The Local Train
The Local Train
What this site keeps about you, which is not much, and why. Last changed 14 November 2026.
The site is run under the name The Local Train by its owner, an individual rather than a registered company, who also runs The Local Bus and is responsible for what is described here. If anything is unclear or wrong, the contact page reaches them directly.
One cookie, tlt_session, is set when you sign in. It holds a random session code and nothing else. It cannot be read by scripts, it is only sent over HTTPS and only to this site, and it lasts 90 days or until you sign out. No cookie is set for visitors who do not sign in.
A few things are kept in your browser's own storage, on your device. All but one are never sent anywhere:
Because none of this is used to track you across sites, and the cookie is strictly needed for the thing you asked for, UK law does not require consent for it. The notice you see the first time is there so you know, not to ask.
The site counts how many people read each kind of page each hour, and for how long, so its owner knows what is used. It records the shape of the page, such as /station/:crs, never the particular station or train you looked at. Your browser makes up a random code for the tab, so the count can tell twenty readers from one reader twenty times; the code is never connected to an account and is gone when the tab closes. Hourly counts are kept for 90 days and the tab codes for 60 days.
To tell new readers from returning ones, your browser keeps the date of your last visit on your device. Once a day it sends that date with the first page you read, and the site adds one to a count for "today, last here this many days ago" (or "first visit"). That count is all that is kept, so the site cannot join one of your visits to another. These counts are kept for 90 days.
The counts also say how readers found the site. With the first page a tab opens, your browser sends the name of the website that linked to it, such as www.google.com. The address of the page you came from is not sent, and nor is anything you searched for there. If the link was tagged with a source, such as utm_source=facebook, that tag is sent instead. The site adds one to a daily count for that source. These counts are kept for 90 days.
While a tab is open, it tells the site which kind of page it is on once a minute, so the admin panel can show how many people are reading right now. That is forgotten 30 minutes after the tab closes.
You can stop all of this for your browser. Tick the box below and this browser sends nothing to the reading or search counts from then on. If your browser sends a Global Privacy Control signal, that does the same thing without the box.
The home page can show the stations closest to you, but only if you switch it on and your browser asks you and you allow it. Your browser then sends your position, rounded to about a hundred metres, to the site, which answers with the nearest stations. The site does not store the position or link it to you or your account; like any address requested, it can appear in the web server log described below for up to 7 days. You can switch it off on the home page, or withdraw location permission in your browser at any time.
When you search for a station, the site counts what was searched for once you stop typing, so its owner can see what people look for and, most of all, what they look for and do not find. It records the words and whether anything was found. It does not record who searched, or link one search to another. A full postcode is counted as the word "postcode" and never kept as itself. Search counts are kept for 90 days.
An account is an email address. To sign in you are sent a link, which works once and expires after fifteen minutes; you can also set a password, which is stored as a salted hash and never in a form we can read. Sign-in links are sent from the mail server run for this site and The Local Bus, so no other company sees your address to deliver them. Each link request and each password attempt is recorded with the network address it came from, so that guessing can be slowed down. Password attempts are deleted after a day, and the record of a sign-in link a day after it expires.
Each signed-in browser is a session with the browser's description and the time it was last used. Sessions end after 90 days, or when you sign out.
You can save trains and journeys to your account. They are visible on your account page and removed when you remove them or delete your account.
An account that has not been used for two years is deleted automatically, with everything saved in it. Using the site while signed in counts as using it.
An administrator can mark an account to be asked for feedback. That mark is stored with the account until the pop-up has been shown to it, the request is cancelled, or 90 days have passed, and is removed with the account.
Messages through the contact page are kept with the name and email address you give, the page you sent them from and the network address they came from, so that abuse can be dealt with. A copy is emailed to the site's owner from the site's own mail server. They are read by the site's staff and deleted a year after they have been dealt with, or a year after they arrived if they never were.
Feedback sent through the pop-up that asks for it is kept with the page you sent it from and the network address it came from, so that abuse can be dealt with. A name and email address are kept only if you choose to give them. Feedback is deleted a year after it has been read, or a year after it arrived if it never was.
The web server keeps a log of requests: the time, the address requested, the response and its size, and the network address it came from. Log files are kept for at most a week, and are used to find faults and abuse. When something goes wrong inside the site, the page address is logged with the error, without anything typed into it and without anything about who asked. Those error logs are overwritten as they fill up.
The site's data is stored with a hosting provider in the European Union, which the UK recognises as providing adequate data protection. Train times, timetables, positions and disruption notices come from rail industry data feeds, credited on the contact page; they contain nothing about you.
Changes made in the admin panel, and changes to accounts, are written to a log: what was done, when, and by which account number. Deleting your account, downloading your data and setting or removing a password are logged the same way. The log keeps account numbers, never email addresses or network addresses. It is kept for two years.
Requests about your data and complaints are kept in a register with the dates they were received, acknowledged and answered, so they are answered on time and that can be shown. Each entry is kept for two years after it is closed.
UK data protection law asks for a reason, called a lawful basis, for each use of personal information.
| Your account, saved trains and journeys, and sessions | To provide the account and features you asked for (contract) |
|---|---|
| Sign-in attempts, sign-in link records and server logs | Keeping the site and accounts secure (legitimate interests) |
| Contact messages | Answering you and dealing with abuse (legitimate interests) |
| Feedback | Improving the site and dealing with abuse (legitimate interests) |
| Reading, search and source counts | Knowing what is used so the site can be improved, with a way to opt out (legitimate interests) |
| Audit log and request register | Being able to show that data is handled lawfully (legal obligation) |
Nothing is sold or shared for marketing. The people who run the site can see accounts and messages in order to run it. Email is sent from the mail server run for this site and The Local Bus. No one else receives anything about you.
| Reading counts, by page shape and hour | 90 days |
|---|---|
| Reading counter tab codes, by day | 60 days |
| New and returning reader counts | 90 days |
| Where readers came from, by day | 90 days |
| Search counts, by words and day | 90 days |
| Tabs open right now | 30 minutes |
| Web server logs | up to 7 days |
| Sign-in sessions | 90 days, or until you sign out |
| Sign-in link records | 1 day after they expire |
| Password attempts | 1 day |
| Account and saved trains and journeys | until you delete them, or 2 years after the account was last used |
| Requests to ask your account for feedback | until shown, or 90 days |
| Contact messages | 1 year after they are dealt with, or after they arrive if never dealt with |
| Feedback | 1 year after it is read, or after it arrives if never read |
| Audit log | 2 years |
| Requests and complaints register | 2 years after the request is closed |
| Backups of all of the above | 7 days |
If this page changes in a way that matters, the date at the top changes with it and the notice shows again.