Legal notice and privacy policy
Last updated: 31 October 2026
Software developed on a non-profit basis. It is provided for academic or personal use.
This is a courtesy translation. The legally binding version is the Spanish one.
1. Legal notice
In compliance with Article 10 of Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE), the details of the owner of this website are provided below.
1.1. Owner
- Owner
- Andrés Marchante Tirado
- Tax ID (NIF)
- Address
- Website
- trenalia.org
- Qualification
- Telecommunications Engineer, qualification awarded in Spain
- Professional association
- Colegio Oficial de Ingenieros de Telecomunicación (COIT), membership no. 17752
1.2. Purpose and nature of the service
Trenalia is a personal, free and non-profit project that shows on a map the approximate position and status of trains in Spain, based on public data. It is not an official service and is not affiliated with Renfe, ADIF, Iryo, Ouigo or any operator or public authority. It has no advertising, sells nothing and charges nothing for its use.
The software is provided for academic or personal use. Any other use, especially commercial use, requires the owner's prior written permission.
1.3. Accuracy of the information
Positions, delays, incidents, warnings and statistics come from third-party public sources or are automatic estimates calculated from them. They may be incomplete, arrive late or contain errors. In particular:
- The positions of operators without public GPS are estimated from the timetable and the delay.
- Alerts of a possible rear-end or head-on conflict are rough calculations based on public data, with no access to signalling or railway safety systems. They may be false alarms or miss real risks. They are offered for information only and must not be used to make safety decisions.
- The answers of the Trenalito assistant are generated by artificial intelligence and may be wrong.
Before you travel, always check the information with your operator. In an emergency, call 112.
1.4. Liability
The owner does not guarantee that the service will be continuously available or that the data are accurate. To the extent permitted by law, the owner is not liable for damage arising from the use of the information shown, from interruptions, or from the content of third-party sites linked from here.
1.5. Intellectual property and sources
Trenalia's code and design are the work of its owner. The data belong to their respective owners and are used in accordance with their terms:
- Renfe Viajeros and ADIF: positions, routes, station boards and incidents published on their websites and open services.
- AEMET (Spanish State Meteorological Agency): weather warnings and weather station observations.
- NASA FIRMS: satellite-detected fire hotspots. IGN (Spanish National Geographic Institute): recent earthquakes.
- Railway lines © OpenStreetMap contributors (ODbL licence). Outlines: Natural Earth (public domain).
- Terrain elevation: AWS Terrain Tiles (Mapzen, derived from public sources).
- Detailed map: © CARTO and © OpenStreetMap contributors.
- Detailed map in the fast engine: OpenFreeMap © OpenMapTiles and © OpenStreetMap contributors; when enabled, your browser downloads the tiles from tiles.openfreemap.org.
- Earthquakes: Instituto Geográfico Nacional (IGN). Active fires and fire danger: Copernicus EMS / EFFIS. Electricity demand: Red Eléctrica (REData). «Network alerts», «sections at risk» and the «possible blackout» notice are estimates by Trenalia, not notices from Adif or Red Eléctrica.
- Station boards obtained through RadarDeTrenes, which reuses public data from Renfe and ADIF.
- Official Renfe, Ouigo and Iryo timetables published in GTFS format (data.renfe.com and the Spanish National Access Point for Multimodal Transport).
- Other operators: FGC train positions (Ferrocarrils de la Generalitat de Catalunya, CC BY 4.0), Euskotren and Metro Bilbao (Open Data Euskadi – Basque Government · MoveUskadi, CC BY 4.0) and Rodalies de Catalunya service status (Generalitat de Catalunya). Cercanías timetables: Renfe (open data).
