Your journey. Your information.
This notice explains the public RailPlanner beta, the information used to plan train journeys, and your choices when using the service.
Controller: Dario Bonfiglio.
Privacy contact: dario.bonfiglio@outlook.com.
RailPlanner is a free public beta with partial timetable coverage. No account is required to plan a journey. For questions, corrections or privacy requests, contact the controller at the address above.
What the planner processes
| Activity | Information and purpose | Where it goes / how long |
|---|---|---|
| Finding trains | Station names and identifiers, coordinates of selected stations, travel dates/times, transfer buffers and planned pauses. These are used to answer the searches you request. The app does not request your name, ticket details or precise device location. | From your browser through Sites hosting to our MOTIS server on Oracle Cloud in Milan. Requests and results use bounded in-memory caches; no journey-history database is configured. |
| Protecting the service | Request times, connection metadata and a client IP address or hosting-supplied account identifier can be used for rate limiting, delivery and security. | Sites and its infrastructure providers handle website delivery. The app’s rate-limit map is bounded and held in process memory. Backend bridge access logging is disabled; system/provider logs are separate. |
| Saving routes | Only when you select Save: your chosen trip name, stations, travel date/time and pause preferences. | Stored under railplanner-trips in this browser’s local storage. It stays until you remove the saved trip, clear site data or the browser removes it. Loading a saved route sends fresh search requests. |
| Showing maps | Your browser requests the map tiles for the area displayed. The tile provider receives your IP address, browser request details and the requested map areas. | Directly to OpenStreetMap Foundation’s tile service. OSMF has its own privacy policy and retention rules. |
| Hosting statistics and access | Sites provides built-in traffic statistics, including page views and unique visitors. The public planner does not require you to sign in. RailPlanner does not add Google Analytics, session replay or its own user-account database. | OpenAI / Sites hosting and its delivery infrastructure. The app does not control platform analytics or authentication retention. |
| Contacting us | Your email address, message and any information you choose to include, to answer your request and handle privacy enquiries. | The controller’s Outlook mailbox, operated by Microsoft. Correspondence is kept while needed to resolve the enquiry and necessary follow-up or legal obligations; ordinary enquiry correspondence is deleted within six months of resolution unless needed for an ongoing dispute or a legal obligation. |
Why we process it
Requested searches, temporary caching, service security and ordinary enquiries serve our legitimate interests in operating RailPlanner (GDPR Article 6(1)(f)). We use consent for optional advertising where required, and legal obligations where applicable to rights requests. Stations/dates are needed for a relevant search; saving trips and emailing us are optional. RailPlanner makes no decisions with legal or similarly significant effects.
Cookies, local storage and advertising
The planner uses local storage for trips you choose to save. Browser caches retain site assets and map tiles under their cache settings. Hosting sign-in/security features may use their own cookies. Fonts are served from RailPlanner itself, so loading the interface does not contact Google Fonts.
This beta does not serve advertising. A publisher-verification meta tag and ads.txt identify the intended seller; they do not execute advertising code or request an ad. Sponsor previews are hidden. No advertising or consent-manager script is loaded by the beta.
If advertising is introduced later, this notice and the advertising page will be updated before activation, with consent controls where required. Refusing optional advertising will not prevent journey planning.
Recipients and international processing
Infrastructure involved in delivery includes OpenAI’s Sites hosting, its Cloudflare-based runtime, Oracle Cloud for our Milan timetable server, OSMF for map tiles, and Microsoft if you email us. Google advertising partners are involved only when the advertising integration is enabled. These providers’ roles and contractual terms differ; we do not describe every provider as our processor.
The Milan backend does not make this an EU-only service. Sites does not currently offer data-residency controls for deployed Sites and logs; other providers may process information outside the EEA. The providers’ linked privacy policies describe their international processing and applicable safeguards. RailPlanner does not select an EU-only hosting region for Sites or set its platform log-retention periods. Contact us for questions about the providers involved in your request; we do not promise a fixed deletion period for systems outside our control.
Retention and your controls
RailPlanner does not deliberately write your search history to a persistent application database. Browser and Worker caches have bounded entries: autocomplete results are considered fresh for up to one hour, and other search results for 30–60 seconds. These are freshness limits, not guarantees that an expired entry is erased from process memory at that exact instant; entries are replaced, evicted or lost when the process/page ends.
Our Python backend bridge does not log station/date queries. Access logging is disabled on the dedicated API proxy. Native service and infrastructure error/security logs can still be retained by the operating system or providers. Platform and operating-system security/error records follow the relevant service’s retention settings and policies; they are separate from RailPlanner’s in-memory search caches. We do not promise that provider systems store no IP addresses or request metadata.
Delete routes in Saved trips, or use your browser’s clear-site-data controls to remove local storage. Downloaded itineraries are files on your device and remain until you delete them. When contacting us, include only the details needed to handle your enquiry.
Your rights
Where applicable, you may request access, correction, erasure, restriction or portability; object to legitimate-interest processing; and withdraw consent without affecting earlier lawful processing. Contact dario.bonfiglio@outlook.com. Proportionate identity checks may be necessary.
You may complain to a supervisory authority, particularly where you live, work or where an alleged infringement occurred, including Italy’s Garante or Austria’s Datenschutzbehörde. We do not assign a lead authority here.