Privacy Policy

Effective date: August 1, 2026 · Last updated: November 5, 2026

The Rail Roster ("we," "us") is the operator of this Service. This policy explains what information the Service touches and where it lives.

The short version

Your collection data and photos live in YOUR Google account — your Google Sheet, your Google Drive. We don't have a database of your trains.
We keep only what's needed to run your account: your email address and your subscription/trial status — and, for beta testers only, when the app was last opened and how often.
We never see your card number. Payments are handled entirely by Stripe.
We don't sell or rent your information. Ever. There are no ads in the app.

What we store, and why

What / Where / Why
Your email address and name — Our account list (a private spreadsheet) — To know who you are when you sign in, and whether your trial or subscription is active
Trial start date / subscription status — Same account list — To run the 30-day trial and yearly subscription
Beta testers only: the date you last opened the app, the app version, and a count of opens (the last 14 days by day) — Same account list — To see which testers are using the app and whether a release reached them; nothing about your collection or what you did in the app
Gift list you choose to share (optional) — Our backend (a private spreadsheet) — Only if you turn on the family link: the items on your gift list as your family sees them (names, about-prices, pictures, store links), the date you last sent it, and which items your family marked as bought. Your email is kept only as a one-way code that cannot be turned back into it. Nothing else from your collection.
Community catalog contributions (optional, anonymous) — Our shared reference data — If you opt in: item numbers, conditions, and identification results — never tied to your name or email — to grow the collector-built catalog

What stays in YOUR Google account

Your items, variations, conditions, prices paid, estimated values, locations, notes, want lists, sales records, contacts you add, and every photo. The Service reads and writes this data only at your direction, using the Google permissions you grant at sign-in. Revoke access anytime at myaccount.google.com → Security → Third-party access; everything remains in your account.

Google API disclosure: The Rail Roster's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access your Google Sheets, your Google Drive, and the photos you pick from Google Photos solely to provide the collection-tracking features you see, never for advertising, and we don't transfer that data to third parties except as needed to provide those features or as required by law.

Google Photos (optional)

If you choose "From Google Photos," the app asks Google for one extra permission: to see the photos you pick in Google's own photo picker. Google opens the picker, you choose the pictures, and only those pictures are shared with the app. The app copies them into your own Rail Roster photo folder in your Google Drive, so they show on your items. It cannot see the rest of your photo library, and it cannot change, move, share or delete anything in Google Photos. Nothing from Google Photos is kept on our side or sent anywhere else, except a photo you choose to run through photo identification (see below). You can remove this permission anytime at myaccount.google.com → Security → Third-party access.

Photo identification

When you use photo identification, the photo you submit is sent to an automated photo-reading service (Google's) to identify the item, under the consent you gave during setup. Photos are used for identification only. You can decline this feature and use manual entry, barcodes, or label reading instead.

How we protect your information

Encrypted everywhere. Every connection between the app and Google, Stripe or our account service is encrypted (HTTPS).
Your data goes straight to your own Google account. Your collection, your photos and any picture you pick from Google Photos travel directly between your device and your own Google account. They never pass through our side and are never stored there. The one exception is a photo you choose to run through photo identification (see above).
The narrowest Google permissions. The app can open only the Drive files it created or that you open with it, not the rest of your Drive. Its Google Photos access is read-only and covers only the pictures you pick.
Google sign-in. The one-hour pass Google gives the app stays on your device and is erased when you sign out. So that Google's sign-in window doesn't pop up every hour, our account service also keeps one long-lasting Google renewal key for your account. It is stored scrambled with a secret only the service holds, in a private spreadsheet only we can open, and it can only ask Google for the permissions you already granted. It stops working the moment you remove the app's access at myaccount.google.com/connections, and we delete it the next time it's tried, or when you ask us to delete your information.
Our account list is private. Your email address and account status are kept in a private spreadsheet that only we can open.
No card numbers. Payments go directly to Stripe.

Payments

Handled by Stripe, Inc. When you subscribe, you give your card details to Stripe directly — they never pass through us. Stripe tells us only who paid and until when. Stripe's privacy policy: stripe.com/privacy.

Cookies and tracking

The Service keeps sign-in and app settings on your own device (local storage). The app itself — where your collection lives — runs no advertising or analytics trackers.

We advertise The Rail Roster on Google. Two pages of our public website — the home page and the short "Welcome aboard" page you see right after checkout — use Google's advertising tag, which sets a cookie so we can tell whether a Google ad led to a free trial. That page tells Google only that a trial started, with Stripe's checkout reference number so it is never counted twice; nothing about your collection, and not your email address, is shared. Google's privacy policy: policies.google.com/privacy. You can turn off ad personalization at adssettings.google.com.

Children

The Service is not directed at children under 13, and we don't knowingly collect their information.

How long we keep information, and how to delete it

Google data: We keep no copy of your Google Sheet, your Drive files or your Google Photos. Everything stays in your own Google account until you delete it. Pictures you pick from Google Photos are copied into your Rail Roster photo folder in your Drive, and the app closes Google's picker right away, so it holds no further access to what you picked.
Photo identification: We don't keep the photo. We keep only a fingerprint of it and the answer, never with your name or email, so the same photo isn't read twice. The oldest entries are removed automatically.
Your account information (email, name, trial or subscription status, beta-tester visit counts, and the Google renewal key described above) is kept while you have an account with us. Email support@therailroster.com and we'll delete it within 30 days. Stripe keeps its own payment records as the law requires.
A shared gift list is deleted, with its bought marks, the moment you press Stop sharing in the app, or by itself 12 months after you last sent it.
You can remove the app's access anytime at myaccount.google.com/connections. That stops the app from reaching your Google account immediately, and your data stays where it is in your account.

Changes and contact

If this policy changes materially, we'll notify you in the app or by email before the change takes effect. Questions: support@therailroster.com.