Privacy Policy

Last updated 14 October 2026.

In short: Card details, ticket numbers and TfL statements stay on your device, as do ticket photos unless you choose to send us one. Forwarded booking emails are deleted once read; their e-tickets are kept encrypted. Profiles, bank details, TfL email and tickets sync encrypted. We never see your TfL password. No adverts or data sales. Delete your data anytime.

Who we are

Railhop (railhop.app and the Railhop app) is run by KMR Digital Ltd, a company registered in England and Wales (company no. 17516682), trading as Railhop (registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ). That company is the "controller" of your personal data under the UK GDPR and the Data Protection Act 2018. Contact: hello@railhop.app.

What we keep on our server

Only if you create an account, unless noted.

Your email address: a one-way hash to find your account, and an encrypted copy to send you sign-in codes and the emails below. With Sign in with Apple and "Hide My Email", this is Apple's relay address.
Sign-in methods: for Google or Apple, the account ID they give us and the email they share. For Apple, an encrypted token so we can disconnect Railhop from your Apple ID when you delete your account. No passwords.
Passkeys: if you add a passkey to sign in with Face ID or your fingerprint, your phone or computer makes a pair of keys. We keep only the public half, which can check a sign-in but can't make one, with the passkey's name (such as "Safari on iPhone", which you can change), when it was added and last used, and whether it syncs to your other devices. Your face, fingerprint or device PIN never leave your device: it checks them itself and only tells us it was you. We never receive or store biometric data. Remove a passkey in your account at any time; deleting your account deletes them all.
Signed-in devices: a label such as "Safari on iPhone", when it signed in and was last used. Phones hold a random token we keep only as a hash.
Your age confirmation: that you confirmed you're 16 or over, and when.
Your journeys: journeys you save (from a train page, your TfL statement or a ticket added in the app) and, if "Keep my journeys in my account" is on in the app, a summary of each journey the app detects. A journey holds the date, stations, times, the train and its delay, the other trains you could pick, and your answer to "Was this your train?". One saved from a TfL statement also holds the touch-in time, contactless or Oyster, and the fare. One saved from a ticket also holds its type, paper or e-ticket, the price and the railcard name. Never your location, a ticket number, a photo or card details.
Journeys you import from a booking link (for example split tickets booked in TrainPal): each train of the booking, the stations, the times and the booking's total price, kept as one journey, and which kinds of ticket you added to it (a screenshot, a Wallet pass or the booking email) and on which device. To read the link we ask the booking app's own short link where it leads, once; nothing about you is sent with it. The tickets themselves stay on your phone or in your browser, where they're put into one image for the claim.
Your tickets' details: for each ticket you add on the website or in the app while signed in, its type (Single, Return, Advance, Season Ticket, Flexi Season or Travelcard), stations or zones, dates, an Advance's train time, the price, the railcard name, paper or e-ticket, Anytime or Off-Peak, and whether you chose to keep it. We keep them so the ticket shows on each of your devices: a ticket added on your computer shows in the app and is used for your claims there, and the other way round. Never the ticket number, serial number, photocard number, the photo or the e-ticket file: those stay on the device you added the ticket on (a ticket from a booking email you forward is the exception: see Booking emails you forward). When you remove a ticket, its details go; we keep only its random ID and when it was removed, so your other devices remove it too. Where on a ticket's photo Railhop read each detail (the boxes it shows you) is kept with the photo, on that device only.
Your Railcards: for each Railcard you save on Tickets & Passes, its name (such as "16-25 Railcard"), its expiry and issue dates when you add them, and which Autofill Profile it belongs to, so your tickets can offer it. Never its number. A photo of it stays in the browser you added it on. Remove it on Tickets & Passes and it goes.
