Privacy Policy
Version 2026-10-16 · Effective date: 8 September 2026
1. Who we are, and when we are responsible for your data
This policy explains how Railyard at railyard.sh handles personal data.
Railyard is a trading name of Railyard Tech Ltd, a company registered in England and Wales under company number 17525277, whose registered office is 24 Elizabeth Road, Wokingham, England, RG40 1UB.
There are two different relationships here, and they matter for who you ask about what:
- We are the controller of the data we need in order to run the Service for you: your account and membership details, billing identifiers, sign-in records, security and audit logs, request logs, feedback you send us, and our email to you. This policy covers that data, and sections 2 to 12 are about it.
- We are a processor for the personal data inside Customer Data — the designs and the working records around them. If your colleague's name is on a comment, an invitee's email address is on a pending invitation, or a person's name is in a rack label, the organisation that put it there is the controller and decides what happens to it. We process it on that organisation's instructions under our Data Processing Agreement. If you are a member of someone else's organisation and want that data changed or removed, ask an owner of that organisation first; we will help them, and we will pass your request on if you contact us instead.
For any privacy question, or to exercise your rights, contact us at [email protected]. We are not required to appoint a Data Protection Officer for this processing and have not done so;[email protected] is the monitored route for privacy matters.
EU representative. We offer the Service to organisations in the European Economic Area, so EU GDPR Article 27 requires us to name a representative established in the Union. One is not yet appointed. Until it is, EEA residents can raise anything with us directly at [email protected], and may complain to their own national supervisory authority without going through a representative.
2. The personal data we collect as controller
We keep collection to what the Service needs to work. We collect:
- Account data — your email address, and your name and avatar if your identity provider supplies them or you set them. We do not collect or store a password, because sign-in is passwordless.
- Organisation and membership data — which organisations you belong to and your role (owner, editor or viewer) in each, and which projects you have been granted access to.
- Sign-in and session records — short-lived, one-time email sign-in codes; session records including the browser user agent of the device you signed in from and when it was last seen, so account settings can show you your sessions and you can revoke them; and a record of the networks your account has signed in from, kept for 90 days so a stranger's failed attempts cannot lock you out. Sign-in codes and session identifiers are stored only as one-way hashes, never in a form we could reuse to sign in as you. Sign-in codes are hashed with a secret key held outside the database, so a copy of the database alone does not reveal them.
- Terms acceptance records — each time you accept our Terms of Service (when you create your account, after we change the Terms, and when you subscribe or buy a Project Pass): the Terms and Privacy Policy versions you were shown, when you accepted, how (sign-up, re-acceptance or checkout) and, for a purchase, which organisation it was for. They are our record that the Terms apply to you.
- Linked sign-in identities — which identity providers you have connected, and the opaque subject identifier each gives us.
- API tokens and connected clients — the name, creation and expiry dates and last-used time of each personal access token you create, and for each AI assistant or other client you connect through our connector interface, the client's registration details, what you allowed it to do (read-only, or read and write) and when it last used the grant. Token and client secrets are stored only as hashes. A token or client you authorise acts with your access, and we record its activity against your account.
- Billing identifiers — if you choose a paid plan, we store Stripe customer and subscription references, your plan status, billing interval and billable editor quantity, and a record of the billing emails we sent you. If you buy a Project Pass, we store which estate it covers, who bought it (a link cleared if that account is deleted), when it was bought and when it expires, the Stripe Checkout session and payment references, and, if it is refunded, when and why it ended. Full card details are entered directly with Stripe and are never received or stored by us.
- Security and audit data — a log of significant account and organisation actions, recording the actor's email address, IP address and a short description, so we can investigate abuse and keep the Service secure.
- Request and server logs — our servers log requests and errors to diagnose faults and detect abuse. These are operational logs: they record what happened, not who you are, and we do not use them to build a profile of you. They may contain IP addresses and the URL path of a request, which in some cases can indirectly identify an account.
