Privacy Policy
London Tube Run Generator - Privacy Policy
Last updated: June 14, 2025
Policy Version: 2.1
1. Who We Are
London Tube Run Generator is a web application that helps users generate random running routes through London's transport network.
Data Controller: Misha Pemberthy
Data Protection Officer: misha.pemberthy at outlook dot com
Contact: misha dot pemberthy at outlook dot com
Service Location: London, United Kingdom
2. What Data We Collect
| Data Type | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Email Address | Account identification and contact | Consent (Art. 6(1)(a)) | Until account deletion |
| Password (hashed) | Account security | Consent (Art. 6(1)(a)) | Until account deletion |
| Run Data | Service provision, progress tracking, and network visualisation | Consent (Art. 6(1)(a)) | Until account deletion |
| Session Data | Authentication and security | Legitimate Interest (Art. 6(1)(f)) | 24 hours or logout |
| IP Address | Security and fraud prevention | Legitimate Interest (Art. 6(1)(f)) | 6 months in audit logs |
3. Data Retention Policy
Automatic Account Deletion: Accounts with no activity for 730 days (2 years) are automatically deleted.
Warning System: We'll send a warning at 700 days of inactivity, giving you 30 days to log in before deletion.
Specific Retention Periods:
- Active Account Data: Until account deletion or 2 years of inactivity
- Run History: Until account deletion
- Session Data: 24 hours or until logout
- Audit Logs: 6 years for legal compliance
- Consent Records: 3 years after withdrawal
4. How We Protect Your Data
- Encryption: All data transmission uses HTTPS/TLS encryption
- Password Security: Passwords hashed using bcrypt with salt rounds
- Access Controls: Strict authentication and authorization
- Data Minimization: We only collect data necessary for service provision
- Regular Audits: Automated monitoring of data access
5. Your Rights Under GDPR
📥 Right of Access (Article 15)
Request a copy of all your personal data. Download your data (while logged in)
✏️ Right to Rectification (Article 16)
Correct or update your personal information in your account settings.
🗑️ Right to Erasure (Article 17)
Delete your account and all associated data permanently.
📤 Right to Data Portability (Article 20)
Export your data in machine-readable formats (JSON, CSV, XML).
🚫 Right to Object (Article 21)
Object to processing based on legitimate interests.
❌ Right to Withdraw Consent (Article 7)
Withdraw consent for data processing at any time.
Response Time: We respond to all data subject requests within 30 days.
Free of Charge: All rights requests are processed free of charge.
6. International Data Transfers
Your data may be processed outside the EU/UK through our hosting provider:
- Provider: Railway.app (United States)
- Safeguards: Standard Contractual Clauses (SCCs)
- Security: SOC 2 Type II certified infrastructure
- Adequacy Decision: No adequacy decision for US transfers
7. Third-Party Services
| Service | Purpose | Data Shared | Legal Basis |
|---|---|---|---|
| Google Maps API | Distance calculation | Station names only | Legitimate Interest |
| MongoDB Atlas | Data storage | All account data | Consent |
| OpenStreetMap | Map tiles for progress visualisation | No personal data shared | Legitimate Interest |
| Mapbox API | Route generation and directions | Coordinates only (no personal data) | Legitimate Interest |
8. Data Breach Notification
In case of a data breach affecting your personal data:
- Authority Notification: We notify relevant supervisory authorities within 72 hours
- User Notification: We inform affected users without undue delay if there's high risk to rights and freedoms
- Breach Details: We provide nature of breach, categories of data affected, and remedial actions
- Contact Information: Contact the Data Protection Officer using the details in section 1 for breach-related queries
9. Cookies and Tracking
Essential Cookies Only: We use only technically necessary cookies:
- Session Cookie: Keeps you logged in (httpOnly, secure)
- Consent Cookie: Remembers your cookie preferences
- No Tracking: We don't use analytics, advertising, or tracking cookies
10. Children's Privacy
Age Requirement: Our service is intended for users 16 years and older.
Parental Consent: Users under 16 require verifiable parental consent.
Special Protection: We provide enhanced data protection for users under 18.
11. Automated Decision Making
No Automated Profiling: We don't use automated decision-making or profiling.
Route Generation: Our route generation is random and doesn't profile users.
12. Legal Basis Summary
Consent (Article 6(1)(a)): Account creation, data processing, run tracking
Legitimate Interest (Article 6(1)(f)): Security, fraud prevention, service improvement
Legal Obligation (Article 6(1)(c)): Audit logs, breach notifications
13. Changes to This Policy
We may update this privacy policy to reflect changes in our practices or legal requirements.
Notification: We'll notify you of significant changes via the app interface or email.
Version Control: Each update includes a new version number and last updated date.
14. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority:
UK: Information Commissioner's Office (ICO) - ico.org.uk
EU: Your local Data Protection Authority
15. Contact Information
Data Controller: Misha Pemberthy
Data Protection Officer: misha.pemberthy at outlook dot com
Privacy Questions: misha.pemberthy at outlook dot com
General Support: misha.pemberthy at outlook dot com
Address: London UK