Why did the privacy policy change?
The privacy policy needed to change because of the release of push notifications functionality for the app. Previously all of the app functionality was local to the device (iPhone, iPad or Mac) and the only information that was sent from the phone was the pair of station codes that went to the National Rail API to load your next three trains.
With the introduction of push notifications, there is now cloud infrastructure that runs 24/7 that needs to know some details about your app setup in order to deliver push notifications. This infrastructure is only used if you have notifications enabled, and any data I hold is automatically deleted if you disable notifications.
Key things to know:
- The app does not send your location off your device. Equally, there are no advertising or analytics SDKs in use by Next3Trains that could inappropriately share your location.
- The data sent to the cloud infrastructure is stored in a Google Firebase Firestore database - this includes basic details about your app (version and build), whether you have certain settings turned on or not (commuting hours, location access, you use widgets or not), and the details of the commuting routes you have setup, and what your notification preferences are. If you have enabled location access to the app, it will also share the current (nearest) route that you have setup. These are all used to try to send you the most relevant delay and cancellation push notifications.
- I also store a device identifier, which identifies your device to the Apple Push Notifications system - this is a random identifier that is not tied to you personally and is used in order to send your notifications to your device.