Privacy Policy

This policy explains what Foxx Cyber LLC, which operates RailCompliant ("we," "us"), collects when you use RailCompliant, why we collect it, and what control you have over it. It covers our website and the RailCompliant application.

1. Three roles: our customers, their people, and free accounts

Most personal information in RailCompliant is entered by our customers about their people — crew members, volunteers, and contract inspectors. For that information the railroad is the controller and decides what to collect and why; we are its processor and act on its instructions, under our Data Processing Agreement. If you are a crew member or volunteer and want to see, correct, or delete what is held about you, contact your railroad first. We will help them respond, and you can always reach us at [email protected].

For account holders and website visitors, we are the controller, and the rest of this policy describes what we do.

The third is a free crew account. For the account itself we decide what is collected: your profile, your certifications and their documents, the past service and career log you enter or import, your railfan journey with its photos, and your regulation watch and email settings. So we are the controller for that data, and a railroad sees a certification you keep there only while you share it with that railroad. A railroad's records about you (your hours, runs and inspections there) stay the railroad's, as above, and appear on your My Career page only while you are a member of it.

2. What we collect

Category	What it includes	Why
Account	Name, work email, hashed password, organization name and role	To create your account, authenticate you, and apply permissions
Crew account (free)	Your name, email and hashed password, and what you add to My Career: certifications with their numbers, dates and documents (photos and PDFs; photos are re-encoded, which removes their location and camera data), past service and a log of your shifts and trips that you enter or import, a short profile, and, if you keep one, your railfan journey: the rides and visits you log and up to 100 photos, stored at web size with their location and camera data removed. A spreadsheet you import is read for its rows and held for at most two hours until you import or drop it; we keep the rows you import and the file's name, not the file. If you ask a railroad to verify your history, that railroad sees only the entries you send it, and keeps a record of what it verified. When you leave a railroad, we keep a record that you were a member, only so you can ask that railroad to verify your history later; closing your account removes it	To keep your records for you and remind you before a certification expires. We use your email only for your account (confirming it, reminders, password resets), never marketing
Regulation watch and blog emails	The parts of 49 CFR you follow, whether you want FRA safety advisories, and whether you asked for an email when the blog has a new post	To send the emails you asked for. Each one has a link that unsubscribes you without signing in
Customer Data	Locomotive, inspection, maintenance, parts, and labor records you enter — including the crew and volunteer names, roles, qualifications, and hours you choose to record	To provide the Service you are paying for
Billing	Subscription status, plan, billing contact, and a payment-processor customer reference. We never receive or store full card numbers	To bill your subscription and support billing questions
Technical	IP address, browser user agent, timestamps, pages requested, and error diagnostics	Security, abuse and fraud prevention, rate limiting, and debugging
Site and Service usage	The pages you view and the links you click on our public site, the site that referred you, and any campaign tags in the link you followed; in the Service, which kinds of page each railroad's members open (for example "a locomotive's page", never which locomotive). Counted against a code that changes every day, never your IP address or a cookie	To see how people find us and which parts of the Service are used, so we can improve them
Support	Tickets, messages, and any attachments you send us	To answer you and to keep a record of the issue

Comments you leave on our blog are public: each one shows the name on your account, never your email address or your railroad. You can delete your own comments at any time, and we may hide or remove a comment.

Accounts are for people 13 and older. If we learn that an account belongs to someone younger, we delete it. Starting a railroad needs someone 18 or older. The account forms and Start a railroad ask for your month and year of birth; we keep only the time you told us you were 18 or older, never the birth date. Railroads that record hours for volunteers under 18 should collect no more than they need and should have parental consent where their own law requires it.

3. Cookies

We set three cookies, and all three are strictly necessary: one keeps you signed in, and two protect the account forms from abuse. Each is HttpOnly (scripts on the page can't read it), sent only to our own site, and marked Secure in production. We do not use advertising cookies, analytics cookies, or third-party trackers, so there is no tracking to opt out of and no consent banner to click.

Cookie	What it does	How long it lasts
__Host-rh_session	Keeps you signed in. It holds a random token; we keep only a hash of it.	Until you sign out, or 30 days; it ends sooner if the account goes unused for 14 days
__Host-rh_dev	Set when you open the sign-up or free account form. It holds a random number and our signature over it, nothing about you or your device. It lets us limit automated sign-ups per browser instead of per network, so a group signing up together on one wifi isn't turned away. That is all it is used for: it is not linked to your account, not kept in our database, and not used for tracking or analytics.	1 year
rc_join	Set only if an account form can't create an account for you. It remembers that, so the form isn't simply tried again. It holds only its expiry time, nothing about you.	1 day

We count page views and clicks on our own servers without any cookie; see section 4. Your browser also remembers your light or dark theme and which sidebar sections you folded, in its own storage on your device; those choices are never sent to us.

