Privacy Policy

This Privacy Policy applies to the websites junatkartalla.com and trainsonmap.com, as well as the Junat Kartalla (Trains on Map) mobile applications available on the Apple App Store and Google Play Store (collectively referred to as "the Service").

Touko Peltomaa built the Service as a free tool and is the data controller for the Service (contact details below).

Data Collection and Use

We respect your privacy. The Service does not require an account and does not collect your name, email address, or other identifying personal information, and we do not use third-party advertising frameworks or invasive tracking tools. To provide the Service and keep it secure, the following anonymous technical data is processed under the lawful basis of legitimate interest — namely keeping the Service secure and functional and improving it for everyone:

• Infrastructure & Security (Cloudflare): Our web traffic and APIs are routed through Cloudflare for performance and security. Cloudflare processes standard network data (such as IP addresses) solely to protect the websites and APIs against malicious attacks and to serve data quickly. Cloudflare may process this data in regions outside the EEA; such transfers are protected by appropriate safeguards, including the EU–US Data Privacy Framework.
• Analytics (cookieless, self-hosted): The websites use Umami, hosted on our own servers, to understand aggregate traffic. These are cookieless and collect no personal data: IP addresses are not stored and visitors are never tracked across websites.
• Software updates (Expo): The mobile apps receive software updates through Expo's update service, which processes basic, anonymous technical information (such as the app version and platform) to deliver updates correctly. It does not track your identity or personal usage habits.
• Traveller reports (crowd-sourced insights): Travellers can anonymously report conditions on a train — for example crowding, disruption, or other status information. When you submit a report, we store the train, the reported information, the time, and an anonymous device identifier. Reports are shown to other visitors only as aggregate consensus counts (a report appears once enough distinct travellers have reported the same thing within a rolling time window). Raw reports are retained as long as they are useful for operating and improving the Service, including analytics and product development, and may be combined with other data we hold. Data shared with third parties is anonymized or aggregated and does not identify you.
• Device identifier (local storage): To support features such as counting distinct reporters without accounts, your browser may store a random identifier (a UUID) in local storage. It contains no personal information and can be cleared at any time by clearing your browser's data for this site.
• Bot protection and rate limiting: Certain parts of the Service may use Cloudflare Turnstile to distinguish humans from automated traffic. When it runs, Cloudflare processes standard technical data (such as your IP address and browser characteristics) for security purposes, in line with Cloudflare's own privacy policy. We may also rate-limit submissions by IP address; this data is held in memory only and never stored.

Train timetable and location data is processed directly between your device and public transit APIs.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, or restrict the processing of your personal data, to object to processing based on legitimate interest, and, where applicable, to data portability. The Service does not require accounts and does not collect identifying personal information such as your name or email address. Traveller reports are stored with a random device identifier only; because no identifying information is collected, reports cannot be attributed to a specific person, and we are unable to identify or delete individual reports on request. IP addresses are processed briefly for security and rate limiting and are never stored. If you have concerns about privacy or the third-party security tools we use, or wish to object to any processing, you may contact us at any time. You also have the right to lodge a complaint with your local data protection supervisory authority (in Finland, the Office of the Data Protection Ombudsman).

Contact

If you have any questions about this Privacy Policy, you can contact us at [email protected].