Privacy
Last updated October 18, 2026
The short version
- You can use the whole map without an account. Nothing about you leaves your device except what any website sees (your IP address, your browser).
- If you make an account, Trainsheet keeps your email address, your trips and the trains you're tracking, so you can see them on every device. That's all, and it's only used to show them back to you.
- Your location is used on your device to find trains near you. It's never sent to Trainsheet or saved.
- No ads, no analytics, no tracking cookies. Nothing is sold or shared for marketing.
- You can delete your account and everything in it from Settings at any time.
Without an account
Trainsheet runs in your browser. Your settings (theme, units, language and so on), the trains you're tracking, your recent searches and the railroads you've hidden are kept in your browser's own storage on your device. They aren't sent to Trainsheet. Clearing your browser's data for trainsheet.com removes them.
To show live trains, your browser fetches data from the railroads' public feeds, some directly and some through Trainsheet's relay (a small Cloudflare service that forwards feed requests). The map's background comes from OpenFreeMap. Those requests carry your IP address and browser details, as any web request does. Trainsheet doesn't keep logs of them.
Your location
Trainsheet asks for your location only when you press "Find trains near me" or the locate button, and your browser asks your permission first. It's used on your device to list the closest trains and, while you're riding, to work out which train you're on. It isn't sent to Trainsheet, saved, or added to your account. Trainsheet remembers only whether you allowed it, so it can refresh the nearby list on your next visit.
You can turn location off at any time in your browser's site settings.
If you make an account
Accounts are optional. With one, Trainsheet keeps:
- How you sign in: your email address. With a password, the password is stored only as a secure hash, which nobody can read back, Trainsheet included. With Google, Trainsheet receives your name, email address and profile picture link from Google. Only your email is used.
- Your trips: the ones you add (railroad, train number, date, stations, times and any notes you write) and the ones logged when a train you're tracking reaches your stop.
- Your tracked trains: the trains you're following, so they appear on your other devices too.
- Sign-in records: when the account was created and last signed in, kept by the sign-in service for security.
This is used only to provide those features to you. Each account can read only its own data. Trainsheet doesn't look at it, sell it, share it, or use it for ads. Information received from Google is used only to sign you in, under the Google API Services User Data Policy, including its Limited Use requirements.
Who else handles it
Trainsheet relies on a few services. Each sees only what it needs to do its job:
- Supabase stores accounts and their data on servers in the Americas, handles sign-in, and sends sign-up and password-reset emails.
- Google handles signing in with Google, if you choose it.
- GitHub Pages serves the website.
- Cloudflare runs the relay for railroad feeds.
- jsDelivr and unpkg serve the code libraries the site uses.
- OpenFreeMap serves the map.
- The railroads' feeds provide the live train data.
Deleting your data
To delete your account: open Settings, then Your trips. Under Account, choose Delete my account. Your account, trips and tracked trains are deleted from Trainsheet's servers right away. This can't be undone.
If you signed in with Google, you can also remove Trainsheet's access at myaccount.google.com/connections.
If you can't sign in, email alexanderbronzini@gmail.com from the address on the account, and it will be deleted within 30 days.
Data on your device (settings and so on) stays until you clear your browser's data for trainsheet.com.
How long it's kept
Account data is kept until you delete it. Copies in the database provider's routine backups are gone within a few weeks after that.
Your rights
You can see and change your trips in the app at any time. Wherever you live, you can ask for a copy of your data, ask for it to be corrected or deleted, or object to how it's used, by emailing alexanderbronzini@gmail.com. If you're in the EU or UK, you can also complain to your data protection authority.
Security
Everything travels over HTTPS. Account data is protected by access rules in the database that let each account reach only its own rows. Passwords are never stored in readable form.
Children
Trainsheet accounts aren't meant for children under 13, and Trainsheet doesn't knowingly keep their data. If you think a child has made an account, email the address below and it will be deleted.
Changes and contact
If this policy changes, the new version will be posted here with a new date. For anything about your privacy, email alexanderbronzini@gmail.com.