Privacy Policy

Last updated 22 August 2026 · Effective 22 August 2026

Noricho records train rides. That means it handles location data, which is about as personal as app data gets. This page describes what the app actually does with it — not what a template says a policy should claim.

Who is responsible

Noricho is an independent project run by an individual developer, not a company, and it is not affiliated with, endorsed by or connected to any railway operator. For anything in this policy, write to privacy@noricho.com.

What Noricho collects

Location, while you are hunting

The whole app rests on one idea: a station stamp means you were actually there. That only works with real location data.

• Noricho requests “While Using the App” location permission together with the iOS background location mode, so a hunt keeps crediting segments with your phone in your pocket. It never requests “Always” location.
• Location is read while a hunt is running, and when you check in at a station to claim a stamp. Those are the only two times a position is recorded or sent anywhere. The one other read is the home screen, which asks the phone for the position it already has — the cached last-known fix, which costs no GPS — so the line picker can put what is near you at the top. That one is used on your phone and never leaves it.
• Stopping a hunt stops the tracking. There is no passive or background collection between hunts.

What a completed ride uploads

When you confirm a hunt while signed in, the app sends the ride to the Noricho server so it can be credited and so your collection survives losing your phone. That upload contains:

• the station and segment identifiers the engine resolved — which stations you boarded and alighted at, which stretches of track you covered, and which stations were stamped;
• the start and end time of the ride, and its duration;
• a sampled GPS trail of at most 300 points — latitude and longitude rounded to six decimal places, plus a timestamp, an accuracy figure and a speed for each. The full trail your phone recorded is not uploaded; it stays in the app’s local database;
• a confidence tier and any quality flags the engine raised, and the version of the rail dataset the ride was matched against;
• on the fifteen lines with a realtime train feed, the train number your ride was matched to, so the server can resolve which rolling-stock class you were on.

Rides you never confirm are not uploaded. If you use Noricho without signing in, nothing is uploaded at all — your collection lives only on your phone, and is lost if you delete the app.

Account

Signing in is optional and uses Sign in with Apple or Sign in with Google. Noricho never sees or stores your password. From the provider it receives an account identifier, an email address and, where the provider supplies one, your name. If you use Apple’s Hide My Email, Noricho only ever sees the relay address.

Your account also holds a display name and an optional handle, your XP, level and unlocked achievements, and a switch controlling whether your profile is public.

Diagnostics, so bugs can be found at all

So the app sends anonymised diagnostic events to PostHog, a product-analytics service, hosted in its US region. What goes in one of those events:

• What the engine decided, and how confidently — which line it matched, how many segments it credited, which questions it had to ask you, and where in its own ranked list your answer sat. That last one is the most useful thing in the whole system: it is how we learn the engine guessed wrong without anyone being in Japan to see it.
• The shape of a GPS trail — how many fixes, how accurate they were, and how long the longest gap with no signal lasted. This is how underground behaviour gets tested at all.
• Failures — rides that could not be credited, uploads the server refused, crashes and errors, with the technical reason.
• Which build and which phone model, so a fault that only happens on one of either can be found.

What deliberately does not go into a diagnostic event:

• No coordinates. Not one, ever. Diagnostics carry the shape of a trail — accuracy figures, gaps, counts — never a position.
• No station identifiers. A line name says which line misbehaved; a station name would say where you live. Only line names are sent.
• No location derived from your IP address. PostHog can work out a city from the connecting address; that is switched off, and the project is set to discard client IP addresses.
• No screen recording, and no session replay of any kind.
• No email address, no display name, no handle.

If you are signed in, these events are tagged with your account identifier, so a recurring fault reads as one rider hitting it five times rather than five separate strangers. Signed out, they carry only a random device identifier. Deleting your account does not automatically erase past diagnostic events — write to privacy@noricho.com and they will be removed.