Your Autofill Profiles: for each profile you save on the website or in the app while signed in, the title, name, email, phone, address, the profile's name (such as "Me" or "Mum"), which one is your Default and, if you add one, the email you sign in to TfL with (the app fills it in on TfL's sign-in; your TfL password is never kept by Railhop, in your account or anywhere else). We keep them in your account, encrypted, only to fill your claim forms on each of your devices, and never share them. Turn on "Keep on this device only" (Autofill Profiles on the website, or in the app) to keep them on your device only: the account's copy is deleted straight away. When you delete a profile, its details go; we keep only its random ID and when it was deleted, so your other devices delete it too. Each profile's bank details are kept as described next.
Bank details for your Autofill Profiles: for each profile you add them to on the website or in the app while signed in, the name on the account, the sort code and the account number. Never a card number, IBAN, PIN or password, and never a PayPal email (that stays on your phone). We keep them in your account, encrypted (each value sealed with a key kept apart from the database, so a copy of the database alone can't read them), only to fill the train company's payment step when you claim, on each of your devices, so you add them once. Everywhere else they're shown masked (the last 4 digits of the account number and the last 2 of the sort code): the whole numbers go only to your own signed-in device, at the moment it fills a claim form's payment step, or to keep a copy locked on your phone. Whenever bank details are added or changed, we email your account's address (never the numbers) with a link to sign out everywhere and remove them, and we allow only a few changes a day. They're never in our logs, analytics or error reports, and Download My Data shows them masked. They're deleted with their profile, when you turn on "Keep on this device only", or when you delete your account. When you remove them, we keep only the profile's random ID and when, so your other devices remove them too.
Claim records: the journey and train, delay, ticket type, claim status, the operator's claim reference, the amounts asked for and received, how you were paid (e.g. "bank transfer", never the account details), the reason for any rejection, and notes. When you copy your claim details on the website while signed in, the notes keep your ticket reference, or for pay as you go the last 4 digits of the card you tapped and your touch-in time.
Forgotten TfL tap-outs: when you check a TfL statement while signed in on the website, each journey it shows with no tap-out that TfL may still refund: the date, your touch-in time, the station you tapped in at, what TfL charged for it, where you probably got off (worked out from your other journeys on the statement), about how much TfL may pay back, which month to ask TfL in, and whether you've asked TfL (when, online or by phone, with TfL's reference if you add one) and what TfL said. When a later statement shows TfL refunded one, your browser spots it and sends only that it was refunded and how much, never the statement. If you have the app, we also note when we sent you a reminder about one, so it only comes once. Nothing about your card. Railhop never asks TfL for you.
Usual trains and commutes: stations, departure time and days. For a usual train you turn alerts on for in the app: how early to alert you, the train company if known, holiday dates, your alert settings (quiet hours, pause, which bank holidays), and your phone's notification address (an Expo push token).
Email and alert logs: which reminder emails and alerts we sent and when, so we never send the same one twice.
Abuse-prevention counters (everyone, signed in or not): counts of sign-ins, ticket reads and lookups, keyed by a one-way hash of your IP address, email address or account, never the address itself.
Server logs (everyone): our host records requests, including IP addresses, to keep the service running and secure. We don't log what you send us when you check a statement or have a ticket read.
Journey detection (optional, early version; only if you turn it on in the app): minimised station and journey events, described in its own data policy in the app. See below.

