Privacy
What is stored
Slow Train has no accounts and sets no cookies. Your passport (the stations you have visited, your streak, and your sound preference) is saved in your browser’s local storage on your own device. It never leaves your device, and you can clear it from your browser settings at any time.
Live rider count
The “riders on board” number comes from a WebSocket connection to our server. The server only counts how many connections are open at the moment. It stores no identifier, no cookie and no history, and the count disappears when you close the page.
When you board the train for the first time on a given day, your browser tells the server so once. The server only adds one to anonymous totals (boardings per day, all-time boardings and the peak number of riders on board at once). It does not record who you are.
Messages between riders
Riders can send each other a small set of ready-made reactions and phrases. There is no free text. The server checks that the message is one of the presets, relays it live to the other riders and forgets it: nothing is stored, and no name or identifier is attached. A limit of one message every 15 seconds per rider keeps the train calm, and you can hide other riders’ messages at any time.
Your passport and backup code
Your stamps, streak and title are stored only in your own browser (local storage). The optional backup code lets you restore them on another device; it is generated on your device and we never receive or store it. Clearing your browser data removes the passport unless you saved the code.
Linking a screen (QR code)
To move your passport to a TV or another phone, the receiving screen shows a QR code with a random code and a random key. Your phone encrypts the passport in the browser with that key and sends it to a temporary relay on our server. The key only lives inside the QR code (in the part of the link that browsers never send to servers), so we cannot read what passes through. The relay hands the data over once and deletes it, or deletes it automatically after 5 minutes. Nothing is tied to your name, and no account is created.
Analytics and advertising
At the moment the site uses no analytics and shows no advertising. If advertising is added in the future, this page will be updated first, and visitors in the EEA, the UK and Switzerland will be asked for consent through a certified consent banner before any personalised ads are shown.
Abuse protection
To stop one machine from faking a crowd, the server briefly counts how many live connections come from the same network address. This is held in memory only while the connection is open and is never written to storage or logs by us.
Time check
When you open the site, your browser asks the server for the current time so that a wrong clock on your device cannot move the train or stamp your passport on the wrong day. Nothing is recorded.
Hosting
The site is served by a static hosting provider, which may keep standard server logs (such as IP address and time of request) for security and operations. We do not combine these logs with anything else.
Contact
Contact details for the site operator will be published here before the public launch.