4. How we use information

To provide, secure, and support the Service; to process payments; to send transactional email such as password resets, invitations, compliance-deadline notifications, and service notices; to detect and prevent abuse; to meet our own legal obligations; and to understand how the site and the Service are used so we can improve them.

For that last purpose we count page views and clicks ourselves, with no third-party analytics. Instead of your IP address we keep a one-way code made from your address and browser with a random value that we replace every day and then delete, so a visit can be counted but you cannot be recognized from one day to the next, even by us. In the Service we count which kinds of page each railroad's members use, by railroad, not by person and never by record. These counts stay with Foxx Cyber; anything we share or publish is aggregated so that it does not identify you, your railroad, or any individual. We do not use Customer Data to train machine-learning models, and we do not sell or share personal information for cross-context behavioral advertising.

We send marketing email only to people who ask for it, and every such message has an unsubscribe link. The regulation watch digest and new-post emails go only to people who chose them, and each one unsubscribes in one click. Transactional email about your own account is not marketing and continues while your account is open.

5. Who we share it with

We share personal information only with service providers who process it on our behalf under contract, and only as needed to run the Service:

Provider	Purpose
Railway	Application hosting, managed database, and file storage (United States)
Cloudflare	Network delivery, TLS, and denial-of-service protection
Stripe, Inc.	Subscription billing and payment processing
Resend	Transactional email delivery

We may also disclose information if legally required — in response to a valid subpoena, court order, or lawful government request — or to protect our rights, users, or the public. Where we are permitted to, we will tell you first. If we are ever part of a merger, acquisition, or sale of assets, information may transfer with the business, and this policy continues to apply until replaced with notice to you.

6. Where data is stored

The Service is hosted in the United States, and Customer Data is stored there. If you access the Service from outside the United States, you are sending information to the United States, where privacy law differs from your own.

7. How long we keep it

We keep Customer Data for as long as your account is open. After termination you may request an export within 30 days, after which we may delete Customer Data from active systems; residual copies in routine backups age out on our normal backup cycle. We keep billing and tax records for as long as the law requires, security logs for a limited period for abuse investigation, and page-view and click counts for 400 days.

We keep a free crew account until you close it: Delete my account on your profile, or ask us at [email protected]. Closing it deletes your profile, certifications, their documents, your past service and career log, your imports, your journey with its photos, your comments, and your regulation watch and email settings. If our audit records name the account, we keep its row with the name and email removed and sign-in disabled.

Note that some records in the Service are deliberately immutable: the audit trail is hash-chained so that entries cannot be silently altered, which is the tamper-evidence the product exists to provide. Corrections are recorded as new entries rather than edits to old ones. Deleting an account removes the data; amending a single historical audit entry in place is not something the design allows.

8. Security

Each railroad's records are held in a separate, logically isolated database schema, and every query is scoped to the schema of the authenticated session. Traffic is encrypted with TLS in transit. Passwords are stored using argon2id; session tokens are stored only as hashes. Uploaded images are re-encoded to strip embedded metadata and served through an authenticated, same-origin proxy. Third-party secrets are encrypted at rest with authenticated encryption. Access to production is limited to people who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as applicable law requires, without undue delay.

9. Your rights

Depending on where you live — including under the Colorado Privacy Act and similar U.S. state laws, and under the GDPR or UK GDPR if you are in Europe — you may have the right to access a copy of your personal information, correct it, delete it, obtain it in a portable format, opt out of sale or targeted advertising (we do neither), limit the use of sensitive information, and appeal a decision we make about a request. We do not use your information for automated decisions that produce legal or similarly significant effects.

To exercise a right, write to [email protected]. We will verify your identity through your account and respond within the time your law allows — generally 45 days, extendable once where permitted. You will not be charged or receive a worse service for asking. If you are unsatisfied with our response, you may appeal by replying to our decision, and you may complain to your state attorney general or supervisory authority.

Where we process personal information about people in Europe, we rely on our legitimate interest in operating the Service, on the necessity of processing to perform our contract with the customer, and on consent where the law requires it.

10. Changes to this policy

We will post any update here with a new effective date, and for material changes we will notify account holders by email or in the Service before the change takes effect.

11. Contact

RailCompliant — A product of Foxx Cyber LLC
[email protected]

See also our Terms of Service.