Privacy

What happens to the data in a request - for your own privacy notice, or if you simply want to know.

Forwarded to search.ch. Every request is passed on to timetable.search.ch, which provides the timetable. It receives the parameters of the request - for /locations with x and y, the coordinates - together with the caller's IP address, User-Agent and key, if one is given, because search.ch applies its rate limit per caller. What search.ch keeps, and for how long, is governed by its own privacy policy.
Access log. The server logs each request: the time, the IP address, the full request URL with its parameters (coordinates included), the status and the User-Agent. The log is kept for 90 days and used only to run the service: to find faults, to spot abuse and to judge the load.
Statistics. The public statistics count requests, errors and kinds of client, and list the station boards and connections asked for as they were written, without any link to a caller; these lists are deleted after 35 days. Distinct callers per day are counted as hashes of the IP address under a key that changes every day; once the day is over, only their number remains. Coordinates are not part of the statistics.
Nothing else. The API has no accounts, sets no cookies and does no tracking. Nothing is passed on to anyone but search.ch, and nothing is sold. The service is hosted in Switzerland.