Privacy Policy

Last updated: September 2026

Who is responsible

Depart UK is made by codfishworks, an independent one-person app studio. If you have a question about anything on this page, email msafeworks@gmail.com.

What codfishworks collects

Outside the advertising services described below, the app does not:

• Ask you to create an account, or collect your name, email, or phone number
• Request or use your location - it only knows the stations you picked yourself
• Include a separate analytics, crash reporting, or usage tracking service
• Read your contacts, calendar, photos, files, or any other app's data
• Build a profile of you or sell any data to anyone

If you email us for support, we receive your email address and the information you choose to send so we can respond.

Your saved routes

Routes - the stations you chose, whether you want direct trains only, and the days and hours the route applies - are stored in the app's private storage on your device. The app does not upload your saved route list to codfishworks or provide its own route sync service. It sends station codes to the departure service when you check live times.

Your phone may include the saved routes in a device backup or transfer, depending on your settings. This includes iCloud Backup on iPhone and Android's backup service. codfishworks cannot access those backups. Deleting the app removes its local data, but a device backup may restore that data later. Backups are managed through your device and backup provider.

How live departures are fetched

Live times come from National Rail Enquiries through the Rail Data Marketplace. The app does not call National Rail directly; it calls a small proxy server run by codfishworks, which adds the National Rail credentials and forwards the request.

Departure requests include the station codes for the route being refreshed (for example STP and LTN), search options, and a shared app token. No account or advertising ID is attached. As with any internet request, the server receives the IP address the request arrives from and technical details such as the app's version.

The proxy does not keep a record of the routes people look up. It logs only technical failures so the service can be kept working, and the hosting provider (Amazon Web Services) records the operational data it needs to run the service.

Advertising

Depart UK is free and is paid for by ads served through Google AdMob. Google's User Messaging Platform manages ad consent and privacy choices.

To serve and measure ads, prevent fraud, and improve its advertising services, Google may collect and process:

• Device or app identifiers, including Android's advertising ID when available and identifiers limited to an app or developer
• Device and app information such as model, operating system version, language, and app version
• Your IP address, which gives an approximate location - typically your town or region, not a precise position
• Ad interactions - which ads were shown, viewed, or tapped
• Crash reports, diagnostics, and performance information from Google's ad software

codfishworks does not receive any of this. What comes back is an aggregate report of how many ads were shown and what they earned, with nothing about individual users in it.

Google acts as an independent controller of the data it collects here. How it uses that data is set out in Google's privacy and terms and its iOS ad data disclosure.

Consent. In the UK, the EEA, and Switzerland, the app requests Google's consent form when required. Declining consent does not stop you using the departure features. Depending on your choices and ad availability, you may see non-personalised ads, limited ads, or no ads. Non-personalised ads can still require consent for device storage.

Changing your ad choices. On Android and iPhone, tap the information button on the departures screen to open About, then choose Change your ad choices. This option appears when Google makes the privacy form available for your region.

Android advertising ID. You can reset or delete your advertising ID in your device's ad settings, usually under Settings > Privacy > Ads. The path varies by device and Android version. See Google's advertising ID guidance.

iPhone tracking. Depart UK does not request Apple's tracking permission and does not access the iPhone advertising identifier (IDFA). Ads can still use the other data described above. Apple's tracking controls are under Settings > Privacy & Security > Tracking; Depart UK may not appear there because it does not request this permission. These controls are separate from the ad consent choices in About. See Apple's tracking guidance.

Legal basis and your rights (UK / EU)

Fetching departures for the routes you saved is done to provide the service you asked for. Personalised advertising uses your consent, which you can give or withhold in the consent form and change later. Google applies your choices to ad serving, including consent for device storage where required.

You can delete saved routes in the app, or delete the app to remove its local data. Manage any device backups separately. For questions or requests about personal data held by codfishworks, including support emails, contact us below. For data held by Google as an advertising partner, use the Google links above and the ad privacy controls described here.

Children

Depart UK is a general-audience travel app and is not directed at children under 13. If you believe a child has used the app and you have a concern, get in touch and it will be dealt with promptly.

Third parties, in full

• Google AdMob and User Messaging Platform - serve ads and manage consent, as described above
• National Rail Enquiries, via the Rail Data Marketplace - supplies live departure boards, reached through the codfishworks proxy
• Amazon Web Services - hosts that proxy
• Google Play - distributes the app and, if you have Play's own reporting turned on, may collect crash and install data under Google's policy rather than this one
• Apple - provides the App Store and TestFlight for iPhone distribution and testing, and may process download, diagnostic, or feedback data under Apple's policies and your settings
• Your device backup provider - may store app data in backups you enable, as described above

There is nothing else. No other SDK, tracker, or partner is embedded in the app.

Changes to this policy

If this policy changes, the updated version is published on this page with a new "Last updated" date. Any change that widens what is collected will also be announced in the app before it takes effect.

Contact

Questions about this policy, or about anything the app does with data, go to msafeworks@gmail.com.