Privacy Policy | EuropeTrainPics

01Who is responsible

EuropeTrainPics is operated by Tristan Schelkens, a private individual based in Belgium. Tristan is the controller of the personal data processed to run the EuropeTrainPics website, iOS app and connected community bot.

Contact: support@europetrainpics.com. This notice covers our processing, not the independent activities of Apple, Discord or other websites you visit.

This notice explains our practices; accepting the Terms does not give blanket consent to every use of your personal data.

02Information we process

Accounts: username, email, password hash in the account database, account identifiers, role, verification status, preferences and account dates. Optional profile information includes an avatar, biography and location.
Community and archive: uploaded photos or videos, captions, train details, stations, countries, dates, location coordinates where supplied, comments, topics, replies, likes, follows, albums, logbook entries, points and challenges.
Conversations: participants, message content and attachments, replies, reactions, timestamps, delivery/read status, hidden-conversation settings and notification information.
Safety and support: reports, blocking relationships, moderation decisions, correspondence, copyright claims and security events.
Technical data: IP addresses and request information received by our infrastructure, browser/device information, sign-in sessions, local settings and caches, and device tokens for push notifications.
Discord: Discord user/server identifiers, linked account details, verification activity, roles and community actions handled by the bot. Moderation logging can include edited or deleted server messages and their attachments.

Most information comes from you or your use of the service. Other sources include people who message, mention or report you, moderators, Discord when you use its integration, and public sources used for railway news. A photograph submitted by someone else may depict you.

Account credentials and information needed for a requested feature are necessary to provide that feature. Optional profile details are not required. Do not put sensitive information in a profile, report or message unless it is necessary for your request.

03Why we use it

Accounts, uploads and requested features — performance of our agreement: To register and authenticate you; provide your archive, conversations and community interactions; send verification/reset messages; and synchronize the features you use.
Safety, moderation and reliability — legitimate interests: To prevent fraud and misuse, enforce community rules proportionately, investigate reports, diagnose faults and protect users and infrastructure. We balance these interests against your privacy, particularly for minors.
Public attribution and community promotion — legitimate interests: To identify contributors and promote approved public archive photos under the limited licence in the Terms. This does not authorise promotional use of private messages. You can object to the use of your personal data for these purposes.
Optional processing — consent where required: Where a feature requires consent, we must ask separately and explain its purpose. You can withdraw that consent. Device permission for notifications can be disabled in your operating-system settings.
Legal obligations and disputes: To comply with a specific applicable legal requirement or lawful order. Necessary handling of legal claims may instead rely on legitimate interests. A legal obligation is not a general reason to keep everything indefinitely.

Automated text checks can flag or reject prohibited content, and moderators assess submissions and reports. You can request human review of a moderation decision. We explain the process in the Terms.

04Public content and private conversations

Approved archive media, usernames, avatars, public profile information, public comments, topics and associated social activity can be visible to visitors, indexed by search engines and copied by others. Check a feature's audience before sharing. Putting an already-public photo into a private album does not make the original photo private.

Our official social-media accounts may repost approved public archive photos with attribution under the content licence. Those platforms also process information under their own policies. Contact us about attribution or removal.

Private messages are not end-to-end encrypted against the service operator. The service can access message content to operate the feature, investigate reports or incidents, and meet legal requirements. They are not routinely reviewed before delivery. Participants can copy or report messages.

Push notifications can expose a sender or preview on a device's lock screen. You control device notification permissions. Removing a message cannot guarantee removal of a screenshot, a notification already read, or a copy retained by its recipient.

05Recipients and connected services

Access is limited according to the purpose of the processing. Recipients include authorised owners/moderators, infrastructure providers, and people to whom you intentionally publish or send content.

