Privacy Policy

1. Who is responsible

RailRoute is operated by Dhruv Shah, India (contact by email at hello@railroute.in). For anything in this policy, write to hello@railroute.in.

2. What we collect

Search inputs

The stations, travel date, quota and class you enter, and the searches those inputs generate. This is what the Service needs in order to answer your question.

Account information, if you create an account

Searching does not require an account. Creating one lets your recent searches follow you between devices, and is the only reason we hold any of the following.

• If you sign up with an email address and password: your email address, the name you choose to give (optional), and your password. The password is stored only as a bcrypt hash — a one-way transformation. We never store, log or display the password itself, and we cannot recover it or tell you what it is.
• If you sign in with Google: your email address, your name and your profile picture, as supplied by Google. We ask Google for nothing else — no Gmail, no contacts, no Drive — and no password is involved or stored.
• Your saved searches: the stations, date and quota of your recent searches, held on our servers and linked to your account. Only the inputs are stored. Timetable and availability results are not kept against your account.

Technical information

Standard request information such as IP address, browser type, device type, referring page, and timestamps, together with error and performance logs. This is used to keep the Service running, to debug it, and to protect it from abuse.

Notification subscriptions, if you turn notifications on

If you ask us to notify you when a berth opens, your browser issues a push subscription and we store it against your account: an address supplied by your browser vendor’s push service, the two encryption keys that let only your device read what we send, and your browser’s user-agent string so you can tell one of your devices from another. One record per device you switch notifications on from. We never receive your phone number or device identifier, and we cannot read anything from your device through it — a push subscription only lets us send.

Travel contacts shared through our invite-only importer

We run a password-protected, invite-only page where people we know can share the travel businesses in their Google Contacts: hotels, homestays, cab drivers, bike and car rentals, and tour operators. When you connect Google Contacts there, Google gives the page read-only access to your contacts. Your browser reads the address book, picks out the travel businesses and then removes RailRoute’s access straight away. The rest of your address book is never sent to our servers, and we never store your Google access token. You review the list it found, and we receive only the contacts you leave ticked: the business’s name, phone numbers, email, organisation, a category and its town. To find a contact’s town, we may send its name (never its phone number or email) to Google Maps. These records are marked unverified and are used only to build and check RailRoute’s information about places to stay and ways to get around. We do not message them. Sharing a contact does not mean that business has agreed to be contacted. Our use of data from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Aggregate usage information

Anonymous or aggregated measurements of which pages and features are used, collected through a third-party web analytics provider. These measurements are not used to build a profile of you as an individual.

Searches and what they returned

Whether or not you have an account, we record each search you run — the two stations, the date and the quota — together with what we showed you for it: how many trains came back, what their seat availability said, and whether we found a way to book a confirmed ticket. The purpose is to check the thing this site claims to do. Without it we cannot tell a search that produced a useful answer from one that produced a screen of nonsense.

These records carry no name, no email address, no IP address and no device fingerprint. They are grouped by a random identifier that is created in your browser and deleted the moment you close the tab, so the searches of one sitting can be read together and cannot be connected to you, to another visit, or to another device. If you are signed in, the record notes that a signed-in person made the search and links it to your account so that deleting your account also removes that link. These records are deleted after 90 days.

Session recordings

We use PostHog to record some visits as a replay of what appeared on screen: the pages you opened, clicks, scrolls, and the layout as it was shown. The purpose is to see where the product is confusing — for example a search that led nowhere, or a filter that hid every result — so we can fix it. It is not used to advertise to you, and it is not sold.

Anything you type into a form (stations, dates, email, password) is masked in the recording and is not stored as text. A visitor who never signs in is not given a PostHog person profile. If your browser sends a Do Not Track signal, we do not start a recording. You can also write to hello@railroute.in and ask us to delete a recording that involves you.

What we never collect

• No account is required to search. You can use the whole Service without signing up.
• No payment data, ever. RailRoute takes no payments, so no card number, UPI ID, bank detail or billing address is ever entered into or stored by the Service. Payment happens on IRCTC, on their systems, under their privacy policy.
• No PNR, passenger name, age, gender, ID number or any other passenger detail is requested by RailRoute.

3. Cookies and browser storage

Signing in sets a session cookie so the Service knows a request is yours. It carries an identifier for your account and nothing more — no search history, no profile — and it is cleared when you sign out. Signing in also sets short-lived cookies that exist purely to make the sign-in itself safe: a cross-site-request-forgery token, and, while a Google sign-in is in progress, the values needed to verify the redirect back from Google.

PostHog, which provides analytics and session recordings, also sets cookies or similar storage in your browser so it can tell one visit from another. That happens whether or not you have an account. Hosting providers may set cookies for security and load balancing.

