Calling At privacy policy

Last updated 22 October 2026

Calling At is an iPhone app, with widgets and an Apple Watch app, for following trains in Great Britain. It's made by Max Woolf, who decides what it collects and is responsible for it under UK data protection law. "We" on this page means Max.

In short

• No accounts, no advertising and no tracking. We never sell data, or share it for advertising.
• Your journeys, your Logbook and your badges stay on your iPhone.
• Your location is only used on your iPhone, to suggest the nearest station. It never leaves the device.
• To send alerts, Live Activities and widget updates, our server keeps a random device ID, push tokens and the journeys you're following. Journeys are deleted 24 hours after they end.
• If you buy Calling At Pro, our server also keeps your plan and your repeats.
• Unless you turn it off, the app sends usage data to PostHog in the EU: what's used in the app, never your stations, your location or anything you type.
• Delete all data, in Settings → Privacy & data, deletes everything on your iPhone and on our server at once.

On your iPhone

• The journeys you track, your Logbook (each past journey with its stations, times, route and delays), your badges, your repeats and your settings are kept by the app on your iPhone. Only what this page lists under On our server is sent to us.
• They're included in your iPhone's backups, in iCloud or on a computer, if you make them.
• Location. If you tap Use your location in the station picker, iOS asks whether Calling At may use your location while you're using the app. If you allow it, your location is used, to about 100 metres, only to suggest the nearest stations. It's never saved, and never sent to our server or anyone else.
• Maps. Maps come from Apple Maps. To draw one, your iPhone asks Apple for the map of the area on screen, under Apple's privacy policy.
• Delay Repay. Reminders to claim are made on your iPhone. Claim opens the train company's own page in your browser, where its privacy policy applies. Calling At sends it nothing.
• Sharing. Anything you share or export from Calling At, such as a badge or your Logbook as a file, leaves your iPhone only when you share it, and goes only where you choose.
• Delete history, in Settings → Privacy & data, deletes your Logbook. Delete all data deletes everything. Deleting the app deletes what it keeps on your iPhone.

On our server

Our server finds trains, keeps their times live and sends your alerts. It runs on Fly.io in London, with its database at Supabase, also in London.

When you first open Calling At, it gets a random device ID from our server. The ID isn't linked to your name, your Apple Account or your phone number, and we never learn who you are. We still treat what's kept with it as personal data.

What our server keeps:

• Your device: the device ID; a secret only your iPhone knows, which our server keeps only in a form that can't be turned back into the secret; the app's version and the iOS version; whether you allow notifications; and when your iPhone registered and when it last contacted our server.
• Push tokens: the codes Apple gives the app so that we can send it notifications, start and update its Live Activities, and update its widget. Apple's Push Notification service delivers each one.
• The journeys you follow: for each journey you track, its trains, where you board and leave each one, the scheduled times, your alert and Live Activity settings, and what we last told you about it, so you're never told the same thing twice. A journey is deleted when you remove it, and 24 hours after its scheduled arrival.
• Calling At Pro: if you've bought it or started its free trial, your plan, and with it your repeats. See Calling At Pro and Repeats.

What our server doesn't keep:

• Your searches. Our server answers each search, and each request for a train's times, then forgets it.
• Your IP address. Fly.io sees it when it passes your request to our server. Our server holds it in memory for up to an hour, to limit how many requests one address can make, and never saves or logs it.
• Your name, email address, phone number, location or Logbook.

Logs. For each alert, Live Activity update and widget update it sends, our server logs the device ID, the journey's ID, which train it was about, what kind of update it was and when it went. It names push tokens and purchases only by a short code made from them, and a repeat only by the start of its ID. We use the logs to check that alerts arrive on time and to fix faults. Fly.io keeps them for 7 days.

How long. Delete all data deletes your device's record from our server at once, with its push tokens, journeys, repeats and plan. If you delete the app, they're deleted 90 days after your iPhone last contacted our server. A device that registers and then never contacts our server again is deleted after 24 hours. Our database isn't backed up, so what's deleted is gone.

Widgets and Apple Watch

• The Next train widget, the Apple Watch app and its complications show the journeys on your iPhone. Your iPhone sends them to your watch directly, not through our server.
• To keep their times current, the widget, the watch app and the complications ask our server about your journeys with your iPhone's device ID. The watch keeps a copy of that ID, which your iPhone sends it, and deletes it when you use Delete all data.
• So that your widget updates when your train changes, our server keeps the widget's push token with your device's other push tokens while you have Calling At Pro, and deletes it with them.
• Neither the widgets nor the watch send usage data.

