Privacy Policy
1. Who we are
Peron is made by XOD Group, medijska produkcija in marketing, d.o.o. ("XOD Group", "we", "us"). We decide how your personal data is used for Peron, so we are the controller under the EU General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
| Company | XOD Group, medijska produkcija in marketing, d.o.o. |
| Address | Tržaška cesta 132, 1000 Ljubljana, Slovenia |
| Registration no. | 9953671000 (District Court of Ljubljana) |
| VAT ID | SI41225716 |
| Privacy contact | info@xodagency.com |
This policy covers the Peron iPhone app, the websites at peron-app.com (including the German page) and the Peron beta programme. It explains what we collect, why, who else sees it and what you can do about it.
The short version: we collect as little as we can. Your trips live in your own iCloud, your location never leaves your iPhone, and we only keep your e-mail address if you sign up for the beta.
2. What we collect and why
Beta sign-up (website). When you join the beta or the waitlist, we collect your e-mail address and, if you give them, the line or route you ride most and your region. We use them to confirm your sign-up, to send you a TestFlight invitation when a place opens, to pick testers across different lines, and to send one message when Peron launches.
Beta testing (TestFlight). To invite you, we give your e-mail address to Apple, which runs TestFlight. While you test, Apple shares with us what you choose to send through TestFlight (feedback and screenshots) and technical data such as crash reports, device model and iOS version. We use this only to fix bugs and improve Peron.
Signing in. Peron uses Sign in with Apple. Apple gives us an anonymous user identifier and, if you allow it, your name and an e-mail address (which can be Apple's private relay address). We use them to keep your settings and trips tied to you.
Your trips, commutes and passport. The trips you save, your commutes and your rail passport are stored in your own iCloud account through Apple's CloudKit. We cannot read them.
Location. If you allow it, Peron uses your location during a trip you follow, to check that you are on your train (the "ride check"). This happens only on your iPhone. Your location is never sent to us and never stored by us. You can use Peron without location; it then asks whether you took the train.
Alerts and Live Activities. To tell you when to leave, when your train is late or when your platform changes, our server needs to know which trains you follow (train, date, your stations, your alert settings) and a push token from Apple for your device. We use them only to send those alerts.
Messages to us. If you write to us, we use your e-mail address and your message to answer you.
Website. The website sets no cookies and uses no analytics or advertising tools. Like any website, our host processes your IP address and basic request data to deliver the page and keep it secure. The page loads fonts from Google Fonts, so your browser connects to Google's servers.
We do not sell your data, show ads or build advertising profiles.
3. Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Beta sign-up, invitations, the launch message | Your consent, Art. 6(1)(a). You can withdraw it at any time. |
| Beta feedback and crash reports | Our legitimate interest in fixing and improving Peron, Art. 6(1)(f) |
| Signing in, alerts, Live Activities | Providing the service you asked for, Art. 6(1)(b) |
| Ride check with location | Your consent through the iOS permission, Art. 6(1)(a). The data stays on your device. |
| Answering your messages | Our legitimate interest in replying, Art. 6(1)(f) |
| Website delivery and security | Our legitimate interest in running a safe website, Art. 6(1)(f) |
| Keeping records the law requires | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interest, you can object at any time (see section 6).
4. Who else processes your data
We use a small number of service providers. They process data only for us and only as needed for their service.
| Provider | What for | Data |
|---|---|---|
| Google (Google Sheets) | Storing the beta sign-up list | E-mail address, line or route, region |
| Apple (TestFlight, Sign in with Apple, iCloud, push notifications) | Beta invitations, sign-in, storing your trips in your iCloud, delivering alerts | E-mail address, Apple user ID, push token; your iCloud data is held by Apple for you |
| Our server host [TO FILL] | Running the Peron server that sends alerts | Followed trains, alert settings, push token |
| Our website host [TO FILL] | Delivering peron-app.com | IP address, request data |
| Google Fonts | Loading the website's fonts | IP address, browser data |
Apple's and Google's own privacy policies also apply to your use of their services.
Transfers outside the EU. Some providers may process data in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
We share data with public authorities only when the law requires it.
5. How long we keep it
| Data | How long |
|---|---|
| Beta sign-up | Until you unsubscribe, or 12 months after Peron's public launch, whichever comes first |
| TestFlight feedback and crash reports | 12 months |
| Followed trains and push tokens | While you follow the trip; deleted 30 days after the trip, or when you delete the app or your account |
| Messages to us | 2 years after the conversation ends |
| Your trips and passport in iCloud | Until you delete them; they are in your iCloud, not with us |
| Location for the ride check | Not stored by us |
When the period ends, we delete the data or make it anonymous.
6. Your rights
You can ask us to:
show you the personal data we hold about you and give you a copy;
correct data that is wrong;
delete your data;
limit how we use it;
give you your data in a common, machine-readable format;
stop using it where we rely on legitimate interest.
You can withdraw your consent at any time, for example with the unsubscribe link in our e-mails. This does not affect what we did before.
Write to info@xodagency.com. We answer within one month. We may ask you to confirm your identity first.
You can also complain to the Slovenian data protection authority: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. If you live in another EU country, you can also complain to the authority there.
7. Other things to know
Children. Peron is not meant for children under 15. If you are younger, ask a parent or guardian before you sign up for the beta.
Security. We keep the data we hold to a minimum, use encrypted connections, and limit access to the people who need it to run Peron.
Cookies. Our website does not use cookies or similar tracking. If that changes, we will ask for your consent first and update this policy.
Changes. If we change this policy, we post the new version here with its date. If a change matters for how we use your data, we tell beta testers by e-mail or in the app.
Contact. XOD Group, medijska produkcija in marketing, d.o.o., Tržaška cesta 132, 1000 Ljubljana, Slovenia · info@xodagency.com
Last updated: [date of publication]