Privacy policy

TrainWatcher (“we”) operates train-watcher.com, a service that monitors Eurostar Snap ticket availability and sends alerts. This policy explains what personal data we process, why, and your rights. We deliberately keep it minimal: we never resell your data, and the only third-party measurement we load — Google Ads — waits for your explicit consent.

1. Data we collect

• Account: email address, first name (optional), password (stored only as a bcrypt hash), phone number if you choose to enable SMS alerts, and your language preference. If you sign in with Google: your email address, first name and the technical identifier Google provides — never your Google password.
• Alerts: the routes, dates and slots you choose to monitor, and the history of alerts we have sent you.
• Technical data: standard server logs (IP addresses, timestamps) needed for security and to keep the service running.

2. Cookies and measurement

We never store your card details (payments are handled by Stripe, and bookings happen on Eurostar's official website). Your session is kept locally in your browser.

With your explicit consent only, we load Google Ads measurement tags (ID AW-474224770) to understand which advertising campaigns bring new travellers to TrainWatcher. Until you accept the cookie banner, no advertising cookie is stored (Google Consent Mode is set to “denied” by default). You can decline, and change your mind at any time by clearing your browser storage for this site. See Google's privacy policy. When you sign in with Google, Google may also set its own cookies.

We also record, when you create your account, the campaign parameters (UTM) and the referring site that brought you to us — attribution data used solely to measure our own acquisition, never resold.

3. Purposes and legal basis

We use your data solely to run the service: creating and securing your account, monitoring the routes you asked for and sending the corresponding alerts by email and, if enabled, SMS (performance of a contract), and keeping the platform secure (legitimate interest). No marketing without your explicit consent.

4. Retention

We keep your data for as long as your account is active. Alerts whose date has passed and technical logs are purged regularly. When you delete your account, your personal data is erased.

5. Recipients and hosting

Your data is never sold or shared for commercial purposes. It is processed by our technical providers strictly to run the service: Google Cloud (database, European Union), Railway (API), Vercel (website), Resend (email delivery), Twilio (SMS delivery), Stripe (payments) and, subject to your consent, Google Ads (advertising measurement). Some providers may process data outside the European Union; such transfers are covered by appropriate safeguards (standard contractual clauses).

6. Your rights

Under the GDPR you have rights of access, rectification, erasure, portability and objection regarding your data. You can delete your alerts at any time from your dashboard. For any request (including account deletion): [email protected]. You may also lodge a complaint with your national data protection authority (in France, the CNIL).

7. Changes

We may update this policy; the date at the top of the page applies. If a change is significant, we will let you know by email.