Last updated: June 14, 2025
Policy Version: 2.1
London Tube Run Generator is a web application that helps users generate random running routes through London's transport network.
Data Controller: Misha Pemberthy
Data Protection Officer: misha.pemberthy at outlook dot com
Contact: misha dot pemberthy at outlook dot com
Service Location: London, United Kingdom
| Data Type | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Email Address | Account identification and contact | Consent (Art. 6(1)(a)) | Until account deletion |
| Password (hashed) | Account security | Consent (Art. 6(1)(a)) | Until account deletion |
| Run Data | Service provision, progress tracking, and network visualisation | Consent (Art. 6(1)(a)) | Until account deletion |
| Session Data | Authentication and security | Legitimate Interest (Art. 6(1)(f)) | 24 hours or logout |
| IP Address | Security and fraud prevention | Legitimate Interest (Art. 6(1)(f)) | 6 months in audit logs |
Automatic Account Deletion: Accounts with no activity for 730 days (2 years) are automatically deleted.
Warning System: We'll send a warning at 700 days of inactivity, giving you 30 days to log in before deletion.
Request a copy of all your personal data. Download your data
Correct or update your personal information in your account settings.
Delete your account and all associated data permanently.
Export your data in machine-readable formats (JSON, CSV, XML).
Object to processing based on legitimate interests.
Withdraw consent for data processing at any time.
Response Time: We respond to all data subject requests within 30 days.
Free of Charge: All rights requests are processed free of charge.
Your data may be processed outside the EU/UK through our hosting provider:
| Service | Purpose | Data Shared | Legal Basis |
|---|---|---|---|
| Google Maps API | Distance calculation | Station names only | Legitimate Interest |
| MongoDB Atlas | Data storage | All account data | Consent |
| OpenStreetMap | Map tiles for progress visualisation | No personal data shared | Legitimate Interest |
| Mapbox API | Route generation and directions | Coordinates only (no personal data) | Legitimate Interest |
In case of a data breach affecting your personal data:
Essential Cookies Only: We use only technically necessary cookies:
Age Requirement: Our service is intended for users 16 years and older.
Parental Consent: Users under 16 require verifiable parental consent.
Special Protection: We provide enhanced data protection for users under 18.
No Automated Profiling: We don't use automated decision-making or profiling.
Route Generation: Our route generation is random and doesn't profile users.
Consent (Article 6(1)(a)): Account creation, data processing, run tracking
Legitimate Interest (Article 6(1)(f)): Security, fraud prevention, service improvement
Legal Obligation (Article 6(1)(c)): Audit logs, breach notifications
We may update this privacy policy to reflect changes in our practices or legal requirements.
Notification: We'll notify you of significant changes via the app interface or email.
Version Control: Each update includes a new version number and last updated date.
You have the right to lodge a complaint with a supervisory authority:
UK: Information Commissioner's Office (ICO) - ico.org.uk
EU: Your local Data Protection Authority
Data Controller: Misha Pemberthy
Data Protection Officer: misha.pemberthy at outlook dot com
Privacy Questions: misha.pemberthy at outlook dot com
General Support: misha.pemberthy at outlook dot com
Address: London UK