- Email delivery and opt-out records — whether a message was delivered or failed, and a one-way digest of any address that has opted out of invitation email, so we can honour the opt-out without keeping a readable list of addresses.
- Feedback data — when you send feedback we store its category and message, your optional reply email address, and limited troubleshooting context such as the page route, selected view, viewport, language, application version and browser user agent. If you are signed in we also attach your account and organisation identifiers. We do not attach your estate or project document automatically.
- Aggregate usage counts — daily totals for a small, fixed set of actions (see section 9). These contain no identifier for you.
Interface preferences and, in local-only mode, your working project are stored in your own browser and are not sent to us. Section 9 lists them.
3. Personal data inside Customer Data (where we are a processor)
We do not choose what personal data goes into your designs. In practice the following personal data commonly ends up in Customer Data, and we flag it so that whoever administers your organisation knows what they are responsible for:
- Invitation email addresses — a pending invitation stores the address it was sent to until it is accepted, declined or expires (30 days).
- Attribution and collaboration records — who created, changed, commented on, reviewed or approved what, and when. While you are in a project, your name, avatar and current location in the design are visible in real time to other members of that project who are also in it. This is how collaborative editing works; it cannot be turned off while you are editing, though you can leave the project.
- Project access events — a record of grants, removals and administrator recovery on private projects.
- Free-text content — names, labels, notes, tags and comments can contain personal data if your team puts it there. Please do not put anything sensitive in a rack label.
Organisation owners can reach private projects. An owner of an organisation can restore their own administrator access to a private project inside that organisation, including one they had been removed from. The action is recorded in the organisation's audit trail, but it is not blocked. Treat an organisation's projects as visible to its owners.
Our retention, security and sub-processors for Customer Data are the same as described below; what differs is who decides. The Data Processing Agreement sets out our obligations to the controller, including our breach-notification commitment and how we help with access and erasure requests from your people.
4. If you were invited but never had an account
Someone may have entered your email address to invite you to an organisation. In that case we hold your address because that customer gave it to us, not because you gave it to us, and this section is the notice UK/EU GDPR Article 14 requires.
- What we hold: the email address, the organisation and role you were invited to, who invited you and when.
- Why: to deliver the invitation and let you accept it. The organisation that invited you is the controller of that record; we act on its instructions, and we also use the address to honour an opt-out if you ask for one.
- How long: until the invitation is accepted or declined, or 30 days, whichever comes first — then it is deleted.
- Your choices: ignore it and it expires. Every invitation email carries an unsubscribe link that stops all Railyard invitation email to your address; we keep only a one-way digest of the address to enforce that. You can also email [email protected] to be removed immediately, and you have the rights in section 10.
5. How we use your data, and our lawful bases
Under UK GDPR, and EU GDPR where it applies, we rely on the following lawful bases for the data we control:
- To provide the Service — creating your account, authenticating you, storing your designs, enabling collaboration and exports, providing support, and recording that you accepted the Terms that govern it. Lawful basis: performance of a contract with you, or steps taken at your request before entering one, and our legitimate interests in being able to show which Terms apply.
- To manage paid plans and Project Passes — plan, billable-editor, renewal, invoice, Project Pass and refund information, and applying the limits and features of the plan you are on. Lawful basis: performance of a contract, and our legitimate interests in running our business. Keeping invoices and payment records afterwards is a legal obligation under tax and accounting law.
- To keep the Service secure — audit logging, request logs, session records, rate limiting, abuse prevention and troubleshooting. Lawful basis: our legitimate interests in protecting the Service and its users, and legal obligation where security or record-keeping duties apply. We have considered your interests here: the data is limited, kept for a year at most, and never used to profile or market to you.
- To communicate with you — sign-in codes; security notices such as a new API token, a connected client, an email change or a sign-out of your other devices; organisation invitations; billing, dunning, trial and plan notices; review and merge-request notifications; and notice of material changes to our terms. Lawful basis: performance of a contract and our legitimate interests. You can turn off the optional product notifications in Email preferences; sign-in codes and security, billing and legal notices are not optional while you have an account. Any marketing email would be sent only with your consent.
