Your journey. Your information.
This notice explains the public RailPlanner beta, the information used to plan train journeys, and your choices when using the service.
Controller: Dario Bonfiglio.
Privacy contact: dario.bonfiglio@outlook.com.
RailPlanner is a free public beta with partial timetable coverage. No account is required to plan a journey. For questions, corrections or privacy requests, contact the controller at the address above.
What the planner processes
| Activity | Information and purpose | Where it goes / how long |
|---|---|---|
| Finding trains | Station names and identifiers, coordinates of selected stations, travel dates/times, transfer buffers and planned pauses. These are used to answer the searches you request. The app does not request your name, ticket details or precise device location. | From your browser through Vercel hosting to our MOTIS server on Oracle Cloud in Milan. Requests and results use bounded in-memory caches; no journey-history database is configured. |
| Protecting the service | Request times, connection metadata and a client IP address or hosting-supplied account identifier can be used for rate limiting, delivery and security. | Vercel and its infrastructure providers handle website delivery. The app’s rate-limit map is bounded and held in process memory. Backend bridge access logging is disabled; system/provider logs are separate. |
| Saving routes | Only when you select Save: your chosen trip name, stations, travel date/time and pause preferences. | Stored under railplanner-trips in this browser’s local storage. It stays until you remove the saved trip, clear site data or the browser removes it. Loading a saved route sends fresh search requests. |
| Downloading an itinerary | The selected itinerary is turned into a PDF in your browser, including its map and links to operator homepages. The PDF generator and fonts are served by RailPlanner. Map tiles for the exported route are requested from OpenStreetMap. Operator websites are contacted only when you follow a link. | The PDF is saved on your device; it is not uploaded to a PDF service. OpenStreetMap receives the map requests described below. |
| Showing maps | Your browser requests the map tiles for the area displayed. The tile provider receives your IP address, browser request details and the requested map areas. | Directly to OpenStreetMap Foundation’s tile service. OSMF has its own privacy policy and retention rules. |
| Hosting statistics and access | Vercel handles delivery and may keep operational traffic and security records. RailPlanner does not enable a separate analytics SDK. The public planner does not require you to sign in. RailPlanner does not add Google Analytics, session replay or its own user-account database. | Vercel hosting and its delivery infrastructure. The app does not control platform analytics or authentication retention. |
| Contacting us | Your email address, message and any information you choose to include, to answer your request and handle privacy enquiries. | The controller’s Outlook mailbox, operated by Microsoft. Correspondence is kept while needed to resolve the enquiry and necessary follow-up or legal obligations; ordinary enquiry correspondence is deleted within six months of resolution unless needed for an ongoing dispute or a legal obligation. |
Why we process it
Requested searches, temporary caching, service security and ordinary enquiries serve our legitimate interests in operating RailPlanner (GDPR Article 6(1)(f)). We use consent for optional advertising where required, and legal obligations where applicable to rights requests. Stations/dates are needed for a relevant search; saving trips and emailing us are optional. RailPlanner makes no decisions with legal or similarly significant effects.
Cookies, local storage and advertising
The planner uses local storage for trips you choose to save. Browser caches retain site assets and map tiles under their cache settings. Hosting sign-in/security features may use their own cookies. Fonts are served from RailPlanner itself, so loading the interface does not contact Google Fonts.
This beta does not serve advertising. A publisher-verification meta tag and ads.txt identify the intended seller; they do not execute advertising code or request an ad. Sponsor previews are hidden. No advertising or consent-manager script is loaded by the beta.
If advertising is introduced later, this notice and the advertising page will be updated before activation, with consent controls where required. Refusing optional advertising will not prevent journey planning.
Recipients and international processing
Infrastructure involved in delivery includes Vercel hosting and its Node.js API runtime, Oracle Cloud for our Milan timetable server, OSMF for map tiles, and Microsoft if you email us. Google advertising partners are involved only when the advertising integration is enabled. These providers’ roles and contractual terms differ; we do not describe every provider as our processor.
The Milan backend does not make this an EU-only service. Our API functions are configured for Vercel’s Frankfurt region; website assets are delivered through its global network and other providers may process information outside the EEA. The providers’ linked privacy policies describe their international processing and applicable safeguards. RailPlanner does not select an EU-only hosting region for all Vercel services or set its platform log-retention periods. Contact us for questions about the providers involved in your request; we do not promise a fixed deletion period for systems outside our control.
Retention and your controls
RailPlanner does not deliberately write your search history to a persistent application database. Browser and Worker caches have bounded entries: autocomplete results are considered fresh for up to one hour, and other search results for 30–60 seconds. These are freshness limits, not guarantees that an expired entry is erased from process memory at that exact instant; entries are replaced, evicted or lost when the process/page ends.
Our Python backend bridge does not log station/date queries. Access logging is disabled on the dedicated API proxy. Native service and infrastructure error/security logs can still be retained by the operating system or providers. Platform and operating-system security/error records follow the relevant service’s retention settings and policies; they are separate from RailPlanner’s in-memory search caches. We do not promise that provider systems store no IP addresses or request metadata.
Delete routes in Saved trips, or use your browser’s clear-site-data controls to remove local storage. Downloaded itineraries are files on your device and remain until you delete them. When contacting us, include only the details needed to handle your enquiry.
Your rights
Where applicable, you may request access, correction, erasure, restriction or portability; object to legitimate-interest processing; and withdraw consent without affecting earlier lawful processing. Contact dario.bonfiglio@outlook.com. Proportionate identity checks may be necessary.
You may complain to a supervisory authority, particularly where you live, work or where an alleged infringement occurred, including Italy’s Garante or Austria’s Datenschutzbehörde. We do not assign a lead authority here.