Calling At Pro

• You buy Calling At Pro with your Apple Account, through the App Store. Apple takes the payment, under Apple's privacy policy, so we never see your name, your Apple Account, your payment details or your address.
• So that your repeats keep working while the app is closed, your iPhone sends our server the App Store's signed record of your purchase, or of your newest one once Calling At Pro has ended. Our server checks Apple's signature, then keeps with your iPhone's device ID: Apple's number for the purchase, which plan you have, when it ends, whether it's a free trial, and whether it was refunded.
• Apple tells our server when your subscription renews, lapses or is refunded, and our server asks Apple if one ends without word. Our logs name a purchase only by a short code made from Apple's number.
• It's deleted with your device's other data: when you use Delete all data, or 90 days after your iPhone last contacted our server.

Repeats

• When you repeat a train with Calling At Pro, our server keeps the repeat with your iPhone's device ID: its stations, the train's time, the days it repeats and any days you skip. That lets it follow each day's train for you, with its alerts and Live Activity, even when the app is closed.
• Each day's train is kept like any journey you follow, and deleted 24 hours after it ends. Our server's note of which days it has dealt with is deleted two days after each one.
• A repeat is deleted when you stop repeating it, and when you use Delete all data. If you delete the app, your repeats are deleted with your device's other data 90 days after your iPhone last contacted our server. Until then, their trains are still followed while Calling At Pro lasts.
• Our logs name a repeat only by the start of its ID, never by its stations or times. Each day's train is logged like any journey you follow.

Usage data

Unless you turn it off, Calling At sends anonymous usage data to PostHog, which stores it in the EU. We use it only to see how the app is used, so we can choose what to improve.

It's sent with a random ID made for the app on your iPhone. That ID isn't linked to you, to your Apple Account or to the device ID our server uses for alerts.

• What's sent: what you do in the app, such as searches made, trains tracked, screens opened, badges opened and settings changed, with broad details like whether a search was for today or later in the week, how long a journey was (in bands such as 30 to 59 minutes), which train company ran it, whether it arrived on time and how long searches take; roughly when a journey runs (a part of the day, such as the morning peak, and whether it's at the weekend), and whether it left late, its platform changed or part of it was cancelled; which parts of a journey's screen you scrolled to, and roughly how long it was open; when the app can't reach our server, which kind of request failed, how, and whether you were on Wi-Fi or mobile data, and how long live times take to arrive; your text size, in broad steps, and whether VoiceOver, Reduce Motion, Bold Text and dark mode are on; how many journeys and repeats you have, and whether you've allowed notifications, Live Activities and location; whether you have the Next train widget or the watch app; whether you have Calling At Pro and which plan, and the steps of buying it (the plan you chose, and whether you bought it, started a free trial or cancelled); and the app's version, the iOS version and your iPhone's model.
• What's never sent: your stations or routes, anything you type, your location, which trains or journeys you track, their dates and exact times, links you open, what our server said in reply, your push tokens, prices, your purchases' numbers, or your Apple Account. PostHog is set to discard IP addresses, so it keeps neither yours nor a location worked out from it.
• Who: PostHog processes it for us under its data processing agreement, and may use it only to provide its service to us. It's deleted after a year.
• Why we may: our legitimate interest in improving Calling At. UK law allows statistics like these without asking first, when they're used only to improve the app, the app says so, and you can turn them off.
• Turning it off: Settings → Privacy & data → Share usage data. Nothing more is sent, and anything waiting to be sent is deleted. Delete all data also gives the app a new random ID.

Who else handles data

• Fly.io runs our server, in London.
• Supabase runs our database, in London.
• PostHog stores usage data, in the EU.
• Apple delivers notifications, Live Activity updates and widget updates, sells Calling At Pro and draws the maps, under its own privacy policy.

Fly.io, Supabase and PostHog act only on our instructions. Fly.io and Supabase are American companies: where they handle data from outside the UK, their data processing terms provide the safeguards UK law requires. We share data with no one else, and never sell it.

Why we're allowed to

• Your device ID, push tokens, journeys, repeats and plan: to do what you ask Calling At to do, such as sending your alerts and following your repeats.
• Logs, and your IP address while it's held to limit requests: our legitimate interest in keeping Calling At working and secure.
• Usage data: our legitimate interest in improving Calling At, as above.

Your rights

You can ask for a copy of the data we hold about you, and ask us to correct it, delete it, stop or limit how we use it, or give it to you in a form you can take elsewhere. You can also object to any use based on our legitimate interests.

The quickest way is in the app: Delete all data deletes everything at once, and Share usage data turns usage data off. As Calling At has no accounts, we may not be able to tell which records on our server are yours; if so, we'll tell you. Usage data can't be traced back to you at all.

For anything else, get in touch. If you're unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Our website

This website, getcallingat.com, which also answers at callingat.woolf.io, sets no cookies, counts no visits and loads nothing from other sites.

Contact

Max Woolf, who makes Calling At and is responsible for your data: max@woolf.io

Changes

When what Calling At collects changes, this page changes before the app does, with a new date at the top.