Last updated: 2026-09-29
Jarnvagskartan is operated by Johan (private individual in Sweden) who is the data controller for the processing of your personal data.
Contact: [email protected]
Examples of data that may be processed:
When trial protection is enabled and payments are available for your account, we check previous use to limit repeated automatic trials. A check may temporarily pause, deny or revoke the trial. Other valid Pro access, for example through a purchase or an organization, is not affected.
Trial control cases contain an account and trial link, platform, reason, result, timestamps and relevant attempts. When you contact us from a trial control notice, the support case is linked to this information. Authorized administrators can review it and record their decision and comment. Retained Android/cookie history may also show a previous account link while it remains. Raw Android IDs and raw DeviceCheck tokens are not included in support messages, emails or general logs. Contact us through the notice on the Pro/account page or the address above if a check appears incorrect, for example following a change of owner.
The app may use the device's GPS for features such as self-movement tracking and position lookup. Location data (coordinates) is sent to our server to retrieve kilometer position and nearby railway objects.
Location data for pure position lookups is processed in real time. If you actively create or save documents/registrations containing coordinates (e.g. A-skydd), location data may be stored as part of that record.
The mobile apps may also derive approximate geographic information from the GPS position, such as county/region, municipality and country, to select sponsored ads. For this purpose only the approximate information is sent to Jarnvagskartan's ads API; precise GPS coordinates are not shared with advertisers.
Location services are optional and require your explicit consent via the operating system's permission dialogs. You can turn off location services in your device settings at any time.
We process personal data in order to:
The Service's primary backend and data storage are hosted with HostUp AB, a Swedish-owned provider with server infrastructure in Sweden. Backups and replication are stored on our own infrastructure in Sweden. Traffic is proxied through Cloudflare (proxy/CDN/WAF) for security and delivery. This means that traffic to the Service passes through Cloudflare's servers: traffic content is processed in transit, and IP addresses and technical traffic data may be processed in Cloudflare's global infrastructure. Push notifications are delivered via Apple's (APNs) and Google's (FCM) platform services, which may process push tokens and message data outside Sweden.
The Service may display sponsored ads. We do not share personal data (such as name, email or phone number) with advertisers. Ads may be targeted based on placement in the Service, railway line and approximate geography such as county/region or municipality. For logged-in users, ad selection may also take organization or industry into account where such information exists in the account. Ad statistics rely on pseudonymized data (e.g. hashed IP, page/placement, railway line and county/municipality).
We do not track your activities across other apps or websites for personalized ads.
We retain personal data for as long as needed for the purposes above, or for as long as we are required to by law. Session and troubleshooting logs are automatically deleted according to technical retention rules.
Registered push tokens are normally stored for as long as your account is active, or until you log out, unregister the device, disable push delivery for the account, or request account deletion. Invalid tokens may be removed automatically when push delivery fails.
Analytics logs are retained for a limited time (typically 14-365 days depending on log type) and cleaned up continuously.
Usage hashes for Android ID and the mobile cookie are valid for 365 days from recorded use and are then purged. Trial control cases are purged 365 days after creation, along with their automatically attached support context. Recorded approval and information needed to resume a still-valid trial may be retained longer, for example if support has extended the trial.
Apple's DeviceCheck marker has a separate lifecycle. We disregard it when Apple's last update month is at least 13 calendar months in the past. That timestamp is shared by the developer account's two markers and does not give the exact date a trial was used. Local purging does not automatically delete the marker at Apple. Contact us if a marker needs to be reviewed or reset.
You may at any time request deletion of your account and all associated personal data. Deletion can be initiated via the app's profile view or by contacting us at [email protected].
Upon a deletion request, the account and associated personal data are typically anonymized without undue delay. Data that we are legally required to retain may be kept longer.
Account closure removes the trial's control cases, check operations and automatically attached support context. Links from usage hashes to the account and trial are also removed. Hashes may remain without those links until their original 365-day expiry to prevent repeated trials through account deletion and recreation. Account closure does not automatically reset Apple's marker or the mobile browser cookie.
Under the GDPR you have the right to, among other things, access your data, have incorrect data corrected, have data deleted and receive your data in a machine-readable format (data portability). Contact us via email to exercise your rights.
The Service is not intended for persons under 18. We do not knowingly collect personal data from persons under 18. If we become aware of such processing, we anonymize or delete the data without undue delay.
We may use technically necessary cookies for authentication, session management and security.
When trial protection is used during sign-in in a phone browser, we may set the jvk_trial cookie with a random identifier. It is used for trial checks, lasts up to 365 days and remains after logout. It is separate from the sign-in cookie and is not used for advertising or statistics. The server stores a hash of the identifier. You can delete the cookie in your browser settings; we do not recreate it from other local storage.
On public web pages we show a statistics banner where you can choose whether we may collect usage statistics. If you reject, that choice is stored for 7 days.
Logged-in users can enable or disable behavior analytics at any time in account settings under Default Values.
Push notifications are controlled separately through operating system permissions and through an account setting in the app/web. If you disable push delivery, we will no longer attempt to send push notifications to registered devices for your account.
If you are logged out, you can reopen statistics settings via this link.
In the Apple App Store and Google Play Data Safety we declare the following data types that may be collected:
Full declaration is available on the app's page in the App Store and Google Play.
If you believe that we are processing your data incorrectly, you may file a complaint with the Swedish Authority for Privacy Protection (IMY).
This policy is governed by Swedish law and the GDPR.