Privacy policy

Last updated: October 2026

This policy explains which personal data is processed when you use this website, for what purpose, and which rights you have.

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

2. Hosting and server logs

This website runs on a server rented from Hostinger International Ltd.. Each time you open a page, the server processes the technical data needed to deliver it: your IP address, the date and time of the request, the page requested, the HTTP status code and your browser identification (user agent).

This is necessary to display the website and to keep it stable and secure, for example to limit abusive request rates. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating the website securely). Log files are overwritten automatically once they reach a fixed size limit; they are not combined with other data or used to identify visitors.

The hosting provider processes this data on our behalf under a data processing agreement (Art. 28 GDPR).

3. Necessary cookies and local storage

Without your consent, this website only stores what is strictly necessary for a feature you actively use:

• Your choice in the cookie banner is saved in your browser’s local storage (sbahn_analytics_consent), so the banner doesn’t appear on every page.
• If you sign in to manage email alerts, a session cookie (sbahn_session) keeps you signed in for up to 30 days. It contains no tracking identifiers and is removed when you sign out.

The legal basis is § 25(2) no. 2 TDDDG; any related processing of personal data is based on Art. 6(1)(f) GDPR.

4. Web analytics (only with your consent)

If you click “Accept” in the cookie banner, we use Google Analytics for Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how the website is used — for example which pages are viewed, which stations are searched for and how often calendar feeds are exported. Without your consent, the analytics script is not loaded at all.

Google sets cookies (_ga, _ga_*) and stores an installation identifier in your browser, and processes information about your device and browser, the pages you view, your interactions and an approximate location derived from your IP address. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU–U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

The legal basis is your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time, with effect for the future, via “Privacy settings” at the bottom of every page; the analytics cookies are then deleted. The cookies expire after at most two years, and Google retains the collected data for at most 14 months.

Privacy settings · Google privacy policy · Firebase privacy information

5. Email alerts and sign-in links

If you subscribe to email alerts, we store your email address, the stations, lines and date range you selected, and when you subscribed, confirmed or unsubscribed. Alerts are only sent after you confirm your address via the link in the confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR).

Every alert email contains a link to unsubscribe immediately. After you unsubscribe, no further emails are sent; the subscription record is kept, marked as unsubscribed. If you want your email address deleted completely, write to the email address above.

To manage your alerts, you can request a one-time sign-in link by email. It is valid for 30 minutes; expired links are deleted automatically.

6. Donations via PayPal

The homepage links to PayPal so you can help cover the running costs. No data is sent to PayPal unless you click that link; from then on, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg is responsible for the processing. PayPal privacy statement

7. Your rights

You have the right to access your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time (Art. 7(3)). To exercise these rights, write to the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).