What stays on your phone or in your browser

These stay on your device (where one also goes to your account, it says so):

Your claim details when you're signed out, or with "Keep on this device only" on (name, address, email, phone, preferred payment method): the app keeps them in your phone's secure storage (the keychain), and the website in your browser's storage on that device, to fill claim forms. Signed in, they're your Autofill Profiles, kept in your account as described above. You can keep details for up to three people. No payment details or ticket photos are kept this way. To delete one, use Delete Profile in Autofill Profiles (on every device), or clear this site's data in your browser. On a shared or public computer, tick "Don't remember on this computer" and nothing is kept there.
Tickets: photos, ticket numbers and e-ticket files you add in the app or on the website (read on your phone or in your browser). They stay on the device you added the ticket on. Only the ticket and journey details listed above are kept in your account. The exceptions are a photo you choose to send us when reading got it wrong (see Photos you choose to send us) and the e-tickets in booking emails you forward to us (see Booking emails you forward).
TfL statements: the PDF or CSV is read on your phone or in your browser. To check your journeys for delays we send only each journey's date, station names, touch-in and touch-out times and fare. We use them to answer and don't keep or log them. No card number, name or address is sent.
Your phone's copy of your bank details (name on the account, sort code, account number, and a PayPal email if you add one): the app also keeps them in your phone's secure storage (the iPhone keychain, or the Android Keystore), protected by Face ID, fingerprint or your phone's strong face unlock, readable only while your phone is unlocked, and never included in backups or moved to another phone, to fill the train company's own payment form when you claim and unlock them. A PayPal email never leaves your phone. Signed out, or with "Keep on this device only" on, the bank details stay only there too. You can remove them at any time in the app (Account → Bank details for payouts): signed in, that removes them from your account and your other devices as well.
Card details and passwords: we never ask for card numbers, and never see your passwords for train company or TfL accounts. See "Claim forms and TfL" below.
Your location, unless you turn on journey detection. Track My Train uses your location only on your device. Your usual trains are worked out on your phone; we only receive one when you turn alerts on for it. With "Add my regular trains automatically" on in the app, regular trains Railhop spots are added to your alerts automatically, and stored on your account like ones you add yourself.
Settings such as the colour theme, map filter and your answer to "How did you pay?".

Claim forms and TfL

Railhop never submits claims for you. In the app, "Fill the form for me" opens the train company's own claim form inside the app and types in your journey, ticket and claim details from your phone. It also attaches your ticket photo if you choose. If you've saved bank details for payouts, it fills the bank transfer (or PayPal) boxes on the payment step, only after you unlock them with Face ID or your fingerprint there. It never reads or fills password or card fields, never reads what you type, and never presses submit. Nothing from the form is sent to us. You check it and submit it yourself, and the train company's privacy policy applies to what you send them.

On the website, Railhop's browser extension (for Chrome, Edge and Firefox) does the same. When you press "Fill in the form for me" on a claim, your journey, ticket and claim details go from the Railhop page in your browser straight to the extension, which opens the train company's form in a new tab, types them in and attaches the ticket photo or TfL statement you chose. It works only on Railhop, the train companies' claim forms and, when you ask it to, TfL's sign-in and contactless websites. It keeps the claim with that tab until you close it or your browser, and remembers in your browser whether you have an account with each train company. It never reads or fills password or card fields, and never presses submit. It fills the bank transfer boxes only with the bank details for the person the claim is for: signed in, the ones kept in your account, which the Railhop page fetches and hands to the extension with that claim; otherwise ones you saved in the extension (see "The Railhop browser extension" below). The only things it sends to Railhop are the claim reference once you've submitted, and a request for which forms it may fill, both explained below.

"Get my statement from TfL" opens TfL's own website in the app. You sign in yourself. On TfL's sign-in page the app only fills in the email from your Autofill Profile and marks the password and code boxes so your phone can offer your saved TfL password and the code TfL texts you. You choose or type them, and you press Sign In: the app never does, never reads your texts and never sees, keeps or fills your TfL password. TfL keeps you signed in in the app (its cookies stay on your phone) for as long as TfL allows.

Once you're signed in, a small script in the app reads TfL's card list (each card's link, its type and last 4 digits, TfL's reference, its expiry and any name you gave it, never your card number) and, on Journey history, takes TfL's own statements for every card you use, using your own TfL sign-in. If you've got your statement in the app before, the app does the same quietly at most once a day when you open it; if TfL wants you to sign in again, it shows a card asking you to, and never opens TfL's page by itself. The statements are read on your phone, as above, and nothing from TfL's pages is sent to us.

The Railhop browser extension

On a computer, the Railhop browser extension (for Chrome, Edge and Firefox) fills in the train company's own claim form from the claim you prepared on railhop.app, on this computer. Your claim details go from the Railhop page straight to the train company's form, never to our server. As in the app, it never reads or fills password or card fields and never presses submit: you check the form and send it yourself. It asks railhop.app which claim forms it may fill and whether TfL statement fetching is switched on, sending nothing about you. If a train company's cookie notice covers the form, it declines optional cookies where the notice allows, and accepts only where that's the only choice, so the form can be reached.

