full list of partners and data uses.

Legal basis

  • Legitimate interests — Server logs for security and rate limiting; analytics for performance monitoring.
  • Consent — Feedback submissions, account creation, and personalised advertising (Google AdSense).
  • Contract — Account data (email, name) to provide cross-device sync.

How long we keep data

  • Feedback — Up to 12 months
  • Server logs — 30 days
  • Account data — Until you delete your account. Dormant accounts (2 years inactive) may be removed after notice.
  • Personalised-ad cookies — Session or up to 30 days, depending on the Google partner. Set only if you enable Personalised ads in the cookie banner; cleared when you switch it off.

Your rights

Under UK GDPR you have the right to access, correct, delete, or restrict processing of your personal data, and to request a portable copy. To exercise these rights, email [email protected]. We will respond within one month. You may also lodge a complaint with the Information Commissioner's Office.

Contact

For privacy questions, email [email protected].