Privacy policy

Who is responsible

LiveRail is run by one person, not a company. For data protection purposes that person is the data controller:

Email is the way to reach me, and it reaches me directly rather than a support desk. If you need a postal address for a formal notice, ask and I will give you one.

What is collected

Almost nothing happens unless you make it happen. Here is the whole list.

What is never collected

• No analytics. There is no Google Analytics, no Plausible, no Fathom, nothing counting you.
• No advertising or tracking pixels. Nothing on this site follows you to another one.
• No accounts and no passwords. LiveRail has no login, on the site or in the app.
• No unsolicited email. The mailing list is the only email you will get from me. You are on it only if you signed up or bought LiveRail, and every message has an unsubscribe link.
• No IP addresses in my database. The votes and ideas tables hold a random identifier and nothing that points back to you.
• No card details, ever. Payment happens entirely on Lemon Squeezy's side. Nothing about your card reaches this site or me.
• No selling or sharing of data. Nothing here is sold, rented, or handed to advertisers or data brokers.

Why, and on what legal basis

Under UK GDPR every use of personal data needs a legal basis. These are the ones relied on here.

The mailing list

There is a mailing list. It carries release notes and what is coming next, and nothing else: no advertising, no offers from anyone else, and no selling your address on.

Where your address is stored. The list is run by Brevo, an email service. When you type your address into the signup box, it is passed straight to Brevo and stored there, and you may be sent an email asking you to confirm it. When you buy LiveRail, Lemon Squeezy tells this site about the order and your address is passed on to the same service. It is never written to my own database: the Cloudflare D1 database behind the votes and suggestions holds no email addresses at all, and the signup box is the only part of this site that asks for one.

How you get on it. Two ways. You type your address into the signup box, or you buy LiveRail, which adds you to the same list automatically.

How you get off it. Every email has an unsubscribe link, and it takes effect straight away without your having to give a reason. You can also email support@liverail.io and I will take you off by hand. Leaving the list changes nothing about your licence, your key, or getting support.

Your address is kept until you unsubscribe. Brevo then keeps a record that you did, which is what stops you being added back by mistake.

Who else is involved

Running even a small site means using other people's infrastructure. These are all of them.

Cloudflare

Hosts the site, serves it worldwide, stores the votes and suggestions in a Cloudflare D1 database, runs the Turnstile anti-spam check on the suggestion form, and hosts the update feed the installed app checks. Cloudflare acts on my instructions as a processor. See Cloudflare's privacy policy.

Lemon Squeezy

Handles buying LiveRail, and issues and checks the licence keys. Lemon Squeezy is the merchant of record, which means it is the seller for the transaction, takes the payment, and deals with VAT. It also holds the keys, so the installed app asks it directly whether yours is valid, as described under the app on your machine. For the payment itself it is a separate data controller in its own right. See Lemon Squeezy's privacy policy.

Brevo

Runs the mailing list: it stores the addresses on it, sends the emails and handles the unsubscribe links. Brevo is a French email service, and it acts on my instructions as a processor. See Brevo's privacy policy.

Fonts

The typefaces are served from liverail.io itself rather than from Google Fonts or any other font service. Loading a page here does not cause your browser to contact a third party for them, and no IP address of yours reaches anyone on account of the type.

Email

Email to and from me sits with an ordinary email provider, the same as any other correspondence.

That is the complete list. There is no CRM, no analytics vendor, no advertising network and no chat widget.

Data outside the UK

Cloudflare and Lemon Squeezy are both American companies with servers around the world, so some data is processed outside the UK. Both operate under the standard safeguards approved for this, including the UK International Data Transfer Addendum and Standard Contractual Clauses, which are set out in their own policies linked above.

Brevo is a French company, and the UK treats the EU as a safe place to send personal data, so the mailing list needs no extra safeguards.

How long things are kept

The app on your machine

LiveRail itself runs on your computer. Your layouts are ordinary files on your own disk. They are never uploaded, and I have no way to see them.

Activating a licence key is an online check, because Lemon Squeezy issues the keys and is the only thing that can say whether one is genuine. When you paste your key in, and then each time the app starts and once a day while it runs, LiveRail sends the key and a random installation identifier to api.lemonsqueezy.com and gets back whether the key is valid and how many machines it is in use on. Like any web request, that shows Lemon Squeezy your IP address and the time. Your name, your email address and your layouts are not part of it, and nothing about the check reaches me. See Lemon Squeezy's privacy policy.

The key and that installation identifier are also kept on your own machine, so the app knows what it is holding. The identifier is made up at random and is not your computer's name. A licence covers two machines, and releasing one from the licence box in the app frees it for another.

There is no way to switch that check off, because it is how the licence works. If Lemon Squeezy cannot be reached the app keeps the paid features going for 30 days and then falls back to the free version, so an outage or a spell offline does not cost you anything.

The other thing the app does over the internet is check for updates. Ten seconds after it starts, and every four hours while it runs, it fetches a small file from dl.liverail.io giving the current version number. If a newer version exists the app downloads it in the background and installs it the next time you quit.

Like any web request, those fetches show Cloudflare, which hosts the files, your IP address and the time. The update library also sends its own name (electron-builder) and a random installation identifier it makes up the first time it runs and keeps in a file called .updaterId in the app's data folder. That identifier is not linked to you, your key or your purchase, and deleting the file resets it. No name, no email, no layout data and no telemetry go with it, and none of it reaches me.

There is no switch in the app to turn the update check off either. Blocking dl.liverail.io in your firewall or hosts file stops it, and the app then behaves exactly as it does offline: it keeps working, and a check you start yourself from the app menu says it could not reach the server.

Your rights

Under UK GDPR you can ask me to give you a copy of any personal data held about you, correct it, delete it, restrict what is done with it, object to it being used at all, or hand it over in a portable form. There is no charge and I will answer within one month.

Email the address at the top of this page and say what you want.

Complaints

If you think your data has been handled badly, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at any time.

ico.org.uk/make-a-complaint, or their helpline on 0303 123 1113.

Changes to this policy

If the site starts doing something new with data, this page changes first and the date at the top changes with it. The mailing list is for releases rather than for policy changes, so the date at the top is the record to go by.