When the train company confirms your claim, the extension passes its claim reference back to your Railhop account through the Railhop page you have open, so it's saved with your claim using your own sign-in. It sends only the reference, Railhop's own number for that claim, the train company, the travel date and the train, never your name, address, ticket or payment details. If no Railhop page is open, it keeps the reference in this browser until one is, for up to 30 days. The extension never holds your Railhop sign-in.

It can also fetch your TfL statement when you ask. When you press "Get My Statement from TfL" on Railhop's statement check, the extension opens TfL's contactless website in a new tab. You sign in there yourself: the extension never sees or keeps your TfL password. In that tab only, it finds your card's link on TfL's card list (never your card number) and, on Journey history, takes TfL's own statement (the PDF, or the journey CSV) for the months the last 28 days need, using your own TfL sign-in. The statement goes to the Railhop page you asked from and is read there, on this computer, like a file you add yourself; it isn't sent to our server and the extension doesn't keep it. While it fetches, it stops TfL's page from saving the statement as a download, and removes any TfL download that starts during the fetch, so nothing is left in your Downloads folder. It does nothing on TfL's website at any other time. An option in the extension's settings, off unless you turn it on, lets it offer to check a TfL statement PDF you download yourself, looking only at that download's web address and file type.

On Check My Contactless, the extension can also guide you through setting up TfL when you ask ("Set It Up for Me" or "Get My Statement"). It opens TfL's sign-up or sign-in in a new tab and, in that tab only, shows a Railhop box saying what to do on each of TfL's pages and pointing at the box to fill in. To know which page you're on it looks at the page's address, title and which of TfL's boxes are there, never at what you type. You type your own email, password, codes and card details: the extension never reads or fills them, never ticks a box for you and never presses TfL's buttons to create your account or add your card. Once your card is on TfL's card list, it gets the Journey history for every card on your account, as above, using TfL's own reference for each card on that list (never the card number), and hands the statements to the Railhop page. It keeps nothing about your cards: those references are forgotten when the set-up ends. While it guides you, it tells the Railhop page only which step you're on (for example "Confirm your email" or "Getting journeys for 2 cards").

If you choose, the extension can also keep your bank details (name on the account, sort code and account number) and a PayPal email on this computer, so it can fill the train company's payment step. They are stored encrypted (AES-GCM), with the key protected by your computer's own sign-in (your face, fingerprint or device PIN) or a PIN you choose (at least 8 characters), and are only unlocked when you say so. They are never sent to Railhop or anyone else, only typed into the train company's own payment fields after you unlock them. You can forget them at any time in the extension's settings (Your Payment Details). If you use your computer's sign-in, the extension makes a passkey called "Railhop payment details" to protect the key. Forgetting your details makes them unreadable, but the passkey stays in your system's passkey list until you remove it there. It never stores card numbers.

Signed in, the bank details kept in your Railhop account for the person a claim is for come to the extension with that claim (from the Railhop page in your browser), so it can fill that claim's payment step without asking you to unlock anything. The extension keeps them only in your browser's memory, with that claim's tab, until the claim ends or you close the tab or your browser, and never sends them anywhere else.

Ticket reading on the website

Your ticket is read on your device first. When you add a ticket on the Tickets & Passes page, or choose a ticket photo or e-ticket in a claim pack, your browser reads the photo or PDF itself and fills in the details, using a reader served by railhop.app (no other website is contacted). On Tickets & Passes the photo never leaves your device, unless you choose to send it to us (below).

If you choose "Use Your Phone's Camera" to send a ticket photo from your phone to your computer, the photo is encrypted on your phone, passes through Railhop's server only in scrambled form that we can't read, and is deleted as soon as your computer collects it or after 10 minutes. If you scan the code with an iPhone that has the Railhop app, the app takes the photo and also keeps a copy on your phone. When you save the ticket on your computer, the app adds that photo to the ticket, so it's on both. A copy that no ticket uses is deleted from your phone after 3 days.

