Last updated: April 13, 2026
OnTrain, developed by CAG Productions, LLC ("we," "our," or "the app"), is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.
OnTrain does not collect, store, or process any of the following personal information:
No user account or registration is required to use OnTrain.
OnTrain collects the following limited, non-personal information to provide its core functionality:
Device Identifier: A randomly generated anonymous identifier is created on your device when you first open the app, along with a randomly generated secret used to authenticate API requests from your device. Together they let our server recognize requests as coming from your device without knowing who you are. They are not linked to your name, Apple ID, or any personal information.
Pairing Codes: When you generate a code to pair with a partner, a short numeric code is temporarily stored on our server alongside your anonymous device identifier. Pairing codes expire automatically after 10 minutes and are deleted as soon as they are used or expire. After a successful pairing, only the link between two anonymous device identifiers is retained.
Push Notification Token: If you enable notifications, Apple provides a device token that allows us to send push notifications about your active trip (e.g., train delays, track assignments, arrival updates). This token is not linked to your identity and can only be used to send notifications to your device through Apple's Push Notification service.
Location Data: If you grant location permission, your approximate location is used only to find the nearest train station. Location data is processed on-device and sent to our server as a single latitude/longitude coordinate for the nearest-station lookup. We do not store, track, or retain your location history.
Active Trip Data: When you start a trip, the following information is temporarily stored on our server to coordinate between rider and driver, or to track your own trip in Solo Mode:
This data is automatically deleted when the trip ends or within a few hours of the scheduled arrival time.
Aggregate Train Performance Data: Our server records anonymized on-time performance for individual LIRR, Metro-North, and NJ Transit trains based on public MTA and NJ Transit data feeds. This data is not associated with any user, device, or trip — it is purely a record of when scheduled trains arrived at their stations. It powers in-app features like the OnTrain Train League standings.
All information collected is used exclusively to:
Transit Agency Data: OnTrain uses publicly available data feeds from the Metropolitan Transportation Authority (MTA) and NJ Transit to provide real-time train information for the Long Island Rail Road (LIRR), Metro-North Railroad, and NJ Transit Rail. This data is obtained from MTA and NJ Transit servers and redistributed through our own servers. OnTrain is not affiliated with, endorsed by, or licensed by the MTA or NJ Transit.
Apple Push Notification Service (APNS): We use Apple's push notification infrastructure to deliver trip updates to your device. Apple's privacy policy governs their handling of push notification delivery.
Cloudflare: Our servers run on Cloudflare's infrastructure. Cloudflare may collect standard web server logs (IP addresses, request timestamps) as part of their service. Please refer to Cloudflare's privacy policy for details.
Active trip data is stored temporarily on Cloudflare Workers KV (a key-value store) and is automatically deleted after trip completion. Device identifiers and push tokens are stored in a Cloudflare D1 database. All data is transmitted over encrypted HTTPS connections.
We do not sell, share, or transfer any data to third parties for advertising, marketing, or any other purpose unrelated to the app's core functionality.
OnTrain does not knowingly collect any information from children under 13 years of age. The app does not require any personal information to use.
Since we do not collect personal information, there is generally no personal data to access, correct, or delete. If you wish to remove your device identifier and push token from our servers, you can unpair your device in the app's Settings tab. Uninstalling the app removes all locally stored data.
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Your continued use of the app after changes are posted constitutes your acceptance of the updated policy.
If you have any questions about this Privacy Policy, please contact us at support@ontrainapp.com.