- To understand whether the product is useful — counting which public guides are read, whether the guided example leads visitors to the app, and when an authenticated app screen opens. The stored results are daily totals, not visitor histories. Lawful basis: our legitimate interests in improving the Service.
- To act on feedback — reading and replying to what you send us. Lawful basis: our legitimate interests in improving the Service, and performance of a contract where it is a support request.
Is any of this required? Giving us an email address is necessary to have an account — without it we cannot authenticate you, so we could not provide the Service. Everything else listed in section 2 is either generated by using the Service or optional. There is no statutory requirement for you to give us personal data.
No automated decision-making. We do not make decisions about you by automated means that have a legal or similarly significant effect on you, and we do not profile you. Rate limits and abuse controls are automatic, but they throttle a request; they do not decide anything about you as a person. We do not use your Customer Data to train machine-learning models.
6. Sub-processors
We use a small number of providers to run Railyard. Each is bound by a written contract, may use personal data only to provide its service to us, and is subject to the same obligations we owe you. The full list, with locations and transfer safeguards, is on our sub-processors page and reproduced here. Last reviewed 6 October 2026.
| Provider | Role | Purpose | Data involved | Location |
|---|---|---|---|---|
| Hosting and managed database provider — to be confirmed | Processor | Application hosting, the PostgreSQL database that stores your account and designs, and encrypted backups of it | All account data and Customer Data stored by the Service | United Kingdom |
| Cloudflare, Inc. | Processor | Authoritative DNS, TLS termination at the edge, denial-of-service protection, and inbound email routing for our published addresses | IP address, request metadata and traffic in transit; inbound email addressed to us | Global edge network, United States parent |
| Resend (Plus Five Five, Inc.) — to be confirmed | Processor | Sending transactional email: sign-in codes, organisation invitations, security and account notices, billing and dunning notices, trial and plan notices, review and merge-request notifications, and email-change confirmations | Recipient email address and the content of the message | United States |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Processor and independent controller | Taking payment for subscriptions and one-off Project Pass purchases, running subscriptions, issuing invoices and making refunds — only if you choose a paid plan or buy a Project Pass. Stripe is also an independent controller when it uses payment data for its own fraud prevention, anti-money-laundering and regulatory obligations, which we do not direct and cannot switch off | Billing contact email and name, card details you enter directly with Stripe (we never receive them), plan and subscription status, Project Pass purchases and refunds, invoices and payment records | Ireland, with group processing in the United States |
Stripe is more than our processor. As well as processing subscription data on our instructions, Stripe acts as an independent controller when it uses payment data for its own fraud prevention, anti-money-laundering and regulatory purposes. We do not direct that processing and cannot switch it off; Stripe's own privacy policy governs it.
Identity providers are not our sub-processors. If you sign in with Google, GitHub, Okta or another provider, that is a provider you or your organisation chose, acting as its own controller. It tells us only the verified profile you release to us — your email address, and your name and avatar if available — and it may log the sign-in under its own policy, which we do not control. Single sign-on is available to any user whose provider we support; it is not something an organisation switches on for you.
Clients you connect. If you connect an AI assistant or another client, it reads and writes your data with your access, and whatever it sends onward goes to a provider you chose, under your agreement with them. We are not a processor for that onward processing. Review and revoke connected clients in account settings.
Changes. We will publish any new or replacement sub-processor on the sub-processors page at least 30 days before it starts processing personal data, and email organisation owners who have asked to be told. Customers may object on reasonable data-protection grounds as described in the Data Processing Agreement.
Where a private deployment is agreed with your organisation, the operator of that deployment may use a different set of providers, named in that agreement.
7. Where your data is processed, and international transfers
The Service runs in the United Kingdom. Your account data and Customer Data — including the database and its encrypted backups — are stored there. We publish this so you can assess it for your own compliance, including under Article 28 of the EU Data Act.