Our AI reader is only a backup, and only if you choose it. If your browser can't read enough from the ticket in a claim pack (no ticket type, price or ticket number), we ask whether to send it to our AI reader. Only if you then press "Send Photo" does the photo go to our server and on to Anthropic, our AI provider, to read the ticket's details. Your browser shrinks it and removes hidden details, such as where it was taken, before sending. We don't keep the photo or log what was read. Anthropic deletes it within 30 days under its standard API terms. You can always type the details instead.

Photos you choose to send us

Reading ticket photos is new (marked Beta), and it sometimes gets a ticket wrong. When it does, you can press "Didn't read it right? Send Us This Photo" on the website or in the app to send us that one photo or PDF, so we can make reading better for every train company and ticket type. Nothing is sent unless you then press Send Photo, and only that file.

What's sent: the photo (made smaller, with hidden details such as where it was taken removed) or the PDF as it is; which details we read and which were missing or you changed (by name, such as "date", never what you typed); the ticket type; the Railhop version; whether you used a phone, tablet or computer; and your short note, if you add one. The photo shows what's printed on the ticket, such as its number. For a Season Ticket or Flexi Season we ask you to cover the photo of your face on the photocard first. If you're signed in, it's linked to your account so you can see and delete it.

We keep it encrypted in a private store only Railhop can open, use it only to improve and test photo reading, and never share it with anyone else. It's deleted automatically 90 days after you send it. Signed in, you can delete it sooner on your account page under Your data (deleting your account deletes it too). Signed out, contact us with roughly when you sent it.

Booking emails you forward

Your account has its own forwarding address (it starts with "t-" and ends @in.railhop.app), shown on Tickets & Passes and in the app. It's unique to your account, so you can forward a booking email to it from any email address, such as a work one. Railhop's server reads the email and its attachments to find your tickets, adds them to your account and emails you (at the email you sign in with) to say what it added. For an Advance ticket, it also adds the booked train to your journeys. Keep the address to yourself: anything sent to it is read as yours.

What we keep: each ticket's details, as for any ticket you add (above), and, encrypted so only Railhop's server can open them, its e-ticket PDF and its numbers (the ticket number or UTN and the seller's order reference), so you can save the e-ticket or attach it to a claim. For an Advance ticket whose train we can't find yet, we keep the booked train's time and stations until we do. We don't keep the email itself, its text, its other attachments (such as a receipt with payment details) or who sent it, and none of it goes in our logs.

An e-ticket and its numbers are deleted when you remove the ticket, 90 days after its claim window ends (28 days after you travel), or when you delete your account. Get a New Address on Tickets & Passes stops your old address straight away. Only forward your own bookings, or ones you're claiming for with the traveller's agreement.

Journey detection (optional, early version)

Journey detection is an optional feature of the app, and an early version. It's off unless you turn it on, and the rest of Railhop works without it. While it's on, the app sends station entry and exit times, boarding times, and during a detected journey at most one position a minute (one every 10 seconds for up to 5 minutes when Railhop can't yet tell two trains apart), rounded to about 10 metres, plus battery level, your answers and, only if you turn them on, diagnostic logs. To measure its accuracy, the app compares detected journeys with your other records of the trip on your phone (TfL statement, tickets, claims) and sends the stations, times and train they name, never your account. It is not linked to your account. You can turn it off and tap "Delete my data" at any time. Its full data policy is shown in the app before you turn it on.

Problem reports from the app

When something goes wrong in the app (an error, or a step that finds nothing), it sends us a short report so we can fix it: what failed and where, the app version, and a random number for the app on your phone. If you tap "Tell us", your note goes with it. It never includes your location, your name, email or address, what you typed into a claim form, your bank details or your tickets' photos, and it isn't linked to your account.

Messages you send us

When you use our contact form, we receive your name, your email address, the topic you chose, your message and, if you add it, the train company and journey it's about. If you're signed in and leave the email box empty, we use your account's email address. The form sends all of this to us as an email (through Resend) so we can reply; it isn't stored in Railhop's database. To stop the form being misused we count messages per device address and per email address, and those counters hold only coded (hashed) versions of them. The form also uses Cloudflare Turnstile to block spam, which checks your browser without tracking cookies. Please don't send bank or card details. Emails you send to hello@railhop.app directly are handled the same way.

