What TrainsPh knows
about you, and what it does not

There is no account. You never give TrainsPh your name, your email address or your phone number to use the app, and nothing you do in it is attached to a person.

• Your location never leaves your phone. It is read when you open the nearest-stations view, compared against station coordinates already on the device, and discarded. It is not stored and not transmitted.
• The only thing the app uploads is a crowd report — a station, a crowding level from 1 to 4, and a timestamp, stamped with an anonymous ID that Firebase issues to the install.
• The app measures how it is used, and you can switch that off. Which screens you open, which fares you look up, which features you use and what goes wrong. It is on when you install the app; the switch is in About & sources and takes effect immediately. Never your location, never anything you type, never your advertising identifier.
• No crash reporting SDK and no advertising. The app contains no crash reporting library and no ad library, and does not read your advertising identifier.
• No tracking on the website. trains.ph sets no cookies and runs no analytics. The only thing it collects is an email address, and only if you type one into the relaunch form.
• Everything is optional except the fares. Location, notifications and crowd reporting can each be refused, and the app still does what it is for.

This summary is here for speed, not to replace what follows. Where the two could be read differently, the clauses below govern.

TrainsPh is built and operated by John Nicholai Villegas, trading as TAIO Labs, in the Philippines. For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), that is the personal information controller for both the app and this site.

TrainsPh is a voluntary, independent project. It is not operated by the Department of Transportation, the LRTA, the MRTA, the PNR or any other government agency, and none of them receive data from it.

Questions, requests and complaints go to taioappsdevelopment@gmail.com.

An anonymous ID, issued to the install

To share a crowd report, the app signs in to Firebase Authentication anonymously. Firebase issues a random identifier — a uid — to that installation. It is not derived from your phone number, your email, your Google or Apple account, your advertising identifier or any hardware serial, and there is nothing in it or attached to it that names you.

Its only job is to let the server enforce two rules: that a report is stamped with the identity that wrote it, and that one install cannot file more than one report per station every five minutes. Delete the app and the identifier goes with it; a reinstall gets a new one.

Usage analytics

The app uses Google Analytics for Firebase to record how it is used. This is on when you install it, and you can turn it off at any time under About & sources → Share usage data. Switching it off stops collection immediately and is remembered.

What it records:

• Screens — which parts of the app you open.
• Fare lookups — the two stations, the ticket type and whether a concession was selected. Stations are recorded by their internal identifier, the same one you pick from a list.
• Features used — saving a trip, submitting a crowd report, turning on notifications, and similar.
• Things that went wrong — a data download that failed, a location permission that was refused, a journey that could not be planned. Recorded as a short code chosen by us, never as an error message.
• Language — whether the app is running in English or Filipino.
• Standard Firebase information — device model, operating system version, country, app version, and an app instance identifier that Google issues to the installation.

What it never records: your location, your advertising identifier, and anything you type. The nearest-stations feature reads GPS and that reading still never leaves your phone; what is recorded is at most the station it resolved to, which is no more precise than picking it from a list yourself.

Analytics data is processed by Google under its own terms. Deleting the app ends collection; the instance identifier goes with it and a reinstall gets a new one.

Crowd reports

When you tap a crowding level, the app writes exactly this:

• Station — which station you are reporting on.
• Level — a number from 1 to 4.
• Time — set by the server, not by your phone.
• The anonymous ID — so the write rules and the rate limit can be enforced.

No text, no photographs, no coordinates. Reports are append-only: nothing in the app or in the database rules permits a report to be edited or withdrawn once written. That is a deliberate integrity property of the crowd data, and it is also why a report contains nothing personal in the first place. The one exception is age — after 90 days the rules permit a report to be deleted, and nothing else.

Device attestation

Firebase App Check asks the platform — Play Integrity on Android, App Attest / DeviceCheck on Apple — to confirm that requests come from a genuine copy of TrainsPh on a real device. This is what stops someone scripting sign-ups to poison the crowd data. Those checks are performed by Google and Apple; the app receives a short-lived token and never sees the device details behind it.

Fare and station data

Every fare, station and travel-time figure ships inside the app, so the core of it works with no network and no permission at all. On launch the app fetches a small manifest from trainsph-data.web.app and downloads a dataset only if its contents have changed. That is an ordinary HTTPS request, carrying nothing about you beyond what any web request necessarily carries — see who else handles it.

The app asks for location for one feature: showing which stations are nearest to you. When you open that view it requests a single fix at medium accuracy — stations sit hundreds of metres apart, so metre-level precision would buy nothing and cost battery — and compares it against station coordinates already bundled in the app.

• Foreground only. Location is read while you are looking at that screen. The app declares no background-location permission and does not track you between uses.
• Never written down. The fix is held in memory to sort a list and is gone when the screen closes. It is not saved to storage.
• Never transmitted. No coordinate is sent to us, to Firebase, or to anyone else. A crowd report carries a station, not a position.
• Refusable, permanently. Decline the permission and every other part of the app works unchanged; you pick your station from the list instead.

You can withdraw the permission at any time in your phone's settings, and the app is built to treat that as a normal answer rather than an error.

Notifications are opt-in. Nothing is subscribed until you ask for it, and the permission prompt is deliberately not shown on first launch.

If you turn them on, Firebase Cloud Messaging issues your install a device token and subscribes it to a topic called advisories. A token is an address for a phone, not a name: we send to the topic, never to an individual. Advisories are published by hand and are limited to what is wrong on the network right now.

There is no re-engagement push, no marketing push, and no "your report helped" push. Turning notifications off in the app unsubscribes the topic; turning them off in your phone's settings stops them regardless.