4. Why we use it

• To run the search you asked for and show you the results.
• To sign you in, and to show you your own recent searches if you have an account.
• To keep the Service available, secure and free from abuse.
• To diagnose faults and improve accuracy and speed.
• To understand, in aggregate, which features people use.
• To watch session recordings of how people use the site, so we can fix confusion.
• To build and check our information about travel businesses, from contacts that people chose to share with us.
• To check whether searches actually end in a bookable ticket, by reading back the answers we gave.

5. Who we share it with

We share information only with service providers who help us operate RailRoute — hosting and infrastructure providers, analytics and session-recording providers (currently PostHog), and third-party providers of railway timetable and availability information — and only to the extent they need it to perform that role. They are required to protect the information and may not use it for their own purposes.

If you turn notifications on, each notification is handed to the push service run by your browser’s vendor — Google, Apple or Mozilla, depending on the browser — because that is the only route to your device. They see that a message is being delivered to your subscription, and they cannot read it: the message is encrypted with the keys your own browser generated, and we never send them your email address or your name.

We may also disclose information where we are legally required to, or where it is necessary to protect our rights or the safety of users.

We do not sell personal data, and we do not share it for third-party advertising.

6. How long we keep it

Your account and its saved searches are kept until you delete them. Deleting your account removes the account record, the Google link if you made one, and every saved search attached to it, immediately and permanently. Accounts that are never used again are deleted after 24 months of account inactivity of inactivity.

A notification subscription is kept until you turn notifications off on that device, delete your account, or your browser’s push service tells us the device is gone — which it does when you uninstall, clear site data or withdraw permission. We delete it at that point without being asked, and we also delete one that repeatedly fails to deliver, because a subscription we cannot send to is not one worth keeping.

Server and error logs are retained only for as long as they are useful for operating and securing the Service, and are then deleted or anonymised. Aggregate analytics are retained in a form that does not identify you. Session recordings are stored by PostHog on their servers and deleted when they expire under our PostHog retention settings.

The records of searches and their results described in section 2 are deleted 90 days after the search was run. They carry no identifier that outlives the browser tab, so there is nothing in them to connect to you after that tab is closed — the deletion is housekeeping, not the thing that makes them anonymous.

Shared travel contacts are kept until we have verified or removed them. They are not removed on a fixed schedule. To have a business removed, email hello@railroute.in with its phone number or email address and we will delete it.

7. Security

Traffic to and from railroute.in is encrypted in transit. Access to systems is limited to those who need it, and external data access happens server side. Passwords are never stored in a readable form: only a bcrypt hash is kept, so nobody — including us — can recover your password. Saved searches are readable only by the account they belong to. No system is perfectly secure, and we cannot guarantee absolute security; if a breach affecting personal data occurs, we will act promptly and notify affected users and authorities where the law requires it.

8. Your rights, and deleting your account

You can delete your account yourself, at any time, without asking us. Open the account menu (your name or picture, at the top of the page) and choose Delete account. This permanently removes your account record, your email address and name, your Google link if you have one, all of your saved searches, every route you asked us to watch, and every notification subscription. It cannot be undone, and there is nothing left for us to restore afterwards. You can also remove any single saved search from the recent-searches list, and stop any watched route or turn notifications off for a device from Notifications, without deleting your account.

Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may also ask us for access to the personal data we hold about you, ask for it to be corrected or erased, or object to certain processing. Write to hello@railroute.in and we will respond within the period the law allows. If you use RailRoute without an account, we may hold nothing that identifies you as a named person, in which case we will say so. A session recording of an unsigned-in visit can still exist on PostHog until it expires; write to us with a date, time and enough detail for us to find it if you want it deleted.

9. Children

RailRoute is intended for general use in planning travel and is not directed at children. We do not knowingly collect personal data from children.

10. Connected applications and AI assistants

RailRoute publishes a Model Context Protocol server, which lets an AI assistant you use — such as Claude — search journeys on your behalf. Nothing is connected unless you connect it: you are shown a RailRoute page naming the application and the permissions it is asking for, and access begins only when you approve it there.

The assistant never receives your password. It receives a token limited to the permissions you approved, which expires and can be withdrawn. We store the record of that approval, the tokens issued under it, and the name the application reports for itself.

For each request an assistant makes we record which tool was used, whether it succeeded, how long it took, and the account the token belongs to. We do not record the contents of the request — where you are travelling and on what date is not written down by that server.

Remove the connection in your assistant to end its access. Deleting your RailRoute account removes every approval and token along with it. We may also disable an application for everyone if it misbehaves.

11. Changes to this policy

We will update this page when our practices change, and the date at the top will change with it. Material changes will be highlighted on the site.