If you tap Share This Trip in the app, Railhop makes a private link someone can open to follow your train live and see when you'll arrive, without an account. It shares the train, never your location: where the train is comes from National Rail's running data, not your phone. We keep only the train, the stations where you get on and off, the first name or nickname you typed for it, when you shared it and when the link ends, plus a coded (hashed) copy of the link's secret part. Nothing links it to your account or your phone. The link stops working an hour after the train gets to your stop (or an hour after it's cancelled), at most 24 hours after you shared it, or as soon as you tap Stop Sharing, and we then delete it. Anyone you send the link to can see what it shows until then. A browser that opens the link remembers it, on that device only, to show the trip in its account menu.

If you open a trip someone shared with you while you're signed in to Railhop, we save it to your account under Shared With You, so you can follow it on your other devices and, in the app, choose alerts for when it's running late or arrives. We keep which shared trip it is, the sharer's name, the train and stations, whether you chose alerts and which alerts we sent. It's never added to your journeys or claims, and we delete it when the shared trip ends, when you tap Stop Following, or with your account.

One ticket, one claim

So a ticket can't be claimed twice, or by someone it doesn't belong to, when you claim for a ticket through Railhop the app sends a one-way code made from the ticket's reference and the journey leg. We never receive the ticket number itself, and we keep only a further coded version of that code, linked to your account. If another account tries to claim the same ticket, the app tells them it has already been claimed. Who made each journey (you, or someone you claim for) stays on your phone.

If your employer uses Railhop

Some companies use Railhop for Business (business.railhop.app) to find the Delay Repay they are owed on rail tickets they bought for their staff. Your employer uploads its booking records: your staff reference, and possibly your name and email address, and for each journey the date, time, stations, ticket type, price, operator, cost centre and booking reference. Railhop uses them only to work out which trains were late and what the train company owes, and to prepare claims. For this data Railhop acts on your employer's instructions as its processor, under a Data Processing Agreement; your employer is the controller, and you can ask them about it. The uploaded file itself isn't kept, and it never includes your bank details or ticket images.

If your employer asks you to submit a claim yourself, you get it by email or in the Railhop app (its Company Claims area, connected with a one-time code). That connection is separate from any personal Railhop account and reaches only your company's claims. Railhop never submits claims for you; you submit each one on the train company's own form, and the train company pays the compensation.

On your employer's instruction, for its expense and audit records, journeys are kept 2 years after the travel date, and your traveller record 2 years after you last appeared in an upload. Claims are deleted after 2 years, except that a submitted claim keeps only its billing line (date, operator, stations and amounts), without your name or the claim reference, for 6 years, as HMRC requires.

The people who manage a company's account (owners and admins) get emails about it: sign-in codes, claim reminders and, as Railhop's own emails, lifecycle emails such as a reminder to upload a booking report. Lifecycle emails go at most once a day and three times a week, never to travellers, and each one has a one-click unsubscribe and a link to email preferences. They contain no tracking pixels. If an email bounces or is reported as spam, the address goes on a suppression list (kept as a one-way hash) so we stop sending to it. Which emails were sent, and when, is kept 2 years. Company subscriptions are paid through Stripe, which holds the card or Direct Debit details; Railhop never sees them.

A company account needs a work email address. To follow up about Railhop for Business, we record when a company's account is created, when it starts and submits its free claim, and when it is shown or clicks the prompt to subscribe, and we may contact the person who created the account at that work address about subscribing. This is Railhop's legitimate interest in offering its service to businesses that tried it. Any such email has an unsubscribe link, and we don't send it to an address that has unsubscribed or that email law says needs consent first (sole traders and other partnerships, other than LLPs and Scottish partnerships, unless they agreed). You can object at any time by unsubscribing or emailing hello@railhop.app. These records are kept while the company's account exists.

