YOUR PHOTOS. YOUR COLLECTION.

Privacy policy

Last updated: 7 October 2026

Train Dex is an Android train spotting and collecting app provided by MboShu. This policy describes the app and this website. For privacy requests, contact the privacy inquiry form below.

Your collection on your phone

Train Dex stores your sighting photos, train classes, dates, optional station text and notes, favourites, preferences and cosmetic unlocks in private app storage on your device. There is no cloud collection sync. Google sign-in is required for online AI scanning; manual collecting needs no account. Your collection is not uploaded automatically. Camera and photo-library access are used to take or select the images you choose. Train Dex does not request GPS location; any station information is text you enter yourself.

Optional online train recognition

When you choose online recognition after the upload explanation, a resized copy of the selected image and an optional country hint are sent to the Train Dex recognition service and then to Google's Gemini API. The service re-encodes the image to remove embedded metadata before forwarding it. Other collection photos, notes and station text are not sent for recognition.

The Train Dex service processes the uploaded image in memory and does not save it or log its contents. Network providers may process technical information such as IP addresses, request times and operational logs. A verified Google account identifier is hashed to associate your scan allowance across devices. We do not store your Google profile, email or password in the scan service. Usage counters support daily and monthly quotas. Request identifiers, image fingerprints and recognition results are cached for up to 24 hours to avoid charging duplicate submissions; image files are not retained. Recognition results are suggestions and may be incorrect.

Google's handling of recognition content is governed by the Gemini API terms. Paid-service terms exclude use of prompts and responses for product improvement, but allow limited safety-related retention. Unpaid-service terms outside the EEA, Switzerland and UK can allow product improvement and human review; those regions have a separate data-use provision. Avoid photos containing people or sensitive information. You can collect manually without using recognition.

Advertising and privacy choices

Train Dex integrates Google AdMob for full-screen ads and optional rewarded ads. When advertising is enabled and permitted, Google's SDK can collect or share IP addresses (including approximate location inferred from them), advertising/device identifiers, ad and app interactions, and diagnostic information for advertising, measurement and fraud prevention. The app does not send your train photos or collection notes to AdMob.

Where required, a Google consent form lets you manage advertising choices before eligible ad requests. You can revisit the available form through the app's Settings privacy options. Advertising availability depends on your choices and Google's services. See Google's privacy policy and how Google uses information for advertising.

Optional purchases

The permanent ad-removal upgrade is a one-time Google Play purchase. Google processes payment and your payment details are not sent to Train Dex. To verify ownership, the app sends the product identifier and Google purchase token to the Train Dex service, which checks Google Play. Ad-removal tokens are checked without being retained. Train Dex Plus is a separate monthly subscription providing 100 AI scans per paid billing period; it does not remove adverts. For Plus, the service retains the purchase token, hashed account identifier, billing order, expiry and usage counts to verify access and handle renewals, cancellations and refunds. These are private backend records, never public or included in collection backups. Purchase tokens and payment details are not logged. Verified ownership is cached securely on the device and refreshed when connected. Buying the upgrade suppresses future ad requests; it does not erase information previously processed by Google.

Keeping and deleting information

Use Settings → Delete online scan account to remove the account's current stored subscription token and disconnect online subscription access. This does not cancel a Google Play subscription: manage or cancel it in Google Play separately. It does not delete your local collection. Limited hashed usage and purchase-binding records are kept for up to 90 days after deletion to prevent quota resets and purchase replay. Active subscription records are otherwise retained while needed for verification and for up to 90 days after their recorded expiry or last use. You can also request account deletion through the privacy inquiry form without the app.

Collection information stays on the device until you delete it or uninstall the app. Deleting a sighting removes its app-managed photo copy; it does not delete the original from your phone's gallery. Exported backups contain photos and collection information and remain wherever you save or share them until you remove them yourself. Purchase restoration may recover Google Play ownership after reinstalling. Information held by Google or hosting providers follows their retention policies.

Security, processing and your rights

Public recognition and purchase verification services use HTTPS. Local development connections may use HTTP on a private network. App credentials and verified purchase state use secure device storage. No system guarantees absolute security. Service providers may process information outside your country.

Depending on where you live, you may have rights to access, correct, delete or restrict use of personal information, object to processing, withdraw consent or complain to a data-protection authority. You can manage the local collection directly in the app. Contact us for other requests; we cannot retrieve photos that exist only on your phone. Google manages its own advertising and payment records.

This website and privacy inquiries

This website is hosted by Cloudflare. Cloudflare processes connection and security information to serve the pages and protect its network; see Cloudflare's privacy policy. Website AdSense advertising is being configured but is not enabled. This version does not load advertising scripts or set advertising cookies. The site has no separate analytics trackers. If you use the privacy inquiry form, your reply email, topic and message are saved privately in the MboShu Cloudflare account for up to 30 days, then expire automatically. We use them to answer your request, including privacy requests. Hashed daily network identifiers and request counts are kept for up to 24 hours to limit abuse; raw IP addresses are not stored in the privacy inbox. No attachments are accepted. Do not send passwords, API keys, purchase tokens or sensitive information. A reply, if needed, is handled separately by MboShu; this website does not send automated emails.

Audience and policy changes

Train Dex is intended for adult train enthusiasts and is not directed at children. We may update this policy as the app or services change. The date above identifies the latest revision.

Privacy contact: MboShu — the privacy inquiry form below.