- STRATOS GS provides its aGIS Open Geodata platform to the project free of charge. Through it, Trenalia shows Adif's official network and stations (INSPIRE segmentation, CC BY 4.0), active fires from Copernicus EMS / EFFIS, IGN earthquakes, AEMET observations, Copernicus EMS activations, GDACS alerts, DGT road closures (National Access Point). Fire danger (EFFIS) and land cover (CORINE Land Cover, EEA) are requested directly from their official services. Trenalia's server requests this data from aGIS and caches it; your browser does not connect to aGIS. «Sections at risk» are an estimate by Trenalia: a hazard near the track does not mean that services are affected.
- Libraries: Leaflet (BSD-2) and MapLibre GL JS (BSD-3).
The trademarks and trade names mentioned belong to their owners and are cited only to identify the source of the data.
1.6. Governing law
This notice is governed by Spanish law. For any dispute, the parties submit to the courts and tribunals that have jurisdiction under the law; if the user is a consumer, those of the user's place of residence.
Journey planner and connections: the journey planner and the connections-at-risk alerts are guidance calculated from public timetables (GTFS) of Renfe, Ouigo and Iryo and live data, with no commitment to reliability. Trenalia does not sell tickets or guarantee seats, times, tracks or connections: always confirm them with the operator. Purchase links go to each operator’s official website. If you turn on location, it is used only on your device; to find the nearest station, rounded coordinates (about 1 km) are sent and not stored.
2. Privacy policy
This policy explains what personal data are processed when you use Trenalia, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). Trenalia does not ask you to register, does not use third-party advertising or analytics, and does not sell or share your data.
2.1. Data controller
Andrés Marchante Tirado (Tax ID (NIF) ), . Contact for any privacy matter: andres.m.tirado@gmail.com.
2.2. What data are processed, why and for how long
Access log
Data: IP address (stored without its last block, that is, partially anonymised), date and time, page or service requested, response code, response time, browser and device type (derived from the user agent) and referring website.
Purpose: to keep the service secure, to detect and stop abuse and attacks, and to obtain aggregate usage statistics.
Legal basis: the controller's legitimate interest in the security and proper functioning of the service (Art. 6(1)(f) GDPR and Recital 49).
Retention: 90 days; after that they are deleted automatically. The full IP address is kept only for the first 7 days; after that it is stored without its last block.
Collaboration form
Data: name, email address, phone number (optional), type of collaboration and message. To prevent mass submissions, an irreversible fingerprint (cryptographic hash) of the IP address is also stored, not the IP address itself.
Purpose: to contact you in order to handle the collaboration you are offering.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box on the form and can withdraw at any time.
Retention: for as long as the collaboration is being handled and, at most, 24 months from the last contact, or until you ask for erasure.
Trenalito assistant
Data: the questions you type and the last few messages of the conversation, which are sent to generate the answer. Do not include personal data in your questions.
Purpose: to answer your questions about trains and about the project.
Legal basis: the provision of the service you request when you use the chat (Art. 6(1)(b) GDPR) and the legitimate interest in limiting abuse (Art. 6(1)(f)).
Retention: the Trenalia server does not store conversations. The conversation is kept only in your browser while the tab is open (session storage) and is deleted when you close it or press “restart”. The IP address is used only in memory, for one minute, to limit the number of questions.
Provider: the answers are generated by the artificial intelligence service of Cerebras Systems Inc. (United States), which receives the text of the question and the necessary rail data, but not your IP address or any identifier of yours.
Minimisation: before sending your question, Trenalia automatically removes any email addresses, phone numbers, Spanish ID numbers (DNI/NIE), IBANs and card numbers it detects. Even so, please do not type personal data in the chat.
Backup service: if the main provider fails, an artificial intelligence server managed by the controller is used. It receives the text and a pseudonymous identifier derived from your IP address (a non-reversible hash) to organise the cache and limit usage.
Administration panel
Only the administrator logs in. A technical session cookie is used for this. Visitors do not have user accounts.
The rail data collected for the history (train positions and delays) are not personal data.
2.3. Recipients and processors
No data are disclosed to third parties unless required by law. The following process data on behalf of the controller, with the safeguards of Art. 28 GDPR:
- The hosting provider of the server on which Trenalia runs.