Before a company starts its free claim, we ask for the company name, the name of the person starting it and a UK telephone number (mobile or landline). We use them to follow up about that free claim and about setting up a subscription, including a telephone call, which the form says we will make; this is Railhop's legitimate interest in following up a free claim the company asked for. A call is noted only in what our team types (who called, when, the outcome and short notes): calls are not recorded. The same step asks whether we may email you about Railhop for Business. Limited companies, LLPs and Scottish partnerships may be emailed without consent, with an unsubscribe link in every email (legitimate interests), and the form says so. Sole traders and other partnerships are asked to tick a box, which is optional: the free claim does not depend on it. We record each choice with the time, the wording shown and its version, so we can show what you agreed to. You can download all of this from Settings, Your Data (Download My Data), and delete your name, telephone number, follow-up notes and marketing choices there at any time (Delete My Contact Details). The name and telephone number are kept while the company's account exists; follow-up notes are deleted 2 years after the last contact; everything here is deleted when the company's account is closed.

Why we use your data (lawful basis)

Contract (UK GDPR Article 6(1)(b)): your account, sign-in, journeys, claim records, commutes and usual trains, your Autofill Profiles and their bank details, a trip you share, and the emails that are part of the service (sign-in codes, the email when bank details change, "You may be owed" and delay reminders, which you can turn off).
Consent (Article 6(1)(a)): journey detection, push notifications (your phone asks, and you turn alerts on per train), sending a ticket photo to be read, and sending us a ticket photo to improve photo reading. You can withdraw consent at any time.
Legitimate interests (Article 6(1)(f)): keeping Railhop secure and preventing abuse (rate limits, server logs), fixing what goes wrong (problem reports from the app), not sending duplicate emails or alerts, counting visits to public pages (anonymous, cookie-free statistics), replying to messages you send us, and answering lookups you ask for without an account, such as checking a train or a TfL statement, and following up with the people who create a Railhop for Business account (their work email, their company's use of its free claim, and the contact name and telephone number given for it, for a follow-up call), with an unsubscribe link in every such email. Sole traders and other partnerships get marketing email about Railhop for Business only if they tick the box for it (consent, which they can withdraw at any time).

How long we keep it

Account data, journeys, claims, forgotten TfL tap-outs and commutes: until you delete them or your account.
A journey you remove: its stations and the train's time (so it doesn't come back from your phone or a TfL statement): 35 days.
Your tickets' details: until you remove the ticket or delete your account. A removed ticket's random ID and when it was removed: 180 days.
Your Autofill Profiles: until you delete the profile, turn on "Keep on this device only" or delete your account. A deleted profile's random ID and when it was deleted: 180 days.
Bank details for your Autofill Profiles: until you remove them, delete the profile, turn on "Keep on this device only" or delete your account. When they were removed (with the profile's random ID): 180 days.
Your agreement to our Terms (at sign-up, and each time they change): the version, the time and your IP address, to show you agreed to them, for example if a payment is disputed. Kept 6 years from when you agreed, like our fee records, or while you have an account if that's longer.
Railhop for Business follow-up: the contact name and telephone number given for a free claim, and the record of marketing email choices, while the company's account exists (or until you delete them in Settings); notes of follow-up calls, 2 years after the last contact.
Sign-in sessions: 30 days on the web; 180 days unused in the app; or until you sign out.
Sign-in links and codes: valid 15 minutes, deleted within a day after that.
Abuse-prevention counters: 7 days.
A ticket photo sent from your phone to your computer: encrypted, and deleted when your computer collects it or after 10 minutes.
Problem reports from the app: 30 days.
Coded ticket references of claimed tickets: 60 days.
Shared trips: until an hour after the train arrives at your stop, at most 24 hours, or until you stop sharing.
Shared trips you follow (Shared With You): until that shared trip ends, or you stop following it.
Reminder email and alert logs: 35 days; "You may be owed" email log: 60 days.
Ticket photos sent to our AI reader, and TfL statement journeys: not kept (except the delayed journeys and forgotten tap-outs saved to your account, above).
Ticket photos you choose to send us to improve photo reading: 90 days, then deleted automatically (sooner if you delete them).
Booking emails you forward: not kept (deleted once read). Their e-tickets and ticket numbers, encrypted: until you remove the ticket, or 90 days after its claim window ends.
Contact form messages and emails to us: not kept on our server; they stay in our email inbox for as long as we need them to deal with what you asked. Resend keeps its own record of emails it sends for a short period.
Server logs (including IP addresses): kept by our hosting provider for a short period, normally no more than 30 days.
Journey detection: raw events 90 days; diagnostic logs 30 days; journey records 24 months; phones not seen for 180 days are deleted.

