Rail
Download

Privacy policy

Rail works without accounts, ads or analytics: your favorites, your searches and your location stay on your iPhone. This policy explains what data the app and this website process, why, for how long and what rights you have.

Data controller

The controller of the data processed by Rail, the app and this website, is Juan Salguero Ibarrola, tax ID (NIF) 26262302M, with address at Calle Juan Díaz del Moral, 34, 29629 Torremolinos (Málaga), España, who publishes Rail under the trade name Jade Horizon Studio.

For anything to do with your data, write to privacy@jadehorizonstudio.com.

Rail is an independent app: it is not an official Renfe app and has no connection with Renfe Operadora.

In short

  • No sign-up and no accounts: Rail doesn’t ask for your name, email address or password.
  • Your location, your favorites, your searches and the copy of the timetables stay on your iPhone.
  • If you turn notifications on, our server keeps a notification identifier, your language and the lines you follow. Nothing else.
  • No advertising, analytics or trackers, and we don’t sell or share data with anyone.
  • Purchases are handled by Apple: we never see your payment details or your Apple Account.

What stays on your iPhone

This information is stored only on your iPhone and is not sent to our server:

  • Your favorite stations and their order.
  • Your recent journey searches.
  • The usual station you choose if you don’t share your location.
  • The copy of the network and the timetables that the app downloads so it can work offline.
  • If you have Rail Plus: the app checks it with the App Store on the iPhone itself and stores the result there.

The widget reads that same data on the device. As it never leaves the device, we have no access to it. If you delete the app, it is deleted with it.

Location

Sharing your location is optional, and Rail only asks for it while you’re using the app. If you allow it, Rail uses it on your iPhone to place you on the map, show you the nearest stations and work out how far you are from each one.

  • Your location is not stored or sent to our server.
  • To estimate how long it takes you to reach a station on foot, by bike, by car or by public transport, the app queries Apple Maps with your position and the station’s. Apple processes that query under its privacy policy.
  • You can withdraw the permission at any time in Settings › Privacy & Security › Location Services › Rail. Without it, you choose your usual station and everything else works the same.

Notifications

Notifications are optional and you only get them if you give permission. They tell you about the disruptions Renfe reports on the lines you choose, never about advertising. To send them, the app registers the following on our server:

  • The notification identifier Apple assigns to Rail on your iPhone. It only serves to send you Rail alerts and doesn’t reveal your name or your Apple Account.
  • The language you want to receive them in.
  • The lines you follow and, for each one, whether you want every alert to make a sound or only the important ones.
  • Whether the app is a development build or the published one, because Apple uses a separate channel for each.
  • The date of the last registration and its expiry date.

We don’t keep your location, your favorites or which alerts we’ve sent you. Alerts reach you through Apple’s push notification service, which receives the identifier and the text of the alert in order to deliver it.

Connections the app makes

  • Timetables, live trains and alerts. Rail downloads them from our server, which reuses Renfe’s open data and the notices Renfe publishes on its official channels. These requests carry no location, no identifier of yours and nothing you store in the app.
  • Maps. The map and the journey estimates come from Apple Maps. When you tap “Start route” or “Directions”, the Maps app opens with the station as the destination.
  • Translation. If your iPhone isn’t set to Spanish, you can translate alerts with the translation built into iOS. According to Apple, this happens on the device itself; the first time, iOS may ask you to download the language.
  • Purchases. When you buy or restore Rail Plus, iOS communicates with the App Store.

As with any internet connection, our server receives your IP address in order to respond. We don’t keep it in our logs or use it to identify you.

  • Sending you notifications (identifier, language, lines and alert level). Legal basis: your consent, which you give by turning them on (Art. 6(1)(a) GDPR). You can withdraw it at any time by turning them off, without affecting the processing carried out before.
  • Serving the timetables, the map and the alerts, and protecting the service against abuse (IP address and technical data of each request). Legal basis: our legitimate interest in keeping the service working and secure (Art. 6(1)(f) GDPR).
  • Replying when you write to us (your email address and whatever you tell us). Legal basis: our legitimate interest in helping you or, if your query is about a purchase or the use of the app, the performance of the contract (Art. 6(1)(b) GDPR).
  • Handling your rights and complying with the law. Legal basis: the legal obligations that apply to us (Art. 6(1)(c) GDPR).

