Privacy policy

Last updated 25 October 2026. This is the same text as in the app.

What we keep

Your Google account email address and Google account ID. The routes you save and their alert settings. The alerts we sent you. For each phone: a random installation ID, a hashed sign-in secret, its push notification token, and when it was last used.

What we do not keep

Your location, your contacts, your name or photo from Google, or any payment details. We do not show ads and we do not sell or share your data for marketing.

Why we keep it

To run the service you ask for (UK GDPR Article 6(1)(b)): to know which trains to watch, to send alerts to your signed-in phones, and to keep your routes when you change phone.

Who else handles it

Google, to confirm your sign-in. Expo and Google Firebase Cloud Messaging, to deliver push notifications. Our hosting provider, which runs the server and database. We send station codes and times to National Rail data services, never your identity.

Our website

Vercel hosts gowhistle.app. The website uses Vercel Web Analytics and Speed Insights to count visits and measure how fast pages load, in our legitimate interest in running the website (UK GDPR Article 6(1)(f)). They set no cookies and do not identify you.

How long we keep it

Until you delete a route or your account. When you delete your account, we delete your routes, their alert history and the account at once, and sign out all your phones.

Your rights

You can ask for a copy of your data, ask us to correct it, or delete it. Delete your account in the app (Account, Delete account) or email support@gowhistle.app. You can also complain to the Information Commissioner's Office (ico.org.uk).

Contact

Privacy questions: support@gowhistle.app.