Privacy policy

Who we are

Platted is made by Weftworks Limited, a company registered in England and Wales, number 17439248. Weftworks Limited is the controller of your personal data under UK data protection law, registered with the Information Commissioner’s Office under registration ZC241086. You can reach us at [email protected].

We have no data protection officer, because the law does not require one for a business of our size and kind. The director is responsible for this policy.

What we collect and why

Your account

You sign in with Apple or Google. Apple gives us an identifier for your account and an email address. If you chose to hide your email, the address is a private relay address that Apple forwards to you. Google gives us an identifier and your Google email address. We do not ask Apple or Google for your name. There is no password. We use these to identify your account and keep your journeys yours.

An Apple sign in and a Google sign in are separate Platted accounts, each with its own journeys.

Your journeys

For each journey we keep the stations, the dates, the train times and the train we matched it to. If your booking shows them, we also keep the booking reference, the retailer and your seat reservation. We keep the platform and timing updates for those trains. We use all of this to show your board and send your alerts.

Once a journey is over, we keep a record of it in Previous journeys for 13 months: the stations, the booked and actual times, how late it was and why, the operator, your ticket type and booking reference, and whether the train qualified for delay compensation. You can add whether you have claimed. We keep it so you can claim, and see how your journeys have run. You can remove any journey from Previous journeys at any time, and it goes for good. If you follow a claim link, you leave Platted for the operator's own website; we send them nothing.

We also keep which stations you have travelled through and the date you first did, for your scratch map. That list holds station codes and dates and nothing else, and it stays until you delete your account, so your map lasts longer than your journey records. Deleting your account removes it with everything else.

Planning a journey

When you ask Where to?, the two stations, or a station and a London postcode you type, and the time go to us to plan the journey. We do not keep the postcode, and our logs record only that a postcode was asked for. A postcode is passed to Transport for London's journey planner to plan the last mile across London, with the time and nothing else: no account detail and no location. The last destination you asked for is remembered on your phone only.

Booking emails and ticket photos

When you forward a booking email or photograph a ticket, we store it with Amazon Web Services in London and read it automatically to find the journey.

• Text in photos and attachments is recognised by Amazon Textract.
• A language model, Anthropic's Claude, running inside Amazon Bedrock in the EU, reads the text to pick out the journey details.
• Your emails and photos are not used to train any model.
• Raw emails and photos are deleted automatically after 30 days. We keep only the journey details taken from them.

Your location, and photos of platform boards

If you allow it, Platted reads your location once, on your phone, when you scan a platform board or ask for the next train from where you are. It uses it only to find the nearest stations, from a list kept on the phone. Your location is not sent to us for that, only the codes of the nearest stations. One feature is different: when you ask Find the train I'm on, your position, and your direction and speed if your phone knows them, are sent to us once so we can say which trains are around you. We answer and let them go: they are not stored, not logged and not linked to your account.

If you turn on Specials near me, the stations you pick as yours are kept against your account as station codes, so we can tell you about charter and steam trains passing near them. Picking them from your location happens on the phone the same way. We never keep a position.

A photo of a platform board is sent to us with those station codes, read by Claude inside Amazon Bedrock in the EU to find the trains on it, and dropped at once. It is not stored and not used to train any model.

How you use the app

The app sends us counts of what is used: that a journey was added and how (email, photo, board, departures or by hand), that a trial or subscription started, that a Delay Repay nudge was shown, and which screens are opened. Each count carries a random identifier for the app installation, the app version and your device type. It does not carry your journeys, stations, booking references or email address. We use it to see which features matter and where the app is failing people. It is processed for us by Google (Firebase Analytics) under our instructions.

You can turn this off in Settings under Usage data. The app then sends nothing of the kind.

Notifications and the Lock Screen

We keep your device's push token and Live Activity tokens. We use them only to send you platform, delay and cancellation alerts and to update your train on the Lock Screen.

Emails from us

We use the email address from your sign in to send a few account emails: a welcome with your forwarding address, confirmation that your free week has started, a reminder two days before it ends, one tip if you have not added a journey yet, a note when a subscription ends, and confirmation that your account was deleted. We send no newsletters or offers, and we never share or sell your address.

Every email except the two confirmations has a Stop these emails link, and one click is enough. We do not track whether you open our emails or which links you follow.

We may also write to you ourselves about your account, for example to answer a question you sent us, in the same branded email from the same address.

When you contact support

To answer you, we look at your account: your email address, how you signed in, when you joined, your plan and when it renews or ends, the account emails we have sent you, and counts of how you use Platted, such as how many journeys and delay claims you have and how many phones receive alerts. We do not look at where you travel. We see this on our own operations dashboard, which fetches it from our servers when we open your account and keeps none of it.

If we give you free access, end it, or stop or restart our emails to you, we keep a note with your account of what we changed, when, who did it and why. The note is deleted with your account.

Subscriptions

Apple handles subscriptions and payment on iPhone, and Google on Android. We receive your subscription status and when it expires. We never see your card details.

Train history

Platted keeps its own record of how trains run: which platforms they used and when they ran. It is about trains, not people, and contains no personal data.

What we do not do

• We do not show advertising.
• We do not track you across other apps or websites.
• We do not sell your data.
• We do not put advertising SDKs in the app. Its one analytics SDK, Firebase Analytics, counts usage as described above. It never reads your phone's advertising identifier, it is never used for adverts, and you can turn it off in Settings.

Why we are allowed to use it

We use your data to provide the service you asked for: tracking the trains you add and telling you about them. Under UK GDPR, that is processing necessary for our contract with you.