- Cerebras Systems Inc., as the provider of Trenalito's language model (only the text of the questions).
- CARTO, only if you choose the “Detailed map”: your browser downloads the map tiles directly from its servers, which receive your IP address as with any website visit.
The data sources (Renfe, ADIF, AEMET, etc.) are queried by the Trenalia server. Your browser does not connect to them, so they do not receive your data.
2.4. International transfers
Using Cerebras Systems Inc. involves sending the text of Trenalito questions to the United States. The transfer relies on the safeguards under Art. 46 GDPR offered by the provider (standard contractual clauses of the European Commission) or on its participation in the EU-U.S. Data Privacy Framework, if certified. You can ask for information about these safeguards at the contact email. If you do not want your questions to be transferred, do not use the chat: the rest of Trenalia works without it.
2.5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent whenever you wish, without affecting the lawfulness of prior processing. Write to andres.m.tirado@gmail.com stating which right you are exercising. For access logs, include the IP address, the date and the approximate time, because there is no other way to identify you. You will receive a reply within one month at the latest.
If you believe your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
2.6. Minors
The collaboration form is not intended for children under 14 (Art. 7 LOPDGDD). If you are under that age, do not submit it without permission from your parents or guardians.
2.7. Security
Appropriate technical and organisational measures are applied:
- encrypted connection (HTTPS)
- access to administration protected by a hashed password and lockout after failed attempts
- isolated server running with minimum privileges
- content security policy
- automatic deletion of logs once their retention period ends
3. Cookies and storage in your browser
Trenalia does not use advertising, analytics or third-party cookies, and does not load third-party resources that track your visit (the fonts are those of your own device). That is why the notice you see on arrival is for information only: there is nothing to accept or reject.
It only stores the following technical and preference data in your browser. They are exempt from consent under Art. 22(2) LSSI-CE because they are necessary to provide the service as you configure it:
| Data | Type | Purpose | Duration |
|---|
| Light or dark theme | Local storage | Remember your choice | Until you delete it |
| Map layers, cab view preferences and welcome screen already seen | Local storage | Remember which layers and options you have switched on, and not show the welcome screen again | Until you delete it |
| Cookie notice already seen | Local storage | Not show this notice again | Until you delete it |
| Muted warnings | Local storage | Not show again the warnings you mute | 12 hours per warning; general mute, until you change it |
| Conversation with Trenalito | Session storage | Keep the chat while you browse | Until you close the tab |
trenalia.follow | Local storage | Trains you follow and the alerts you chose (delay, track, arrival at your station, compensation), to alert you while Trenalia is open. Your browser may ask permission to show notifications; nothing is sent to the server. | Up to 12 hours, or 20 minutes after the train stops running; also when you tap “Stop following” |
trenalia.trip | Local storage | The trip you set a course for (trains, stations, times and alerts already sent) | Until you end the trip or 2 hours after arrival |
trenalia.trip.geo | Local storage | Whether you turned on location for the trip (used only on your device) | Until you turn it off or end the trip |
trenalia.links | Local storage | Connections you are watching (train, station and destination), to alert you if they are at risk | Up to 3, for 12 hours |
trenalia_admin | Technical cookie | Administrator session (only in the administration panel) | Until logout or 8 hours at most, or 30 minutes of inactivity |
You can delete all these data from your browser settings (“Clear site data”). Trenalia will keep working with the default settings.
4. Security and reporting vulnerabilities
If you find a security issue, write to us at andres.m.tirado@gmail.com (also listed in /.well-known/security.txt). We appreciate your report. Please do not run tests that degrade the service or access other people’s data.
Trenalia charges nothing and does not process payments or card data. Administrative access is protected by a hashed password, attempt lockout, optional second factor, inactivity timeout and an audit log.
5. Changes to this text
This notice may be updated when the service or the regulations change. The date of the last update is shown at the top.