Some of our providers process limited data outside the UK and European Economic Area, as the table in section 6 shows — chiefly transactional email and the edge network, and payment data if you buy a paid plan or a Project Pass. For each of those we rely on a specific safeguard: the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or adequacy where it applies. The sub-processors page states the mechanism for each provider, and you can ask [email protected] for a copy of the relevant clauses.
8. How long we keep data
- Account and Customer Data — kept while your account or organisation exists, and deleted when you delete the data or close your account (see section 10). A deleted organisation or project is first kept, unreachable to everyone, for 30 days, so its owners or administrators can restore it, and is then permanently deleted from the live Service; they can delete it permanently sooner. Closing your account deletes your personal space and its projects at once, together with any deleted organisation you alone own. A personal space or organisation whose paid plan has lapsed, or whose Project Pass has ended, keeps all of its data, editable and exportable: we never delete data, or make it read-only, because a plan ended or was not paid for.
- Terms acceptance records — kept while your account exists, and deleted with it.
- Sign-in codes and sessions — codes expire after 15 minutes and work once. Sessions expire after 30 days, or 14 days without use. Expired and used records are pruned automatically after a short grace window. Sign-in network records are kept 90 days.
- API tokens — until they expire (90 days by default, up to a year) or you revoke them; the record is pruned 7 days after expiry.
- Pending invitations — until accepted or declined, or 30 days.
- Security and audit logs — up to one year, then deleted. When you delete your account we remove or anonymise the fields that identify you — email address and IP address — while keeping a pseudonymised record of the action for the rest of that period.
- Request and server logs — short-lived operational logs, kept for troubleshooting and then rotated out. They sit outside account erasure: they record log identifiers rather than email addresses, so there is nothing in them to erase by name.
- Feedback reports — up to 12 months, then deleted. If you delete your account sooner, we remove the actor identity and reply address and keep only a pseudonymised report.
- Email opt-out digests — kept indefinitely. An opt-out is only effective if we remember it, and the digest is one-way, so it cannot be read back as an address list.
- Billing records — retained by us and by Stripe as needed for accounting and tax. A Project Pass record is kept while the estate it covers exists and is deleted when that estate is permanently deleted; the payment and any refund stay in the Stripe and invoice records. Deleting your account or an organisation does not delete the Stripe customer, invoices or payment records, which we must keep. We also keep a minimal link from the deleted organisation to its Stripe customer and subscription references — no name or email address — for seven years, so we can answer billing queries and correct any charge made after deletion, then delete it.
- Backups. The database is backed up, and a deletion you make in the live Service persists in those backups until they age out of the backup retention period. We do not restore deleted data from a backup except to recover the Service as a whole after an incident, and we re-apply erasures afterwards.
Backup retention period: to be published. We are documenting the hosted deployment's backup and point-in-time-recovery window and will state the exact period here. Ask [email protected] for the current figure in the meantime.
9. Cookies and browser storage
Railyard uses no third-party analytics, no advertising and no cross-site tracking, and sets no tracking cookies. Every cookie we set is strictly necessary to sign you in or to complete a sign-in, so no cookie-consent banner is required. These are all of them:
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-ry_session | Keeps you signed in. Holds a random session identifier, stored by us as a hash. | 30 days, or 14 days without use |
__Host-ry_oauth_state | Protects a single sign-on attempt against cross-site request forgery. | Minutes — cleared when sign-in finishes |
__Host-ry_oauth_pkce | Holds the one-time PKCE verifier that proves the sign-in was started by this browser. | Minutes — cleared when sign-in finishes |
__Host-ry_oauth_nonce | Binds the identity token to this sign-in attempt, so one cannot be replayed. | Minutes — cleared when sign-in finishes |
__Host-ry_auth_return | Remembers the page you were heading to, so sign-in returns you there. | Minutes — cleared when sign-in finishes |
The __Host- prefix is dropped on a deployment served over plain HTTP, such as a local development instance.
