Privacy Policy

Data controller

Tågradar is responsible for the processing described here. The service is an independent hobby project without user accounts.

For personal data questions, contact etfnordic@gmail.com. See also the contact page.

What data is processed and why?

Delivery and security – Cloudflare Pages and Workers process information including the IP address, time, requested address, browser details and technical logs to deliver and protect the service. The legal basis is our legitimate interest in a secure and functioning website.
Maps – the standard map is loaded from OpenStreetMap. Esri is contacted only if you actively select the satellite view. Satellite imagery is then loaded from Esri, which may receive your IP address, Tågradar's domain (referrer), browser information and details of the map tiles requested. This processing is necessary to provide the map view you selected.
Analytics – after an optional choice, Google Analytics and PostHog may process page views, visit duration, scroll depth, interactions such as clicks, heatmaps, session recordings, automatically recorded technical errors, technical performance metrics (Web Vitals), page address, time, approximate location, and browser and device type to measure use and site performance. The legal basis is consent. PostHog uses its EU environment and a pseudonymous browser identifier to connect visits from the same browser. Tågradar does not use PostHog's function for identifying people. Page text is omitted from PostHog's automatically captured interactions. Input fields are masked by default in session recordings, but other page text may be included. Content inside cross-origin iframes is not recorded. We remove URL parameters and fragments from four address fields in PostHog events: the current and initial page address and the current and initial referrer address. Other address data, including in Google Analytics and session recordings, may contain URL parameters.
Advertising (Google AdSense) – Tågradar uses Google AdSense. On pages with advertising code, an asynchronous script is loaded from pagead2.googlesyndication.com in the page head. When the script or adverts load, Google and its advertising partners may receive your IP address, page address, time, browser and device information to deliver and measure adverts and protect against fraud. Ad personalisation is based on consent where required.
Operational analytics – some aggregated API events are sent server-to-server to PostHog with a shared server identity and without the visitor's IP address in the event data. The purpose is troubleshooting and availability; the legal basis is legitimate interest.
Location near me – if you start this feature, the browser asks for permission. Your position is used locally to calculate the nearest station and is not sent to Tågradar.

Cookies and local storage

Essential – tagradar_cookie_consent stores the choice, policy version and timestamp for no more than 180 days. tagradar:theme:v1 stores the selected colour theme. Short-lived local train caches are used for faster loading. These values are not sent to advertising or analytics providers.
Analytics – Google Analytics and PostHog are not loaded before analytics consent. PostHog uses local storage for data including a pseudonymous browser ID and session metadata after consent. Tågradar clears PostHog's local storage when consent is withdrawn or an expired choice is detected on page load.
Google AdSense – advertising code loads independently of your analytics choice. Google and other advertising providers may use cookies and local storage. With consent where required, adverts may be personalised based on previous visits to this and other websites. Even non-personalised adverts may use cookies, so declining personalisation does not automatically disable all advertising storage.

Tågradar's local cookie setting applies only to analytics from Google Analytics and PostHog. For personalised adverts in the EEA, the UK and Switzerland, Google requires a separate Google-certified consent platform. If Google's European regulations message is displayed, you can choose purposes and advertising partners there and change your choice using the privacy and cookie settings link at the bottom of the page. Declining does not affect access to train information.

You can also turn off personalised adverts in Google's ad settings. Read how Google uses your information and information about Google's advertising partners and their privacy policies. The advertising partners used on this website are listed in the advertising consent message when it is displayed.

Recipients, retention and transfers

Data may be processed by Cloudflare, Google and its advertising partners, PostHog, OpenStreetMap's infrastructure and, when the satellite view is selected, Esri for the purposes described above. Processing outside the EEA may occur under each provider's terms and safeguards. The PostHog project stores data in the EU, although subprocessors may still be covered by contractual transfer mechanisms.

The local consent choice expires after 180 days. Functional train caches are retained for no more than five minutes and 36 hours respectively. Retention periods for analytics and technical security logs are controlled by the active account and provider settings and are limited to what is necessary for each purpose.

Your rights and consent

You may request access, correction, erasure, restriction or data portability, and object to processing based on legitimate interest. You may withdraw consent at any time as easily as you gave it. Withdrawal does not affect the lawfulness of processing before withdrawal.

Changes to this policy