Who processes data for us

Railway: runs our servers, in the EU (Netherlands).
Neon: our database, hosted in London.
Resend: sends our emails, including the messages you send with our contact form.
Expo (650 Industries): delivers push notifications through Apple or Google. It gets your phone's notification address and the alert text.
Anthropic: reads a ticket photo, only when your browser couldn't read it and you press "Send Photo".
Apple and Google: only if you sign in with them.
OpenFreeMap: serves the tiles of the route maps on train pages and sees your IP address, as any website does.
Cloudflare: Cloudflare Web Analytics counts visits to our public pages (not your account pages, and not inside the app). It uses no cookies or browser storage, doesn't identify you or follow you across sites, and sees your IP address, as any website does. So there's no cookie banner. Cloudflare R2 also stores, encrypted, the ticket photos you choose to send us (in the EU). Cloudflare Email Routing receives the booking emails you forward and passes them straight to our server.

Railhop also counts anonymous steps itself, on the website and in the app's web pages: for example how many people search for a train, sign in or submit a claim, and which errors happen. No cookies, and nothing that identifies you: no IP address, account or email, just the step, the day, phone or computer, and a tag that changes every day, so visits can't be linked over time (it starts from a random number kept in that browser tab only). If your browser sends Global Privacy Control (or Do Not Track), nothing is counted. The step records are deleted after 90 days; only daily totals are kept.

Some of these companies are based in, or may access data from, the United States. Where your data leaves the UK, we rely on UK adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses). We share data with no one else, except where the law requires it.

We get train data from National Rail, Network Rail and Realtime Trains, and station data from TfL. We send them no personal data.

Cookies and similar

We use only cookies that are needed for the site to work: a sign-in cookie (lasts 30 days, or until you sign out) and short-lived cookies that protect sign-in with Google or Apple (minutes). A small cookie tells the site's pages you're signed in, so they can make room for your account menu before they load (it holds no details), and a cookie remembers which set-up step you reached on Contactless & Oyster (90 days; just the step, nothing about you). Your colour theme, map filter and, if you claim on the website, your claim details (see above) are kept in your browser's storage. No advertising, tracking or analytics cookies: our visit statistics (Cloudflare Web Analytics) and our own step counts use none.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, take a copy to another service, and withdraw consent. On your account page (or in the app, under Account) you can download everything your account holds (including your passkeys' names and dates) and delete your account. Under Your data you can also see and delete any ticket photos you sent us. Deleting is immediate: your account and everything in it are removed, including its passkeys, Apple sign-in is disconnected, and we email to confirm. Data on your phone stays until you delete it in the app or remove the app. Journey detection has its own "Delete my data" in the app.

If you can't sign in, or for anything else, use the contact form (choose "Your data / privacy request") or email hello@railhop.app, from the address you signed up with. We'll reply within one month.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd be grateful for the chance to put things right first.

No advertising or profiling

We don't sell your data, use advertising networks or profile you (our only analytics are the anonymous visit and step counts above), or make decisions about you by automated means that have legal or similarly significant effects.

Children

Railhop accounts are for people aged 16 and over.

Changes

We'll update this page when Railhop changes and change the date at the top. For significant changes we'll tell account holders by email or in the app, and ask for consent again where consent is the basis.

Data sources

Powered by National Rail Enquiries.
Contains information of Network Rail Infrastructure Limited licensed under the following licence: networkrail.co.uk/data-feeds/terms-and-conditions.
Some train times from Realtime Trains.

Full credits are on the About page.

Contact

KMR Digital Ltd, trading as Railhop: hello@railhop.app, or use our contact form.