Privacy

Seatwise tells you which side of the train to sit on. You can use it without an account. We collect as little as we can, we never sell data, and there are no advertising or tracking tools in the app or on the website.

If you sign in and share window photos, other travellers see those photos — never your name or e-mail address.

Mathis Erler, Dorfstrasse 4, 3999 Oberwald, Switzerland. Contact: select@seatwise.ch.

This policy follows the Swiss Federal Act on Data Protection (FADP) and, for users in the EU/EEA and the UK, the GDPR.

Searches: the stations and times you search for (or the trip link you paste or share from the SBB app) are sent through our server to the Swiss timetable service (opentransportdata.swiss) to find your trains. Your IP address is not passed on. If you share an SBB short link, our server opens it at SBB to read the trip.

Abuse protection: our server counts requests per device for about 10 minutes, then forgets them. It does not keep your IP address — only a scrambled code that changes every day.

Maps: map images are loaded directly from swisstopo (the Swiss Federal Office of Topography), which sees your IP address like any website does.

Sight cards and reminder pictures: their photos are loaded directly from Wikimedia Commons, which sees your IP address. The texts come with the app; links to Wikipedia open in your browser.

Location: when you choose “Follow live” or take a window photo, the app uses your device's location. While following live, your position stays on your device and is not sent to us.

Reminders before highlights are scheduled on your device only; nothing about them is sent to us.

Diagnostics: when something goes wrong (and for a few key events), the app sends a short technical note to our server: app version, device or browser type and system version, what happened and error details (for example the kind of trip link, never its content, stations or times). These notes contain no name, account or location, and are deleted after 90 days. You can turn them off under Preferences → Send diagnostics; nothing is sent before your choice is read.

On your device or in your browser only (local storage, no cookies): your preferences, last searches, saved journeys and the trip you have open, scheduled reminders, photos still waiting to upload, unsent problem reports, the people whose photos you chose to hide, your diagnostics choice and, when signed in, your sign-in session. Removing the app or clearing the site's data deletes them.

Web version: the website (seatwise.ch) is delivered by Cloudflare, which sees your IP address like any web host does (including technical reports about failed connections).

You need an account only to share window photos, like photos, keep saved journeys on all your devices, or redeem a code.

Signing in with Google gives us your name, e-mail address, profile picture link and a Google account ID.

Signing in by e-mail: we store your e-mail address and send sign-in links to it (from thinkabout@seatwise.ch, through our mail provider Proton). We send nothing else to it. An account created by e-mail must save a passkey within an hour; otherwise it is deleted automatically, with everything in it.

Passkeys: your phone or browser keeps the secret key — we only store its public part, a name such as "Android phone", and when it was added and last used. You can remove a passkey under Account → Passkeys.

Saved journeys: when you are signed in, the journeys you star (their trains, stations and times) are kept with your account so all your devices show them. Each one is deleted from your account a day after the journey ends (also when you removed the star earlier).

Codes and membership: if you redeem a code, we store which code and when, and your membership (Free, Pro, Tester) with its end date.

Terms and age: before you first share a photo, we store that you accepted the terms of use (which version, when) and confirmed you are 18 or older.

For security, our provider Supabase logs sign-ins and requests with IP address and device or browser type, and keeps these logs for a short time (days).

When you take a window photo we store: the photo and smaller copies, the time, the place (GPS), the direction the camera pointed, the side you chose, the train, your device model and system version, and a 30-second record of the phone's motion and compass sensors. We use these to check that the photo really shows the view from that side of that train.

Private by default. Sharing is for people aged 18 or older. If you share a photo, other travellers can see the photo, the day it was taken, its place on the railway line (if it could not be matched to the line: its position rounded to about 100 m) and which side it shows — never your name, e-mail address, exact GPS position or device. The photo's file address contains a random account number, and the app can tell which shared photos come from the same person (so that you can hide someone's photos); neither reveals who you are. Before a photo is shared, the hidden camera data inside the file (EXIF) is removed.

Shared photos must follow the photo rules in the terms of use. Anyone can report a photo; it is then hidden at once until we have checked it. For a report we store the reason, the optional note and, if the reporter is signed in, their account.

Likes: we store which photos you liked.

If you have a tester code, you can report a problem from inside the app. A report holds: your description and any text you selected; a screenshot with your pen marks, if you include it (it can show your position on a map, your photos or your trip); app version, device type, system version and screen size; the screen you were on and its state (for example the trip's stations and times); and the app's last 30 technical events.

A report is linked to your account. Only you (in the app, under Account → My reports) and the Seatwise team see it, and we use it only to fix problems.

We use an AI coding assistant to help fix problems. It never receives names or e-mail addresses: reports are shown to it only under a random code instead of your account, names and e-mail addresses are hidden in screenshots while they are taken, and our tools remove them from anything else it reads.

To provide what you ask for (an account, saved journeys, shared photos, reminders, reports): the contract with you (GDPR Art. 6(1)(b)).

Diagnostics, abuse protection and checking reported photos: our legitimate interest in a working, safe service (Art. 6(1)(f)). You can object at any time — diagnostics with the switch in Preferences.

Location, camera and sharing a photo: your choice, which you can take back at any time (stop sharing, or remove the permission in the phone's settings) (Art. 6(1)(a)).

Supabase (database, file storage and sign-in): data stored in the European Union (Ireland), on our behalf under a data processing agreement; its US parent company is bound by the EU standard contractual clauses, also recognised in Switzerland.

Cloudflare (website delivery, worldwide network; USA) and Google (sign-in with Google; USA): both certified under the Swiss-US and EU-US Data Privacy Framework.

Proton AG (sign-in e-mails; Switzerland). opentransportdata.swiss and SBB (timetable searches and short links; Switzerland) receive the trip details, not your IP address.

swisstopo (maps; Switzerland) and the Wikimedia Foundation (pictures; USA) receive your IP address when your device loads their images directly; the USA has no general adequacy decision, so this happens only to show you the pictures you open.

We never sell or rent data and give it to no one else, unless the law obliges us to.

Everything travels encrypted (HTTPS). In the database, each user can only read and change their own data (row-level security); photos and reports sit in private storage and are shown only through short-lived links. The keys that can see everything are never part of the app or the website, and only the operator has administrator access.

Account data, photos, likes, codes and membership: until you delete them or your account. E-mail accounts without a passkey: one hour. Saved journeys: until a day after the journey ends. Diagnostic notes: 90 days. Abuse-protection counts: about 10 minutes. Photo reports: as long as the photo exists. Problem reports and their screenshots: until 180 days after the report is closed, or until your account is deleted. These periods are enforced automatically on our server.

You can ask us at any time what we store about you and receive a copy, have it corrected or deleted, restrict or object to its use, and take back any choice you made. You can delete your account yourself at any time under Account → Delete account (steps: seatwise.ch/delete-account). Otherwise write to select@seatwise.ch; we answer within 30 days, free of charge.

You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU/EEA or the UK, to your local data protection authority.

Anyone may use Seatwise. Sharing photos is for people aged 18 or older, which you confirm before your first shared photo. Seatwise is not designed for children.

This policy is dated 27 October 2026. If we change what we collect, we update this page and say so in the app.