Browser storage. The following are kept in your browser's local storage or IndexedDB and are never sent to us. Clearing your site data removes them.
| Key | What it remembers |
|---|---|
railyard.theme, railyard.statusPalette | The colour theme you chose (or System), and whether you turned on colour-blind-safe status colours |
railyard.currentOrg, railyard.lastPath | The organisation and screen you last had open, so the app reopens where you left it |
railyard.export.lastOutput | The export format you chose last time |
railyard.cableTable.height, railyard:topology-snap | Panel size and topology snapping preferences |
railyard.tourDone.*, railyard.tourPending.*, ry-early-access-dismissed, railyard:example-update-dismissed:* | Which guided tours, banners and notices you have already seen or dismissed |
railyard:local-project-recovery:v1 and the IndexedDB project store | Your working project when you use Railyard without an account, and a recovery copy so a closed tab does not lose work. Signing out clears the hosted copies. |
Tutorial videos. The videos on our Learn pages are hosted by YouTube. Nothing from YouTube is loaded until you press play, and then the video comes from youtube-nocookie.com, YouTube's privacy-enhanced mode. Once it is playing it is YouTube's service, which may use cookies or browser storage of its own under Google's privacy policy. You can read each video's transcript on its page instead, or watch it on YouTube directly.
Aggregate counts. We count a fixed set of public-page and example actions — homepage and solution-page views, starting or completing the guided example, choosing to sign in, and opening an authenticated app screen. Each event payload contains only the fixed action name. We store the total for each action and UTC day, with no visitor identifier, page URL, referrer, IP address or browser details. These counts use no cookie or browser storage and are not shared with an analytics provider.
At the edge. Our network provider may ask your browser to report failed connections to it so outages can be diagnosed, and keeps its own short-lived security logs of requests. That is the provider's processing on our behalf under the contract described in section 6.
10. Your rights
Under UK GDPR, and EU GDPR where it applies, you have the right to:
- be informed — which is what this policy is for;
- access the personal data we hold about you, and get a copy;
- rectification — have inaccurate data corrected or incomplete data completed;
- erasure — have your data deleted where one of the Article 17 grounds applies;
- restriction — have us pause processing while a dispute about accuracy or lawfulness is resolved;
- data portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider;
- object — object at any time to processing we base on legitimate interests (the security, troubleshooting and product-improvement purposes in section 5). We will stop unless we can show compelling legitimate grounds that override your interests, and we will explain the reasoning if we do. You can also object at any time to direct marketing, which we would then stop without exception — though we do not currently send any; and
- withdraw consent at any time where we rely on consent, without affecting processing done before you withdrew it.
How to use them. You can download your account data and delete your account yourself, from User settings → Data & deletion, and export your design data from within the Service at any time. For anything else, email [email protected]. We respond within one month, and will tell you if we need to extend that for a complex request. We do not charge for a request, and we will ask you to confirm your identity through your account email before acting on one.
If the data is in someone else's organisation, we are the processor, not the controller (section 1). Ask that organisation's owners; if you ask us, we will tell you who to ask and let them know you asked.
Complaints. If you are unhappy with how we handle your data, tell us first at [email protected] — we would like the chance to put it right. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or, if you are in the EEA, to your own national supervisory authority. Complaining to a regulator does not affect any other remedy you have.
11. How we protect your data
We apply technical and organisational measures appropriate to the risk, including encryption in transit, passwordless authentication with hashed credentials, role-based access control and tenant isolation between organisations. Our Security page describes these controls in detail and serves as the measures annex to our Data Processing Agreement.
If a personal data breach occurs, we assess it against the Article 33 criteria and report it to the ICO within 72 hours where required, tell affected customers without undue delay, and tell individuals directly where the risk to them is high. The Data Processing Agreement states what we commit to for Customer Data.
12. Children
The Service is a professional tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy. Each version carries a version stamp and effective date above, and we keep dated copies of superseded versions — ask [email protected] for an earlier one. If a change is material we will notify you by email or in the Service before it takes effect.
14. Contact
For any privacy matter, contact Railyard Tech Ltd at [email protected]. For security reports, see our Security page. For contractual matters, see our Terms of Service.