Hosting, database and email providers: Hostinger hosts the website and incoming support email, Neon provides the PostgreSQL database, and Brevo sends outgoing website emails. Each processes information needed for its respective function.
Cloudflare media services: the media integrations use R2 for stored media and Stream for video processing/delivery when those features are enabled.
Apple: supplies iOS distribution and push delivery. Push delivery involves a device token and notification payload.
Discord: operates the connected community platform. Bot verification can associate your Discord identifier with your EuropeTrainPics account. Staff audit channels may receive account identifiers, email addresses and moderation information. Historical logs may also contain account-deletion feedback. Deleting something on the website does not immediately erase independent copies in Discord logs.
Maps and externally loaded assets: OpenStreetMap, OpenRailwayMap, Overpass and iRail supply map or railway information. Font Awesome, unpkg, cdnjs and jsDelivr supply icons or libraries. Loading these resources connects your device to their providers and can reveal your IP address, request information and, for map queries, the area or station requested.
Contact forms: the website's contact-form integration sends submitted form data through FormSubmit to info@europetrainpics.com. Emailing us directly does not use that form provider.
AI-assisted news: where enabled, OpenAI receives submitted news URLs and source information to help prepare railway news. Do not submit a confidential URL as a news tip.
Legal recipients: advisers or authorities where necessary and lawful, for example to respond to a valid order or handle a claim.

Linked platforms may act as independent controllers, not solely as our processors. Visiting an external social-media link subjects that visit to the destination's own practices.

Some providers operate internationally, so information may be processed outside the European Economic Area. Such transfers require a valid legal basis under the GDPR, such as an applicable adequacy decision or contractual safeguards with any necessary additional measures. You can ask us which recipients, countries and safeguards apply to your data and request a copy of applicable safeguards, subject to necessary redactions.

06Cookies, device storage and permissions

The website uses sign-in cookies, including tb_session, and browser storage for account-related state, preferences and caching. The app also keeps local session and feature data. Necessary storage helps deliver the service you request; optional tracking requires separate consent where the law requires it.

Sign-in cookie: tb_session: Set by EuropeTrainPics to authenticate your requests. The configured expiry is 30 days after creation; signing out clears the cookie and invalidates the session.
Local storage: Keys such as tb_active_user_v1, tb_active_role_v1 and tb_active_user_id_v1 display your account state; tb_user_settings_v2 stores preferences. Other keys cache profiles, photos and the archive, including etp_archive_offline_v1. Local storage has no built-in expiry and can remain until the site replaces/removes it or you clear site data.
Session storage: Used for temporary navigation, photo-view state and hidden-notification state. It normally lasts for the browser tab's session, subject to browser session-restoration behaviour.
IndexedDB and service-worker caches: The europetrainpics-photo-cache database and europetrainpics-pwa caches store resources for photo loading and offline behaviour. Cache versions can be replaced on updates; there is no universal fixed expiry for every cached item. Browser storage controls can clear these records.

You can clear browser storage or use device settings to manage app data and permissions. Doing so can sign you out or remove locally stored settings; it is not an account-deletion request. Sign out on shared devices.

Allowing access to selected photos, the camera or notifications enables the corresponding feature. Do not assume uploaded files are anonymous: visible details and file metadata can identify people or locations. Review a file before sharing it.

This notice is not consent to advertising, analytics or newsletters. Any introduction of those activities requires appropriate information and, where required, a separate choice before processing begins.

07Retention and deletion

Retention depends on the record and its purpose, not simply whether you have uninstalled the app. The following explains the relevant criteria and known technical limits.