Our lawful basis

• Performing our contract with you: your account, your journeys, the emails and photos you send us, notifications, and your subscription.
• Our legitimate interests: keeping Platted secure and working, service logs, and usage counts from the app, which we have weighed against your privacy and limited to what is listed above. You can object at any time, and turn usage counts off in Settings.
• Your consent: analytics and advertising cookies on this website, and, if you allow it, your location on your phone and, for Find the train I'm on, the one position sent to answer it. You can withdraw consent at any time: cookies from the Cookie settings link at the foot of every page, location in your phone's settings.
• A legal obligation: keeping payment and tax records that Apple, Google and HMRC require.

Where your data is and who handles it

Your data is stored with Amazon Web Services in the London region (eu-west-2). When an email or photo is read, its text is processed by Amazon Bedrock in the EU, as described above. The UK recognises the EU as giving personal data adequate protection.

We use six processors:

• Amazon Web Services, which hosts and stores Platted and runs the text recognition and language model described above.
• Apple, for Sign in with Apple, notifications and subscriptions on iPhone and Apple Watch.
• Cloudflare, which serves this website and runs our own operations dashboard. The dashboard receives counts of accounts and subscriptions, and a line for each sign up or change to a subscription: the plan, the store, whether it was a test purchase, and a one-way code so the same change is not counted twice. It stores no name, email address or journey. When we answer a support request, the same dashboard also shows us your account, as described under When you contact support, without keeping it. Cloudflare, Inc. is based in the United States.
• Google, for Sign in with Google on any device; on Android for notifications through Firebase Cloud Messaging and subscriptions through Google Play; in the app for usage counts through Firebase Analytics, as described above; and on this website, only with your consent, for Google Analytics and Google Ads. To deliver notifications, Google holds a token for your phone and counts which were delivered. Google Ireland Limited is our contracting entity. For the website analytics Google also uses some data for its own purposes, described in its privacy policy, which is why we ask before setting its cookies.
• Maileroo, which delivers our account emails. It receives your email address and the email itself, from servers in Germany, the Netherlands, France and Finland. Maileroo Group Pty Ltd is based in Australia, so its access to that data is covered by the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Transport for London, whose journey planner receives a London postcode you type into Where to?, with the time, to plan the last mile. It receives no account detail and no location. Transport for London is in the UK.

Platted gets live train times and platforms from the rail industry's live data services. They receive no personal data, only the stations and trains we ask about.

Transfers outside the UK

Your journeys, emails and photos stay in the UK and the EU as described above. Three things can leave: Maileroo's email delivery (covered by the UK International Data Transfer Addendum, above), Google's analytics and advertising services, and Cloudflare's website and operations dashboard. Google and Cloudflare may process data in the United States. Those transfers rely on the UK Extension to the EU-US Data Privacy Framework, to which Google LLC and Cloudflare, Inc. are certified, with each company's standard contractual clauses as a fallback. You can ask us for a copy of the safeguards at [email protected].

How long we keep it

• Raw booking emails and ticket photos: deleted automatically after 30 days.
• Previous journeys: removed automatically 13 months after the journey, or sooner if you remove them.
• The stations you have travelled through and the date you first did, for your scratch map: kept until you delete your account.
• Everything else tied to your account: removed when you delete your account.
• Backups that may still hold it: overwritten within 35 days.
• Service logs, which may include your account identifier but not your journeys: deleted after 30 days.
• Background tasks that failed, which may include your account identifier: deleted after 14 days.
• Usage counts from the app, held by Google Analytics for us: 14 months.
• The lines our operations dashboard keeps for each sign up or change to a subscription, which name no one: 400 days.
• Website analytics and advertising data, held by Google for us: 14 months for analytics; advertising conversion data as Google's retention allows, and the cookies themselves as listed in the cookie policy.

Deleting your account

In the app, go to Settings and tap Delete account. This removes your account and everything tied to it straight away, including your journeys, emails and photos. Backups that may still hold it are overwritten within 35 days. It cannot be undone. You can also email [email protected] and we will delete it for you.

When you delete your account, Apple asks you to confirm. That lets us end Platted's use of your Apple ID. You can check in iPhone Settings: tap your name, then Sign-In & Security, then Sign in with Apple.

Deleting your account does not cancel a subscription. On iPhone, cancel it in iPhone Settings, under your Apple ID, Subscriptions. On Android, cancel it in Google Play, under Payments and subscriptions.

Your rights

Under UK GDPR you have the right to:

• see the personal data we hold about you
• have it corrected
• have it deleted
• have its use restricted
• receive it in a portable form
• object to how we use it
• withdraw consent where we rely on it, without affecting what was done before

To use any of these rights, email [email protected]. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Children

Platted is not directed at children under 13.

This website

When you first visit, the site stores nothing on your device but your answer to the cookie banner. Google's tag loads in consent mode, which means it sends Google only cookieless signals that a page was viewed, and sets nothing, until you choose. If you accept Analytics, we use Google Analytics 4 through Google Tag Manager to count visits, see which pages are read and where visitors came from. If you accept Advertising, we use Google Ads tags to tell whether a Google advert led to a visit or a download, and, if you allow it, to show Platted adverts to people who have visited. The cookies, what each is for and how long each lasts are listed in the cookie policy, and you can change your mind at any time from the Cookie settings link at the foot of every page.

Fonts are served from this site. Nothing on this site talks to any company other than Google, and Google stores nothing on your device without your consent.

Changes to this policy

If we change this policy, we will update this page and the date at the top.

Contact

Weftworks Limited, [email protected].

Registered in England and Wales, company number 17439248. Registered office: 2 Ravenscroft Gardens, Trowbridge, Wiltshire, BA14 7JU. ICO registration ZC241086.