Privacy

Who we are

RailFocus is a UK aptitude practice service for train driver and rail signaller selection. This page covers the website at RailFocus, not the separate iOS or Android apps, which store practice data on your device only.

What we store

• Account email and an optional display name.
• Career track, optional assessment date, and whether you have finished onboarding.
• Practice sessions: module, track, score out of 100, and metrics needed to show results. We do not store card numbers. Payments are handled by Stripe, who keep the records they need to take payment.
• Anonymised counts of those scores by test, with no user ids, so we can say how a score compares with other people practising here. That is RailFocus practice, not an operator pass mark.
• Battery exam runs you start, and Plus access dates if you buy Plus. About a week before Plus ends, we email the address on the account so you can buy another term if you still need it. That email includes a link to stop these emails. That purchase is one payment. It does not renew automatically, so there are no accidental payments.
• A short bot-check token from Cloudflare Turnstile when you sign in, create an account, or send the contact form. We send that token to Cloudflare to confirm the request is from a person. We do not use it for ads.
• If you attach screenshots on Feedback, those images are emailed to us with your message. We do not keep a separate gallery of them.

Why we store it

To run your account, show your history, enforce free-run limits, and provide Plus if you pay. If you send the contact form or Feedback, we email your name, email address, message, and any screenshots you attach to our inbox so we can reply. We do not sell your data. Practice scores are for your own training. They are not official assessment results.

Google and Apple sign in

You can create an account or sign in with Google or Apple instead of an email and password. If you choose Google, Google sends us the email address on that Google account, and your name if you have shared it with Google. We use that only to create or open your RailFocus account and keep you signed in. We do not receive your Google password. We do not read your Gmail, Drive, photos, or other Google services. We do not use Google account data for ads, and we do not sell it.

If you choose Apple, Apple sends us an email address for the account (which may be a hidden relay address) and, if you allow it, your name. We use that the same way: to create or open your RailFocus account. We do not receive your Apple password.

How long we keep it

We keep account and session data while your account exists. Payment references stay as long as Stripe and tax rules require. You can delete your account from Settings.

Your rights

You can delete your account from Settings, or request a copy of your data from the contact page. You can stop Plus reminder emails from the link in that email. Deleting your account removes your profile, practice history, and access records from RailFocus. Stripe may retain payment records they are required to keep.

GDPR

UK GDPR and the Data Protection Act 2018 apply to this website. RailFocus is the controller for personal data we collect when you use the site.

We use that data because we need it to run the service you asked for: your account, practice history, and Plus if you buy it. We also have a legitimate interest in stopping bots and seeing which public pages are used, without identifying you. Payment records stay where tax and card rules require it.

Other companies process some of this data for us:

• Supabase hosts accounts and practice records.
• Stripe takes payment.
• Cloudflare runs the bot check.
• Resend sends email from us, such as Plus ending soon.
• Plausible counts visits to public pages. It does not identify you.
• Google or Apple, only if you choose to sign in with them. They send us the email (and name, if provided) so we can create or open your RailFocus account. See Google and Apple sign in above.

Some of those companies are outside the UK. Where that happens, we use their contracts and the transfer tools the UK allows.

You can ask for a copy of your data, ask us to correct it, delete your account, restrict how we use it, or object to processing that is not needed to run the service. Delete is in Settings. For a copy of your data, or anything else, use the contact page.

If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.

Site analytics

We use Plausible and Vercel Web Analytics to see how many people visit public pages, and which pages they open. They do not use cookies, do not identify you, and are not used for ads.

We also load a Google Ads tag so we can tell if a Google ad led someone here, and whether they later signed up or bought Plus. Google may set advertising cookies for that measurement. See Google's privacy policy.

Cookies

We use a session cookie so you stay signed in. Cloudflare Turnstile may set a cookie on their challenge. Google Ads may set advertising cookies to measure conversions. Plausible and Vercel Web Analytics do not set a cookie.