You don’t have to give us any data: without notifications, the app works the same but won’t alert you to disruptions. We don’t profile you or make automated decisions that affect you.

How long we keep data

  • Notification registration. Deleted as soon as you turn notifications off in the app or stop following every line. If you turn them off in iOS Settings, it is deleted the next time you open Rail. If you delete the app or stop using it, it is removed automatically 120 days after its last registration; the app renews it at most once a day when you open it.
  • Server request logs. They record the time, the address requested and the result, without your IP address or details of your device, and are deleted after two weeks. For the notification registration, the address requested includes the notification identifier.
  • Server error logs. They contain no personal data and are deleted after one month.
  • Emails you send us. For as long as needed to handle your query and, after that, kept blocked for the periods during which liability arising from it could be claimed.

Who else processes data

  • Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) hosts our server and this website as a processor. The server’s data is stored in its Paris region (France).
  • Apple distributes the app, charges for purchases on the App Store, delivers notifications and provides the Maps service. It processes data for those purposes under its own privacy policy. We don’t receive your payment details or your Apple Account.
  • Email. Our email uses Apple’s iCloud. If you write to us, your message is stored on its servers.
  • Apple statistics. If you agree on your iPhone to share data with developers (Settings › Privacy & Security › Analytics & Improvements › Share With App Developers), Apple gives us crash reports and aggregated usage statistics that don’t identify you.

We don’t sell or share data with third parties. We would only disclose it to authorities or courts where the law requires us to.

International transfers

Our server is in the European Union. Even so, some data may be processed outside the European Economic Area (EEA): Apple and Amazon Web Services belong to groups headquartered in the United States, notifications pass through Apple’s servers, and Amazon’s content delivery network (CloudFront) responds from the location closest to you, which may be outside the EEA if you are. Those transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the Commission, as applicable.

Your rights

You can ask us at any time for:

  • Access: to know whether we process data about you and to get a copy.
  • Rectification of inaccurate data.
  • Erasure of your data.
  • Objection to processing based on our legitimate interest.
  • Restriction of processing.
  • Portability: to receive the data you gave us in a structured, commonly used format.
  • Withdrawal of consent, at any time and without affecting the processing carried out before.

To exercise them, write to privacy@jadehorizonstudio.com saying which right you want to exercise. We will reply within one month, which may be extended by two further months if the request is complex; if so, we will tell you. We will only ask for what is strictly necessary to verify your identity.

As there are no accounts, your notification registration can only be found by its identifier, which you can’t see. The quickest way to delete it is to turn notifications off in the app: it is deleted at that moment.

Complaints to the AEPD

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), at www.aepd.es or at C/ Jorge Juan, 6, 28001 Madrid, Spain, or with the data protection authority of the EU country where you live. We would appreciate it if you wrote to us first so we can try to resolve it.

Security

The connections of the app and this website are encrypted (HTTPS). The server keeps only what is strictly necessary, access to it is restricted, and only our own system can publish alerts on it. If a security breach affected your data, we would notify the AEPD and, where the law requires it, the people affected.

This website

This website uses no cookies and stores nothing in your browser, contains no analytics or trackers, and serves its fonts from the site itself, so your browser connects to no third parties when you open it. It is hosted on Amazon Web Services, which receives your IP address and the technical data of each request (such as the browser and the page requested) in order to serve it. We don’t keep visitor logs or compile statistics.

Links to other sites, such as the App Store, YouTube or Renfe, lead to pages with their own privacy policies.

Children

Rail doesn’t ask anyone for their name, age or contact details. In Spain, children under 14 need the consent of their parent or guardian for processing based on consent (Art. 7 of the Spanish Data Protection Act, LOPDGDD): if you are under 14, ask the person who looks after you to turn on notifications with you. Purchases by children are controlled with Apple’s Family Sharing and Ask to Buy.

Changes to this policy

If Rail changes in a way that affects your data, we will update this page and the date at the top. If a change needs your consent, we will ask for it before applying it.

Contact

For any question about privacy, write to privacy@jadehorizonstudio.com. For help with the app, write to support@jadehorizonstudio.com.