Support messages

If you report a problem or a data error from inside the app, Noricho sends the message you wrote, what it was about (a station, a line, a ride), the dataset version and the app version. Reports made while signed in are attached to your account so a reply is possible.

Reporting another rider

If you report a handle, Noricho sends the handle you reported, the reason you picked, and — if you write one — up to 1,000 characters of your own text. It is held for handling abuse, and it is not shown to the person you reported. Reporting also blocks them for you straight away, so you do not have to keep looking at them while it is dealt with. Blocking on its own sends only the pair of accounts, and no message.

What Noricho does not collect

• No advertising identifiers, and no advertising.
• No behavioural tracking, no advertising profiles, and no data sold or shared with data brokers.
• No contacts, photos, calendar, microphone, camera, or health and fitness data.
• No payment details. Noricho does not sell anything.
• No location sent anywhere when a hunt is not running and you are not checking in. The home screen reads the phone's cached last-known position to sort the line picker; it stays on the phone.

Why Noricho holds it

Who can see your data

Your profile is private by default. While it is private, other riders cannot see your name, your handle, your rides or your collection, and you appear on leaderboards only in anonymised form.

If you switch your profile to public, other signed-in riders can see your handle or display name, your level and XP, your rank on the leaderboards, and summary counts of what you have collected. They never see your GPS trails, the individual rides behind those counts, or your email address. Turning the switch back off removes your identity from those boards again.

Where it is stored, and who processes it

Ride and account data is stored on Supabase (Postgres and authentication), hosted in the Tokyo region (ap-northeast-1) — the same country as the railways the app is about. Supabase acts as a processor on the developer’s instructions.

Sign-in is handled by Apple and Google, each under their own privacy policy. Realtime train information comes from the Open Data Challenge for Public Transportation through a server-side proxy that asks about a railway line and never sends your location or any identifier to it.

Diagnostic events go to PostHog Inc., hosted in its US region, as a processor on the developer’s instructions. Note this is a different country to your ride data, which stays in Tokyo — the two are separate systems and PostHog never receives ride contents.

This site is served by Vercel and Cloudflare, which process the usual web-server request logs. The site itself sets no cookies and runs no analytics — the diagnostics described here are in the app, not on this page. It loads a webfont from Google Fonts, which means Google receives the request for that font file.

Noricho does not sell your data, does not share it for advertising, and does not use it to train machine-learning models.

How long it is kept

• Rides, stamps and collection data are kept while your account exists — that is the point of a collection.
• Sampled ride trails are capped at 300 points per ride and are deleted with the ride.
• Deleting a single ride in the app deletes its trail with it.
• Deleting your account deletes everything attached to it, immediately and by cascade.
• Support messages are kept while they are useful for fixing the thing you reported.
• Diagnostic events are kept for up to 12 months and then expire. They are not deleted by deleting your account, because they are not stored with it — ask and they will be removed.

Your choices and your rights

• Delete everything. Delete your account has the steps, including how to ask if you no longer have the app. There is a delete-account control inside the app. It removes your account and, by database cascade, your rides, trails, stamps, progress and profile. It is immediate and cannot be undone.
• Stop location access. Revoke location permission in iOS Settings at any time. Hunts will stop crediting segments; nothing else breaks.
• Go private again. Turn the public profile switch off.
• Use it signed out. Noricho works without an account. Nothing leaves your phone.
• Access, correction, portability and objection. If you are in the EU, the UK or another region with equivalent rights, write to privacy@noricho.com and you will get a copy of your data, a correction, or an erasure. You also have the right to complain to your local data protection authority.

Children

Noricho is not directed at children. It is rated 12+ and should not be used by anyone under 13. The developer does not knowingly collect data from children under 13; if you believe a child has an account, write to privacy@noricho.com and it will be deleted.

Changes

If this policy changes in a way that affects what is collected or who can see it, the date at the top changes and the app will tell you before the change takes effect. Older versions are in the site’s git history.

Contact

privacy@noricho.com for anything on this page, or the support page for everything else.