Privacy Policy

Introduction

TF Halibut ("we", "us", or "our") operates the Calling Points mobile application (the "App"), which helps people in the United Kingdom plan and track train journeys. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

Calling Points is a UK consumer product, so this policy is written to the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). By using the App, you agree to the handling of information described here.

Our Approach

The App is built to need as little of your data as possible. You can plan journeys and read live departure information without creating an account, and nothing non-essential is collected until you actively opt in. We show no advertisements, use no advertising identifier, and do no cross-app tracking.

Information We Collect

Account and identity

When you first open the App it signs you in anonymously using Firebase Authentication. This anonymous identity is a random identifier that owns your saved data on our servers; it contains no personal information about you.

If you choose to create a permanent account — to sync across devices — you may sign in with Google, Apple, or an email address and password. In that case we collect:

• Your display name
• Your email address
• Your authentication provider identifier

Upgrading from an anonymous to a permanent account keeps the same underlying identity, so the journeys and commutes you have already saved carry over.

Saved journeys and commutes

When you save a journey or set up a commute, we store it against your account so it is available across your devices:

• The origin and destination stations and the time you chose
• For a commute, the days and time window it applies to
• A small amount of display information so your lists load quickly

Notification registration

Where you enable notifications about your journeys, we store a push notification token for each of your devices, along with the device platform and when it was last seen, so that we can deliver those notifications. Tokens are removed when you sign out of a device and when your account is deleted.

Analytics and diagnostics (opt-in only)

Analytics, crash reporting, and performance monitoring (provided by Firebase) are switched off by default. They are enabled only if you actively opt in, and you can withdraw that consent at any time in the App's settings. When enabled, these tools collect:

• Device and app information such as device type, operating system, app version, and general region
• In-app events such as which features and screens you use, sign-in events, and the method used
• Crash reports and performance measurements

No directly identifying information — your name, email address, or the specific journeys you save — is included in these analytics events.

Data stored on your device

Some data stays on your device and is not sent to us, including your chosen theme, your analytics consent choice, cached data for offline use, and your authentication tokens, which are held in encrypted device storage.

How We Use Your Information

We use the information we collect solely to:

• Provide and operate the App — planning journeys, saving the ones you choose, and syncing them across your devices
• Authenticate your identity and secure your account
• Deliver the notifications you have enabled
• Where you have opted in, understand how the App is used in aggregate so we can improve it

Rail Information and Third-Party Services

To show you times, platforms, and delays, the App retrieves live and timetabled rail information through our own server (our "gateway"), which in turn queries the United Kingdom rail industry's data feeds (National Rail Enquiries' Darwin service, obtained via the Rail Data Marketplace). We send only the station codes and times needed to look up services — your identity is never shared with the rail data providers.

We do not sell, rent, or trade your personal information, and we do not share it with data brokers or advertising platforms. We rely on the following service providers to operate the App:

• Firebase (Google Cloud): authentication, database, notification delivery, and — only when you opt in — analytics and diagnostics. Google's privacy policy is available at policies.google.com/privacy.
• UK rail data providers: National Rail Enquiries, via the Rail Data Marketplace, supply the live and timetabled service information the App displays.

Data Storage and Security

Your account data is stored using Google Firebase infrastructure. We take reasonable measures to protect it:

• All data is transmitted over HTTPS
• Database access rules restrict your data to your own account
• Requests to our gateway are checked with app attestation (Firebase App Check) to guard against abuse
• Authentication tokens are held in encrypted device storage and cleared when you sign out

Your Rights

Under the UK GDPR (and equivalent laws such as the EU GDPR and California's CCPA) you have the right to:

• Access: request a copy of the personal data we hold about you
• Correction: request that inaccurate data be corrected
• Deletion: request deletion of your data and account
• Portability: request your data in a portable format
• Withdraw consent: turn off analytics at any time in settings, or delete your account to withdraw consent to all processing

You can delete your account directly in the App. To exercise any other right, contact us at the address below.

Data Retention

We keep your account data for as long as your account is active. When you delete your account, your entire data record — profile, saved journeys, commutes, and device tokens — is erased from our servers. Anonymous accounts that have been inactive for 30 days are erased automatically.

Children's Privacy

Calling Points is not directed at children under the age of 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

International Data Transfers

Our services are hosted on Google Cloud infrastructure in the United Kingdom and European Union. Google may process data in other regions as part of operating its platform. Where data is transferred outside your country of residence, it remains protected by appropriate safeguards and by the measures described in this policy.

Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate any change by updating the "Last updated" date above, and we encourage you to review it periodically.

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

Email: support@tfhalibut.com