Privacy Policy

StationLog ("we", "us", "our") is a personal railway station tracker available at stationlog.co.uk. If you have any questions about this policy, contact us at info@rossmackenzie.co.uk.

When you create an account and use StationLog, we collect:

• Account information — your name and email address, provided via Clerk (our sign-in provider).
• Visit data — the stations you log, dates, ratings, notes, journey purpose, and operator.
• Photos and videos — media you choose to attach to your visits, stored on Cloudflare R2.
• Usage data — anonymised analytics (pages visited, general usage patterns) collected via Vercel Analytics. This is cookieless and does not identify you personally.

If you make a contribution, we also collect:

• Contribution details — your first and last name, email address, the amount, and any comment you leave.

Your card details are entered directly on Square's secure checkout. They never pass through StationLog, and we never see or store them.

We process your data to provide the StationLog service — specifically to let you log station visits, track your progress, and view your history. The lawful basis under UK GDPR is contract (providing the service you signed up for).

Anonymised analytics are processed under our legitimate interest in understanding how the app is used so we can improve it.

If you make a contribution, we use your details to take the payment, send your receipt (Square sends it to the email address you give), thank you, and keep a record of contributions received. The lawful bases are contract (processing the payment you asked us to take) and legal obligation (keeping financial records). We won't use your email address for marketing or add you to any mailing list.

We do not sell or share your personal data with third parties for marketing. Your data passes through the following processors solely to operate the service:

• Clerk (clerk.com) — authentication and account management.
• Cloudflare (cloudflare.com) — database (D1) and media storage (R2).
• Vercel (vercel.com) — hosting and cookieless analytics.
• Square (squareup.com) — payment processing for contributions. Square receives your name, email address and payment details, and handles your card details under its own privacy notice.

All processors are contractually bound to handle your data securely and only for the purposes we specify.

We keep your data for as long as your account is active. If you delete your account, your visit history and media are deleted within 30 days. Anonymised analytics data has no personal identifiers and is retained indefinitely.

Contribution records (name, email address, amount, comment and date) are kept for six years, as financial records, even if you delete your account. After that they are deleted.

Under UK GDPR you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Portability — request your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email info@rossmackenzie.co.uk.

We use strictly necessary cookies for sign-in (set by Clerk). Our analytics (Vercel Analytics) are cookieless. We do not use advertising or tracking cookies.

We may update this policy from time to time. The date at the top of this page will always reflect the latest version. Continued use of StationLog after changes means you accept the updated policy.