Privacy policy

Publisher and data controller

Tommaso De Rosa

Viale Certosa 152, 20151 Milano (MI), Italy

Connection data

No account is required. Our server and Cloudflare process connection data: IP addresses, the requested address (which can contain, for example, the coordinates of a nearby-station search) and browser information, to deliver and secure the service. Technical data can identify a visitor; we do not describe it as anonymous. The retention period of server and Cloudflare logs has not been defined yet.

Email enquiries and rights requests

If you email us, we process the sender's email address, message content, any attachments and correspondence details to answer your enquiry or handle a request about your rights. Ordinary enquiries rely on the controller's legitimate interest (GDPR Article 6(1)(f)); handling GDPR rights requests relies on a legal obligation (Article 6(1)(c)). The retention period of correspondence has not been defined yet.

Visits from AI platforms

For our own statistics, we record visits by recognised bots and arrivals from AI platforms such as ChatGPT. Records contain the recognised source, page path, browser user agent, visit time and visit type. They contain no IP address but may contain personal data; we do not describe them as anonymous. The legal basis is the controller's legitimate interest in measuring traffic sources and service operation (GDPR Article 6(1)(f)). The retention period of these records has not been defined yet.

Map and location

The map loads its basemap from CARTO (basemaps.cartocdn.com), which receives your IP address and request data. On the home page the CARTO basemap loads only when the map preview comes close to the screen, or at your first scroll, touch or click on the map preview (until then you see a still image from our server); on /en/map, and when a map opens on a specific train, it loads straight away. Our server proxies OpenRailwayMap tiles. Location is optional: your browser asks for permission and can reuse it for up to one hour. The position stays in browser local storage until overwritten or cleared, including after that hour has elapsed. Coordinates reach our API when you search for nearby stations.

Error reports

Our collector at errors.tomdapp.uk receives error details, page paths without query strings or fragments, and technical browser data. This is not session recording. Error reports may contain personal data, including data in error details; we do not describe them as anonymous. The retention period of error reports has not been defined yet.

Cookies

The site has no analytics or advertising cookies and no active Google Analytics or AdSense tags, so it shows no consent tool. It uses three technical cookies. “theme” remembers the colour theme (light, dark or system); it is written on every visit and expires one year after the last one. “NEXT_LOCALE” remembers the language when the page is in a different language from your browser's or when you switch language; it ends when you close the browser. “admin_session” exists only after the administrator signs in and expires after 24 hours. Before enabling analytics or advertising we will update this notice.

Browser storage

In your browser's local storage we keep: favourites, recent searches and settings (“mapapociagow-preferences”); the theme you pick, if you change it (“theme”); your last position, if you allow it (“mapapociagow-geolocation”); the number of days with a visit and the date of the last one (“tn_visite”), with no identifier and never sent to the server. That counter only times the offer of notifications, which are switched off for now. These entries have no expiry: they stay until you delete them in your browser. Session storage can keep, until the tab is closed, a marker for a single page reload after a site update. The service worker keeps site files, up to 500 map tiles and up to 50 recent answers from our API (nearby-station searches included) in the browser cache, so the site works on a weak connection; the oldest tiles and answers go when a limit is reached, and everything goes when we change the version of this cache or when you clear the site's data in your browser. The site sends no notifications for now and creates no push subscriptions.

Legal bases and recipients

Essential operation and security rely on the controller's legitimate interest (GDPR Article 6(1)(f)). Optional location works at your request and with consent (Article 6(1)(a)). Recipients include infrastructure providers, Cloudflare, CARTO and email infrastructure providers. We do not sell visitors' data. Cloudflare and CARTO also operate outside the EEA, including the USA. Transfer safeguards depend on the service and its terms, including standard contractual clauses or EU–US Data Privacy Framework participation where applicable.

Retention

Cookies and browser storage: the periods given above. Server and Cloudflare logs, records of bot visits and AI-platform arrivals, error reports and email correspondence: the retention period has not been defined yet. We do not make decisions with legal effects solely by automated processing.

Your rights

Subject to GDPR conditions, you can request access, rectification, erasure, restriction and portability, and object to processing. You can withdraw consent without affecting earlier lawful processing. Contact the controller below. We normally respond within one month; GDPR permits an extension with an explanation. You can complain to Italy's Garante per la protezione dei dati personali or Poland's UODO, including an authority where you live.