Account and profile records: Kept while your account is active to provide the service. Account deletion removes the account and related records linked for automatic deletion. Separately stored media are processed through the deletion queue below; other records are subject to their own retention criteria.
Public content and stored media: Approved and pending submissions do not expire solely because of their age. They are retained to provide the archive until removed, the account is deleted, or there is another reason for erasure. Deleting a database record and removing the associated media file are separate steps. Contact us if content remains visible after a deletion request.
Rejected submissions and abandoned videos: Cleanup is scheduled at startup and every six hours to remove rejected submissions more than seven days after moderation (or submission if no moderation date exists) and unsubmitted video uploads older than one day. Associated media are handled separately, including through the deletion queue below. Outages, backlogs and provider errors can delay removal; older orphaned files may require separate handling.
Conversations: Kept to provide conversation history, subject to deletion and legal rights. Hiding or swiping away a conversation only removes it from your conversation list; it does not erase its history. A deleted message can leave a deletion marker and a reply reference.
Verification and security links: Email-verification, password-reset and account-deletion links expire after 15 minutes; two-factor challenges expire after 10 minutes. Expiration prevents use of a code and does not mean its database record is immediately erased.
Expired records and account-deletion feedback: Automated cleanup is scheduled at startup and hourly to remove expired sessions and verification, reset, deletion and two-factor records. Expiry blocks use immediately, while cleanup may be delayed by downtime. The account-deletion flow does not collect identifying feedback or send a new account-deleted Discord log; cleanup also removes historical database deletion feedback.
Media deletion: Removed or replaced submission media, avatars, message attachments and topic images are placed in a deletion queue. Cleanup is scheduled hourly, after a one-hour grace period, in batches of up to 25. It checks whether files are still referenced and retries provider failures. Backlogs and outages can delay deletion. Older orphaned files and independent copies may require separate removal.
Routine bot audit logs: The bot is configured to remove its own unpinned, non-webhook messages from the designated audit channel after 30 days. Pinned records, webhook copies, other channels and provider backups are not covered by this automated process. Permissions, rate limits and backlogs may delay removal.
Reports, other logs and backups: Records outside automated cleanup are retained only for as long as necessary to handle a report, support request, security incident or legal claim. The relevant criteria include whether the matter is resolved, the need to preserve evidence and applicable legal obligations or claim periods. Backup and infrastructure-log retention depends on the provider and service; we do not promise immediate removal from every backup. Contact us for the retention information applicable to your data or to request erasure.
Discord deleted-message cache: The bot's in-memory snapshot cache has a 24-hour limit. A copy posted to a staff audit channel is separate and is not erased by that cache expiry.

Use account settings or the account-deletion instructions, or email us. The self-service flow uses email confirmation. If you cannot access your account, contact us for another proportionate verification method.

Where a lawful exception requires retaining particular information, we must explain the reason and applicable retention criteria. Deletion controls in the interface do not limit your statutory right to request erasure.

08Your rights and how to use them

Depending on the legal conditions, you can request access and a copy, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests and withdraw consent without invalidating processing that was lawful before withdrawal. You also have protections concerning solely automated decisions with legal or similarly significant effects.

Email support@europetrainpics.com with your account identifier and request. Do not send your password. We may ask for proportionate information to verify identity, but you do not need to send an identity document with your initial request.

We must normally respond within one month. A complex request can require up to two additional months, with reasons explained within the first month. Requests are normally free; lawful exceptions apply to manifestly unfounded or excessive requests. If we cannot fulfil a request, we must explain why and how you can challenge the decision.

You can complain to the Belgian Data Protection Authority, or to the competent authority where you live, work or believe an infringement occurred. You do not have to give up judicial remedies or complain to us first.

09Young users and security

You must be at least 13 years old to hold an account, or older where applicable local law requires it. Where parental authorisation is legally required for the agreement or processing, it must also be obtained. This eligibility rule is not a claim that every user's age has been independently verified.

Discord has its own country-specific eligibility rules, which also apply when using the server or bot. An App Store age rating does not replace account eligibility rules.

If you believe a child has registered contrary to these requirements, contact us so we can assess the account and its data. Young users should avoid sharing home addresses, school details, precise routines or private contact information publicly.

Account database passwords are hashed. No online service can guarantee absolute security. Contact us promptly if you suspect account misuse or a data exposure; do not send passwords or confidential evidence to a public channel.

10Updates to this notice

We will update this notice when relevant practices change and identify the revision date. Material changes require appropriate notice through the service or other suitable means. A revised notice alone does not supply consent for a new use that requires it.