Some things are stored locally so the app is fast and works offline. None of it is uploaded, and all of it goes when you uninstall the app or clear its storage:

• Your own crowd reports, so the app knows you already reported at a station and a tap is never lost when the network is down.
• Downloaded fare and station datasets, plus the manifest describing them.
• Your preferences, such as whether you asked for advisories.

Clearing the app's data resets all of it. It cannot be recovered by us, because we never had a copy.

This site is static pages. It sets no cookies, runs no analytics, and carries no tracking pixels or embedded social widgets — the social links are ordinary links.

The relaunch form

If you fill in the "notify me at relaunch" form, the email address you type, the line you pick and anything you write in the message box are sent to Kit (formerly ConvertKit), the mailing-list service we use, and are used for one purpose: telling you when the app returns, and reading what you asked for. They are not sold, rented or shared. Every email carries an unsubscribe link, and unsubscribing removes you.

There is a hidden field in that form that a person never sees. If it is filled in, the submission is discarded as spam. It is the only check the form performs, and it looks at the form, not at you.

Hosting and fonts

The site is served by Firebase Hosting, which keeps ordinary server logs, and it loads two typefaces from Google Fonts, which means your browser makes a request to Google to fetch them. Both are in the table below.

TrainsPh is a small project and runs on other people's infrastructure. This is everyone who touches data on our behalf — the complete list, not a sample. Each is bound by its own terms, and each is outside the Philippines, so your data may be processed abroad.

Third parties, what reaches them, and why.

Who	What reaches them	Why
Google Firebase Auth, Realtime Database, Cloud Messaging, App Check, Hosting	Anonymous install ID; crowd reports; push token and topic; IP address and request metadata in server logs	Runs the shared crowd data, the advisory pushes, and both this site and the dataset host
Google Play Apple	Device integrity signals, handled by the platform; whatever the store itself records about your download	Confirms requests come from the real app on a real device; distributes the app
Kit formerly ConvertKit	Email address, chosen line and message — from the website form only, never from the app	Sends the one email announcing the relaunch
Google Fonts	Your IP address and browser, when this website loads its two typefaces	Typography on trains.ph. The app bundles its fonts and makes no such request

We do not sell personal data, and we do not share it with advertisers, data brokers or agencies. Nothing above is a sale, or a disclosure for anyone else's marketing.

Stated plainly, because a policy that lists only what a company may do tells you nothing. As of this version, TrainsPh does not:

• ask for your name, email, phone number or any government identifier in the app;
• read your contacts, photos, camera, microphone, calendar, call log or SMS — those permissions are not declared at all;
• read or use an advertising identifier, and shows no ads;
• run session recording, heatmaps or screen capture of any kind — the usage analytics described above counts events we chose and named, and nothing else;
• store or transmit your location, or attach it to an analytics event;
• build a profile of you, or make any automated decision about you;
• sell, rent or trade data to anyone.

If any of this changes, it changes here first — see changes to this policy.

• Crowd reports stop affecting what anyone sees after 45 minutes — that is the only window the app reads. An older row is never shown to anyone and holds nothing but a station, a level, a time and a random install ID.
• Crowd reports are deleted after 90 days. This is not a policy we promise to remember: the database rules permit no one to delete a report before 90 days, and permit anyone to delete it after, so expiry is a property of the data rather than of a job that could quietly stop running. A report can never be edited or withdrawn while it still counts.
• The anonymous ID lasts as long as the installation. Uninstalling ends it.
• Push tokens last until you unsubscribe, uninstall, or the platform expires the token.
• Server logs are kept by Google on Google's schedule; we do not query them.
• Website signups are kept until you unsubscribe or ask us to delete them, and in any case no longer than the relaunch announcement needs them.

Under the Data Privacy Act of 2012 you have the right to be informed, and the rights of access, correction, objection, erasure or blocking, damages, data portability, and to complain to the National Privacy Commission.

Email taioappsdevelopment@gmail.com and we will answer within 15 days. Two honest limits on what we can do:

• App data cannot be traced back to you, because we never learn who you are. A crowd report holds a station, a level, a time and a random install ID. Unless you can tell us that ID, we have no way to find "your" rows and no way to verify they are yours — which is a privacy protection, not an evasion. Uninstalling is what ends the association at your end.
• Crowd reports are append-only by design. The database rules permit no edit, and no delete until the report is 90 days old, so an individual report cannot be retracted after it is written. It ages out of every reading within 45 minutes and is deleted entirely at 90 days.

Website signups are different: there we hold an email address, so access, correction and deletion are straightforward. Ask, or use the unsubscribe link in any email.

TrainsPh is a commuting tool for a general audience, not a service directed at children. It collects no personal information from anyone, children included — there is no account, no name and no contact detail to collect. The website form asks for an email address and is intended for adults.

If you believe a child has sent us personal information through the website form, email us and we will delete it.

The first TrainsPh shipped in 2017 and is no longer on the store. It is worth saying what happened to its data rather than quietly dropping the subject.

That version identified devices by ANDROID_ID, which the client supplied and the server could not verify, and it wrote to a database whose nodes — chat, ratings, active users — could be read by anyone who found the URL. Its backend is gone, and every one of those nodes is closed in the current rules rather than carried forward. Nothing from it feeds the new app.

The 2017 app also showed live station CCTV supplied by the Department of Transportation. That access ended with the old app; no video reaches the new one.

The app is being rebuilt, so this policy will change as features land. The version number and effective date at the top of this page move every time it does.

If a change means collecting something new, or using something already collected for a different purpose, we will say so in the app before it takes effect — not only here.

John Nicholai Villegas, TAIO Labs — Philippines
taioappsdevelopment@gmail.com

If you are not satisfied with how we answer, you may bring a complaint to the National Privacy Commission of the Philippines at privacy.gov.ph.

Back to trains.ph