ItsOnlyFare

Legal

Privacy Policy

This page is maintained by the itsonlyfare team to answer common privacy questions about the app. It explains what we collect and how we use it. It is not a certification and does not replace the full Terms.

Last updated: 12 July 2026

Who we are

itsonlyfare is an independent UK app that helps rail travellers avoid overpaying and claim delay repay. In this policy, "we" refers to the itsonlyfare team.

What we collect

  • Account details (name, email, hashed password or OAuth identifier).
  • Rail profile (home / work stations, railcards, season ticket status, preferences).
  • Journey history you add or track through the app.
  • Claim history and Money Back™ activity.
  • Basic device information for security and support.

Why we collect it

Every field above is used to monitor your journeys and help you claim compensation you're owed. We never sell your data or share it with train operators, insurers or advertisers.

Legal basis (UK GDPR)

  • Contract — to provide the service you signed up to.
  • Consent — for optional marketing emails, revocable anytime.
  • Legitimate interests — to keep the app secure and improve it.

Retention

We keep your data while your account is active. If you delete your account, we remove personal data within 30 days, except where retention is legally required.

Your rights

You can access, correct, export or delete your data from the app, or by emailing privacy@itsonlyfare.co.uk. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

Security

Data is encrypted in transit and at rest. Access is controlled by row-level security policies and least-privilege rules. We limit what any single member of the team can see.

Cookies

We use only essential cookies to keep you signed in and to keep the app secure. No third-party analytics or advertising cookies.

Usage measurement

To understand how ItsOnlyFare is used and improve it, we record anonymous usage events such as pages viewed and features used. This measurement is first-party and cookie-free: nothing is stored on your device, we do not track you across other websites, and we do not share this data with advertisers. Visits are counted using a short-lived, salted one-way code derived from your connection and browser details; we never store your IP address, and the code cannot be used to identify you.

Changes to this policy

We'll tell you before making material changes. Older versions are available on request.