Privacy Policy

Effective: 13 August 2026

This policy covers both the trainkothai.com website and the TrainKothai mobile app(“TrainKothai”, “we”, “us”). The two collect different data, so each section says which one it applies to. If you only ever visit the website, sections 5 and 6 do not apply to you.

1. Who we are

TrainKothai is free, community-powered train tracking for Bangladesh. At trainkothai.com and in our free Android and iPhone apps you can see any train’s live location in real time, check its delay and running status, and search route schedules — with no sign-up, no account, and no SMS charge.

The trains we track are Bangladesh Railway services and the timetables come from BR’s public data, but TrainKothai is an independent project built by passengers. We are not affiliated with, endorsed by, or operated by Bangladesh Railway.

For any privacy question or request, contact us at hello@trainkothai.com. We are the data controller for the data described here.

2. Cookies and similar technologies (website)

A cookie is a small text file stored by your browser. We group ours into three categories. Only the first is set automatically; the other two require your consent.

2.1 Strictly necessary

These remember your own settings. They carry no identifier, are never shared, and the site cannot work as intended without them, so they are set without consent.

Cookie	Purpose	Lifetime
tt_lang	Your language choice (English / Bengali)	1 year
tt_dark	Light or dark theme	1 year
tt_offline	Whether you enabled offline mode	1 year
tt_sidebar_collapsed	Sidebar layout preference	1 year
tt_consent	Records your cookie choice on this banner	180 days

2.2 Analytics

These help us see which pages are used and where the site breaks. Whether they load automatically depends on where you are, because the law differs:

In the EEA, the United Kingdom and Switzerland we ask first. Nothing below loads until you accept.
Everywhere else, including Bangladesh, these load by default when you open the site. You can switch them off at any time with Cookie preferences in the footer, and we will remember that choice.

Provider	What it does	Their policy
Google Analytics 4	Page views, referrers, approximate location (country/city level), device and browser type	Google Privacy Policy
Hotjar	Aggregated heatmaps and anonymised session recordings of how pages are used, to diagnose layout and usability bugs	Hotjar Privacy Policy
Statcounter	Basic visitor counts and traffic sources	Statcounter Legal

We never send your name, email, or any account identifier to these providers — the site has no login, so we do not hold those in the first place.

2.3 Advertising

We plan to fund TrainKothai with advertising. Advertising cookies follow the same regional rule as analytics above — consent is requested first in the EEA, UK and Switzerland, and personalised advertising can be turned off anywhere. See section 3 for the full detail.

2.4 Changing your mind

Select Cookie preferences in the footer of any page to change your choice at any time. You can also delete cookies through your browser settings, or browse in private/incognito mode. Blocking the strictly necessary cookies will reset your language and theme on every visit.

3. Advertising

This website uses third-party advertising, including Google AdSense. We make the following disclosures, which Google requires of every publisher in its network:

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this and/or other sites on the Internet. This is described in How Google uses information from sites that use its services.
You may opt out of personalised advertising by visiting Google Ads Settings. You will still see ads, but they will not be tailored to you.
To opt out of personalised advertising from other participating vendors, visit optout.aboutads.info or, in Europe, youronlinechoices.com.
Third-party ad networks set their own cookies and are governed by their own privacy policies, not this one. We do not control what they collect.
We never share your location data, or any data from the mobile app, with advertisers.

4. Server logs (website)

Like every website, our hosting provider records standard request logs — IP address, timestamp, requested URL, user agent, and referrer. These are used for security, abuse prevention, and debugging, are not combined with any other data to identify you, and are retained for 30 days.

5. Location data (mobile app only)

Precise location

What:Your device's GPS coordinates (latitude, longitude).

When:Only while you are actively using the app and have granted the location permission.

Why:To crowdsource live train positions. When you are on board a train, your anonymised location helps update that train's real-time position for everyone.

Stored:Transmitted to our cloud backend and not linked to any personal identity.

Optional:The app works fully without location permission. Contributing positions is opt-in during onboarding and can be revoked in your device settings at any time.

Never sold:Location data is never sold, and never shared with advertisers.

6. App analytics, crash reports and local storage (mobile app only)

6.1 Analytics & crash reports

What:Screen views, navigation events, app errors, and crash stack traces.

Session replay:Our analytics provider records screen sessions on Android to help us diagnose UI bugs. No payment, password, or sensitive personal data is ever shown in this app.

Why:To understand how the app is used, find crashes, and improve reliability.

Personal data:None. No name, email, or account identifier is sent — the app has no login.

6.2 Local device storage

The following is stored only on your device and never uploaded:

Data	Storage	Purpose
Station list cache	Encrypted local storage	Makes station search instant; expires after 15 days
Onboarding status	Encrypted local storage	Remembers whether you completed setup
Permission state	Encrypted local storage	Avoids re-prompting for location / notifications each launch

6.3 Permissions used

Permission	Why it is needed
`ACCESS_FINE_LOCATION`	GPS coordinates for crowdsourced train tracking
`ACCESS_COARSE_LOCATION`	Fallback location when GPS is unavailable
`POST_NOTIFICATIONS`	Train delay and arrival alerts (Android 13+)
`INTERNET`	Fetching live train data from our servers

7. Train and schedule data

Train timetables, seat classes, running status, and delay information are fetched from our backend servers. This is public railway information and contains no personal data about you.

8. Data we do NOT collect

Name, email address, or account credentials — neither the site nor the app has a login
Payment or financial information
Contacts, photos, microphone, or camera
Device identifiers linked to a named person
Any special-category data (health, religion, political opinion, biometrics)

9. Third parties who process data for us

Each of the following processes only what is needed for its function and is bound to protect it. We do not sell your data to anyone.

Provider	Role
Supabase	Cloud backend — stores and serves live train data; receives anonymised location pings
Cloudflare	Website hosting, CDN, and DDoS protection
Google (Analytics, AdSense)	Website analytics and advertising
Hotjar, Statcounter	Website usability analytics and visitor counts
Google Play, Apple App Store	Distribute the mobile app to your device

Some of these providers are based outside Bangladesh, including in the United States and the European Union, so your data may be processed there.

10. How long we keep data

Data	Retention
Location pings (server)	30 days, then automatically deleted
Server request logs	30 days
Crash reports	1 year
Session replays	30 days
Website analytics (aggregated)	Up to 14 months
Local device cache	Until the app is uninstalled or the cache expires

11. Children's privacy

TrainKothai is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided data through the site or app, contact us and we will delete it promptly.

12. Security

All data in transit is encrypted via HTTPS/TLS. App local storage is isolated to the app sandbox and inaccessible to other apps. Our backend enforces row-level access controls. No system is perfectly secure, but we take reasonable technical and organisational measures to protect what we hold.

13. Your rights

You may at any time:

Withdraw cookie consent — use "Cookie preferences" in the footer
Revoke location or notification permission in your device settings — contribution stops immediately
Clear local data by uninstalling the app or clearing your browser storage
Request access to, correction of, or deletion of any data we hold — email hello@trainkothai.com with the subject “Data Request”
Object to processing, or ask us to restrict it

We respond to requests within 30 days. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

14. Changes to this policy

We may update this policy when features change or new providers are added. The effective date at the top will be updated, and significant changes will be announced with an on-site notice. Continuing to use TrainKothai after a change means you accept the updated policy.

15. Contact

For any privacy question or request:

hello@trainkothai.com All contact options