Privacy notice

Version: draft of 7 October 2026.

In short

• Your password goes only to TfL or the train company. Never to us. A saved one stays on this iPhone.
• ZipRail keeps your journeys on your iPhone. A train company sees one only when you claim from it.
• There are no accounts, no ads and no tracking.
• Our server keeps nothing about you, unless you turn on alerts.
• ZipRail never handles your money. TfL and train companies pay you directly.

Who we are

ZipRail is made by ZipPockets. We decide how the data described here is used, so we are its data controller.

[Legal name and company number] · [Registered address] · ICO registration: [number]

Write to us at privacy@ziprail.co.uk.

What we collect, how and why

On your iPhone

Your TfL journeys. You sign in on TfL's own page, inside the app. ZipRail reads your cards, journeys and refunds to find journeys that may have been delayed. It keeps the latest read, encrypted, on this iPhone only. It is never copied to iCloud or a backup, and never sent to us.

Your TfL password, if you choose to save it. It's kept only on this iPhone. It's sent only to TfL, never to ZipRail's or ZipPockets' servers, and never to iCloud. ZipRail uses it only after Face ID, Touch ID or your passcode. Someone with this iPhone and its passcode could use it to sign in to your TfL account, because TfL texts its codes to this phone. A train company's password, if you save one, is kept the same way and sent only to that company. If you don't save a password, you type it on TfL's page and ZipRail never reads it.

Refund amounts you type in. Kept on this iPhone, encrypted, to show what you have got back.

Evidence for a National Rail claim. When you claim from a train company, ZipRail saves TfL's page for that one journey: its date, stations and fare. It asks before attaching the page to the company's form. The company receives it as soon as it is attached, before you press Submit.

Face ID. ZipRail never receives your face or fingerprint. Your iPhone only tells it yes or no.

On our server

Nothing about you, unless you turn on alerts. Our server holds public rail data, such as each day's TfL delays. It does not record which phones download it.

Alerts, if you turn them on. ZipRail's server keeps the lines and routes you add, with their times and days and whether each is muted, so it can alert you the next morning. It also keeps a random code for this iPhone (scrambled, so it cannot be read back), Apple's address for sending it alerts, and the date ZipRail last checked in. It keeps nothing else: no name, no email and no TfL account. The alert itself names no line, station, time or date.

Your founder code. The first 1000 people get a founder code. To give you one, the app sends our server a one-off check from Apple that the request comes from the real ZipRail app on a real iPhone, and nothing about you. Our server keeps only a count of the codes it has made, so it does not know who holds them. Apple remembers that your iPhone has been given a code. The code is kept in your iPhone's Keychain.

Logs. Our server keeps technical logs to stay running: the kind of request, an error code, a path. They never contain a journey, an amount or anything you typed.

This website

This website sets no cookies and runs no analytics or trackers. Netlify delivers it, and sees your internet address to do so. We keep no record of your visit.

Email

If you write to us, we see your email address and what you write. We use them only to answer you.

The waitlist

If you join the waitlist, Google Forms keeps your email, your phone type and what you ticked, in our Google account. We use your email only for what you ticked: to tell you when ZipRail launches, or to invite you to the test version. Test invites come from Apple's TestFlight, so Apple gets your address. Your email is deleted three months after launch, or sooner if you ask at support@ziprail.co.uk.

Why we may use it

• Your consent, for reading your TfL account, saving a password and alerts. You turn each one on, and you can turn it off.
• To give you the service you ask for, for filling in a claim, and for the waitlist and test invites.
• Our legitimate interests, for founder codes, logs and answering email.

Who we share it with

• TfL. ZipRail works in your own TfL account, on your iPhone, as your browser would. TfL's own privacy notice covers your account.
• A train company, only when you claim from it: your claim, in your name, and TfL's page for that journey.
• Apple provides the App Store, Face ID and the founder-code check, and delivers alerts. If you join the test, Apple's TestFlight gets your email address to send the invite.
• Google keeps the waitlist's answers, in Google Forms.
• Amazon Web Services hosts our server, in London.
• Netlify delivers this website.
• Zoho hosts our email.

We never sell data. We have no advertising partners.

How long we keep it

• On your iPhone: until you disconnect, delete it in the app, or delete the app.
• A saved password: until you turn saving off. Disconnect also deletes your TfL password, and removing a train company from ZipRail deletes its password. A password may stay on your iPhone after you delete ZipRail, so delete it in Settings first.
• TfL's page for a claim: until the claim is sent or dropped, or the time to claim runs out.
• Alerts on our server: deleted when you turn alerts off, delete your last line or route, stop ZipRail's notifications or disconnect, and 60 days after you last open ZipRail. Deletion is complete within 7 days, backups included.
• Your founder code: on your iPhone until you delete it. Our server keeps only the count.
• The waitlist: three months after launch, or until you ask us to delete it.
• Email: [how long we keep it].

Delete it, or withdraw consent

• Settings → Disconnect and delete my data deletes your TfL sign-in, journeys, refund amounts and saved TfL password from your iPhone, and asks our server to delete your alerts. Tick "Also delete my founder code" to delete that too.
• Turn alerts off in Settings → Alerts. Our server deletes what it kept.
• Stop saving a password in Settings, or remove the train company it is for. It is deleted from your iPhone.
• You can also ask us to see, correct or delete your data, or object to how we use it. Write to privacy@ziprail.co.uk.
• You can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.

The TfL connection

TfL has no official way for apps to read your journeys. ZipRail reads your account as your browser would, from your iPhone, at a person's pace. TfL could object. If it did, it would act on your account. If that worries you, ZipRail also works with the journey statement you download from TfL yourself.

Children

ZipRail has no minimum age. If you are under 13, a parent or guardian must agree before you use it.

Changes

We will show you a new version in the app before it applies.