Privacy

Last updated 3 September 2026

The short version

What the app stores

All of it, with nothing left out. Where something is described as scrambled, it is hashed with a secret key before it is written down — the result cannot be reversed, and it only ever answers the question “is this the same one as before?”

WhatWhy it existsKept
A scrambled device number So the reputation your reports earn stays with you instead of resetting. Taken from the identifier your phone gives apps — never a serial number, and it survives a reinstall but not a factory reset. Until you uninstall
An anonymous reporter id A random number that owns your reports. It is not derived from anything about you. Indefinitely
A scrambled network address Rate limiting — stopping one machine inventing a crowd. Your actual IP address is never written down. Indefinitely
Your reports What you reported, which station or route, when, and how far away you were — a distance in metres, not a position. This is the app. Indefinitely
Which stations you opened A count per station per hour, so the app can tell a busy platform from a quiet one. It records that a station was looked at, not who looked. 42 days
A notification token Only if you switch alerts on. Issued by Apple or Google, tied to no identity, and deleted when you switch them off or uninstall. Until you turn alerts off
Which alerts were sent So the same outage does not interrupt you twice. 14 days

Reports are not deleted when they stop counting. A report stops affecting the status after twenty minutes or six hours depending on what it says, but the row stays — it is how the app knows whether a reporter has been right before.

Location, specifically

The app asks for location in two places and uses it differently in each. Neither one sends a position anywhere it is kept.

When you report

Your position is read once to work out which of the five stations you are standing at, so you do not have to pick from a list. It is sent with the report, the server measures how far you were from the thing you reported, and the coordinates are discarded in the same request. Only the distance survives. Refuse location and everything still works — you pick the station yourself.

Arrival warnings, if you turn them on

Your phone watches the five station areas and wakes the app when you arrive. That watching is done by the operating system, on your device. The app is told “you arrived at Beechurst”, never a trail of where else you went, and nothing about your movements leaves the phone.

What is never collected

Your name or emailthere is no account to attach one to
Your coordinatesused, then discarded — only a distance is kept
Your IP addressscrambled before it is written down
Advertising identifiersno IDFA, no ad ID, no tracking prompt
Analyticsno Plausible, PostHog, Sentry or anything like them
Crash reportsnone, from anybody
Contacts, photos, calendarnever requested
Anything sold or sharedthere is no data business here

Who else touches it

One company, for one thing. If you switch alerts on, Google Firebase Cloud Messaging delivers them, and Apple's push service carries them on iPhone. They see a device token and the text of the alert — “Walnut is down” — and nothing about who you are, because the app does not know either.

Everything else runs on servers operated by this project. There is no other processor, no data broker, and nothing is transferred abroad for processing.

What you can do about it

Children

The app is for anybody who rides the PRT and is not directed at children under 13. It collects no personal information from anyone, of any age.

Changes

If this policy changes, the date at the top changes with it, and anything that alters what is collected will be said plainly rather than folded into a paragraph. Continuing to use the app after a change means the new version applies.

← Back to PRT Status Privacy Terms Support