Privacy Policy

Last updated 10 October 2026

This policy explains what Before the Board (the app and the website at beforetheboard.com) does with information about you. The short version: there are no accounts, no advertising and no cross-site tracking. The app uses an anonymous identifier, and we keep only what is needed to remember your purchase and send you platform alerts.

1. Who we are

Before the Board is a trading name of Computer Things Ltd, a company registered in England and Wales under company number 16488652, with its registered office at Flat 6, 136 Shoreditch High Street, London E1 6JE (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us at mail@beforetheboard.com.

2. What we collect, and why

In the app

• An anonymous app identifier. When you first open the app, a random identifier is generated and stored on your device. It contains no personal details and is not linked to your name, email address or booking. We use it to recognise your purchase and to link the departures you watch to your device. Basis: performance of our contract with you.
• Purchase and entitlement information. Purchases are made through the Apple App Store or Google Play, which handle your payment details; we never see them. Through our subscription provider we receive a record of what you bought and whether it is active (product, purchase and expiry dates, store identifiers) so the app can unlock the features you paid for. Basis: performance of our contract.
• Watched departures and notification tokens. When you watch a train, we store the departure you chose together with the push-notification token and Live Activity token your device gives us, so that we can send you alerts about that train. Push notifications are only sent if you allow them in your device settings. Basis: performance of our contract; consent for notifications, managed through your device.
• Device platform and app version (for example, “iOS, version 1.2”), to make alerts work correctly and to help with support. Basis: legitimate interests.

On our servers

• Technical logs. Like most services, our servers record each request (IP address, time, the page or endpoint requested, and a status code) for security and troubleshooting. Logs are kept for up to 30 days. Basis: legitimate interests in keeping the service secure and working.
• Daily usage counts. When the app loads a departure board, our server notes that the app was used that day and whether it was used by a subscriber. It stores a one-way hash of your anonymous identifier rather than the identifier itself, only so that each device is counted once per day. We only ever look at the totals (how many people used the app on a given day), never at individual devices. Basis: legitimate interests in understanding how the app is used.

On the website

The website sets no cookies and loads nothing from third parties (its fonts are served by us). Besides the technical logs above, it counts visits with GoatCounter, an open-source analytics tool that we run on our own server, so the data goes to no one else. For each page view it records the page, the referring site, the browser, operating system, screen size and the country (derived from your IP address, which is then discarded). To avoid counting a reload twice, it keeps a temporary identifier derived from your IP address and browser, which cannot be turned back into either and is discarded after eight hours. It does not identify you, build a profile or follow you to other sites, and the results are only ever looked at as totals. Basis: legitimate interests in understanding how the website is used.

3. What we do not do

• We do not ask for or store your name, email address, phone number or Eurostar booking details.
• We do not sell or rent personal data, and we do not use it for advertising.
• We do not track you across other apps or websites.

4. Who we share data with

We use a small number of service providers who process data on our behalf, under contracts that protect it:

• Apple and Google — process your purchases under their own terms and privacy policies, and deliver push notifications to your device.
• RevenueCat, Inc. (United States) — manages in-app purchases and entitlements. RevenueCat receives the anonymous identifier and purchase information. Transfers to the United States are protected by the EU–US Data Privacy Framework and/or standard contractual clauses (including the UK addendum), as applicable.
• Hetzner Online GmbH (Germany) — hosts our servers.
• Google Cloud (Google Ireland Limited) — holds encrypted nightly backups of our database, retained for 30 days.

We may also disclose data where the law requires it, or to protect our rights, our users or the public.

5. How long we keep data

• Watched departures and notification tokens: deleted within 30 days after the train has departed, or sooner when you stop watching it.
• Entitlement records: for as long as your pass or subscription is valid, and up to 12 months afterwards for support and accounting.
• Technical logs: up to 30 days.
• Daily usage counts: up to 13 months.
• Website visit counts: kept as aggregate statistics; the temporary visit identifier is discarded after eight hours.
• Backups: overwritten on a rolling 30-day cycle.

The anonymous identifier lives on your device. Deleting the app removes the app’s data; on iOS the identifier may persist in the device keychain until the device is reset.

6. Your rights

Under the UK GDPR and the EU GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Because we hold no name or contact details, we can only find your data by your anonymous app identifier; please include it in any request (you can find it in the app under “Data sources & licences”, shown as your anonymous app identifier). Write to mail@beforetheboard.com and we will respond within one month.

You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority of the country where you live.

7. Children

Before the Board is not directed at children under 16 and we do not knowingly collect data from them.

8. Security

All connections use TLS. Our services are reachable only through our web server, data is kept to the minimum described above, and access to servers is restricted to the operator.

9. Changes to this policy

If we change this policy we will publish the new version here with a new “last updated” date. Significant changes will also be noted in the app.

10. Contact

Computer Things Ltd (company no. 16488652), Flat 6, 136 Shoreditch High Street, London E1 6JE, United Kingdom — mail@beforetheboard.com