Privacy

Your email address, so you can sign in and so we can write to you about the site itself. It is not used for anything else and it goes nowhere else.

Your password, hashed. It is stored as a bcrypt hash, which is a one-way transformation: the password itself is never written down, and nobody here can read it.

A display name, if you set one, and the stations and trains you save. That is the point of the account — they are yours and they are not shown to anyone else.

Your sessions. When you sign in, a row records that a browser is signed in, when it was last used, and a one-way hash of the address and browser it came from, so that you can see where you are signed in and sign the others out.

You can change your email, your name and your password, and sign out your other sessions, from your profile. To have the account and the address deleted, or to ask what is held about you, write to [email protected] and it will be done.

Signing in or signing up records a one-way hash of your IP address, so that repeated failures can be slowed down and the sign-up form cannot be used by bots.

These are keyed with a secret that is not stored in the database, so the hashes cannot be turned back into addresses even by somebody who takes a copy of the whole table.

Sign-up records are kept for an hour. Failed sign-in records are kept only as long as the lockout window needs them.

Like every web server, this one writes a line for each request: your IP address, the page, the time, your browser's name, the page that linked you here and, if you are signed in, your account number. It is kept for 30 days, read by nobody but the site's owner, and used to keep bots out and to count how many people visit.

That count keeps a one-way, keyed hash of address and browser together, so it can tell a new visitor from a returning one without holding the address. It forgets anybody not seen for a year. The daily totals it produces hold no addresses at all.

Two are strictly necessary and are set whichever way you answer. One holds a token that proves a form came from this site; the other says you are signed in.

Google Analytics sets its own, and only if you allow it. It tells us which pages get read and roughly where readers arrive from, which is how we decide what to build next. It is never used for advertising and nothing here is sold. If you said no, none of it is loaded: no cookie is set and no request is made to Google at all.