1. The Data Processed (And What Is Discarded)

• Email Addresses: During sign-up, an email address is requested solely to send a verification code. This needs to happen, as some data is restricted to rail staff only due to licensing restrictions. The moment the verification code is sent, the email address is permanently deleted from the system. It is not stored, it is not logged, and it cannot be looked up later.
• Platform Identity: Instead of an email, an account is identified by two things:
  1. A unique alphanumeric "key" generated randomly for the device upon verification.
  2. The domain portion of the registration email.

  Example: If signing up as user@owlboard.info, the email is wiped, and the account identifier becomes [Your-Secret-Key] @ owlboard.info. This allows OwlBoard to manage access without knowing who you are.

• Fuzzy Location Data: If the "Near to Me" toggle is enabled, exact GPS coordinates are calculated, but never leave your device. Your device compresses the position into a "fuzzy location block" (a geohash) roughly 1.2km by 0.6km in size before contacting the server to request nearby stations. OwlBoard only processes that neighborhood block—never an exact location.
• Server Logs & IP Addresses: Like any web application, self-hosted security tools and the Web Application Firewall (WAF) temporarily process network IP addresses. This is strictly for system health, infrastructure monitoring, and blocking malicious or automated attacks.

2. What Is Considered "Personal Data"?

Under the GDPR, "Personal Data" is anything that can directly or indirectly pinpoint a living individual.

Because email addresses are discarded instantly and location hardware telemetry is fuzzed directly on the device, station boards, preferences, and account keys are completely pseudonymized. However, because network IP addresses are technically classified as personal data under European law, transient security logs are treated with the highest level of guardrail protection.

3. Subject Access Requests (SAR) & The Right to be Forgotten

Absolute sovereignty over your digital footprint should be standard, without jumping through bureaucratic hoops. There is no need to send an email to exercise GDPR rights:

• Instant SAR (Right of Access): The Account dashboard contains a dedicated section displaying every single line of data which can be identified with the account key block. It can be viewed or copied instantly.
• The Right to be Forgotten (Instant Erasure): A prominent "Delete Account" button is available on that same page. Clicking this instantly wipes the account key. You will be able to re-register at any time, and all of your preferences remain only on your device.

While the pseudonymized settings left behind are not technically personal data once disconnected from an identity, the OwlBoard project operates on a simple philosophy. When the delete button is pressed, the data is erased.

4. No Third-Party Conglomerates

All data is hosted transparently on isolated, self-hosted server infrastructure in Somerset. OwlBoard does not use third-party analytics trackers, tracking cookies, or advertising networks.