Privacy

The short version

• We do not use analytics, advertising, or tracking of any kind.
• You can read every public page without an account and without being counted.
• We never sell or rent anything about you, and there is nothing to sell.
• If you want your data gone, email hello@levantrain.net and we will delete it.

Just visiting

You do not need an account to browse Levantrain, and we do not run analytics. We have no idea how many of you there are, which is occasionally frustrating and entirely deliberate.

Our host, Cloudflare, processes the ordinary details of a web request — your IP address, your browser’s user-agent, the page you asked for — in order to serve the page and to block abuse. Cloudflare also sets one cookie, __cf_bm, which distinguishes people from bots. It expires within half an hour and is not used to profile you.

Maps are the one place your address reaches someone else. The interactive maps draw their background tiles from OpenStreetMap, and optionally from Esri, OpenTopoMap, or CARTO if you switch backgrounds. Loading a tile means your browser contacts that provider directly, and they see your IP address. There is no way to draw a slippy map without this; we have simply named them below rather than pretending otherwise.

If you make an account

Accounts exist so that, over time, people can contribute to the map and the research. Signing up is open, and a new account starts with no editing privileges until we grant them.

• Your email address — to identify your account, sign you in, and send you the handful of messages the site needs to send (confirming your address, resetting a password). It is not a mailing list, and we do not have one.
• Your password — stored only as a salted hash by Supabase Auth. We cannot read it, and neither can anyone else.
• Your profile — a display name, full name, short bio, website, and avatar, all optional and all supplied by you. Profiles are visible to signed-in members, not to the open web. As community features grow we intend to give you explicit controls over what is shared; until those exist, the conservative setting is the only setting.
• What you contribute — notes, edits, or posts you make are stored with your account so we can attribute them and undo mistakes.

A signed-in session uses a cookie to keep you signed in. That is the only cookie we set ourselves.

Who else handles it

These are the services that process data on our behalf. Everything else in our toolchain — the editors and AI tools we build with, listed on Specs — never touches visitor or member data.

• Supabase
  Database, authentication, and file storage
  Your account email, password (hashed — we never see it), profile fields, and any content you create.
• Cloudflare
  Hosting and content delivery — every page is served through it
  Your IP address, browser user-agent, and the URL requested, as part of serving and protecting the site.
• OpenStreetMap Foundation
  Default map tiles
  Your IP address, when a map loads tiles from their servers.
• Esri / ArcGIS, OpenTopoMap, CARTO
  Alternative map backgrounds you can switch to
  Your IP address, but only if you select one of those backgrounds.

Your rights

Whatever your jurisdiction, we will do all of the following for anyone who asks, at no cost:

• See it — we will tell you exactly what we hold about you.
• Get a copy — we will send it to you as a machine-readable file.
• Correct it — you can edit your own profile, or ask us.
• Delete it — we will delete your account and the personal data attached to it.

Right now these are handled by a person, not a button: email hello@levantrain.net and we will respond within 30 days, usually much sooner. Self-service export and deletion are on the roadmap; we would rather say that plainly than ship a page describing a button that does not exist yet.

One limit worth stating: contributions that have become part of the public rail dataset — a station location, a correction, a cited source — stay in the dataset after an account is deleted, because other people’s work now builds on them. They are detached from your account and your personal details are removed.

How long we keep things

Account and profile data is kept for as long as your account exists, and removed when you ask us to delete it. Records of emails we sent you — the fact of sending, so we can debug delivery — are kept for up to 12 months. Anything else that stops being useful gets deleted.

Children

Levantrain is not aimed at children, and we do not knowingly collect anything from anyone under 16. If you believe a child has created an account, email us and we will remove it.

Changes, and how to reach us

If this notice changes in a way that matters, we will update the date at the top and note it in the build log, which is a public record of how the project has changed.

Questions, requests, or a correction to this page: hello@levantrain.net. A real person reads it.