Privacy Policy
Effective Date: January 9, 2026
This Privacy Policy explains how railfanninglocations.com (the "Site"
) collects, uses, and protects your information. By using this site, you agree to the terms below.
1. What We Collect
We collect only the minimum personal information needed to operate this site:
- Your name and profile picture from Google Sign-In
- A username taken from Google that you can update
- Authentication tokens for session management
We do not collect your email address, GPS location, or any other Google profile details. IP addresses are not stored or retained.
2. How We Use Your Information
- To authenticate your login and maintain your session
- To let you submit and edit locations, railroad lines, railroad information, images, and comments
- To display your username and profile picture alongside your contributions
We do not sell or share your personal data with any third parties.
3. Authentication & Session Management
We use industry-standard JSON Web Tokens (JWT) for secure authentication. Your session is managed by .NET's built-in authentication system and does not rely on custom session storage or IP tracking.
4. Cookies
We do not use cookies for tracking or advertising. Our authentication system uses JSON Web Tokens (JWT) stored locally in your browser and sent with each request via secure headers.
5. Public Content
Any locations, railroads, images, or comments you submit are publicly visible to other users. Your username and profile picture will be displayed alongside your contributions. Please do not upload content you do not have the rights to share.
6. User Control & Data Deletion
You may delete your account at any time from the Settings page. Account deletion removes your personal information and comments from the database. Your contributions (locations, railroads, lines, submissions, images) will remain publicly visible but will be attributed to "Deleted User" instead of your username.
For additional assistance or questions about data deletion, email alex@railfanninglocations.com.
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These include:
- Use of Entity Framework Core with parameterized queries to prevent SQL injection attacks.
- Role-based authorization on all secure API endpoints to restrict access to sensitive operations.
- Minimizing the collection and storage of personal data to reduce exposure.
- Encrypting data in transit using HTTPS.
- Restricting access to backend systems and databases to authorized personnel only.
- Regularly reviewing and updating our security practices to address emerging threats.
However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Therefore, we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
8. Children's Privacy
This site is not intended for children under 13. We do not knowingly collect data from minors.
9. U.S. Audience Only
This site is intended for users in the United States.
