Train Kothay (ট্রেন কোথায়)HR Automation

Privacy Policy

Train Kothay (ট্রেন কোথায়)

Last updated: November 6, 2026

1. Introduction

Train Kothay (ট্রেন কোথায়) is a train tracking and journey-information service operated by HR Automation. It helps users view estimated train positions, train schedules, stations, route information and, where enabled, share journey details. This policy describes how information is processed when you use the website or app. Train Kothay is an independent information platform and is not an official Bangladesh Railway or Government of Bangladesh service unless explicitly confirmed by the relevant authority.

2. Who Controls Your Information

HR Automation operates this service. For privacy requests, contact Kazi Md. Shakawat Hossain using the contact details in Section 17. Your use of a feature does not by itself replace any explicit consent required by applicable law.

3. Information We May Process

  • Journey information: chosen train or route, origin and destination stations, intended travel time and sharing preferences.
  • Location information: GPS or approximate position, accuracy and timestamps, when location-based features are enabled and appropriate permission is granted.
  • Account details: name, display name, email, phone number or login identifiers, only if such account functions are provided.
  • Technical information: IP address, device type, app/browser version, error logs and information required to maintain or secure the service.
  • User submissions: voluntary train-location updates, corrections, reports or support messages.

Not every category is collected from every user. We should only request information necessary for the feature being used.

4. How Data Is Collected and Used

Information may be provided directly by you, generated while you use an activated feature, or received from technical providers and railway information sources. Processing purposes include showing train positions and schedules, enabling optional journey sharing, evaluating reports, responding to requests, preventing misuse, ensuring reliability and meeting legal obligations. Where consent is needed, it should be specific, informed and withdrawable.

5. Live Train Position: Accuracy and Sources

Displayed locations may be derived from passenger-contributed GPS updates, available external data, or calculated estimates. A train marker may represent a last-known or estimated position rather than a verified, continuous railway GPS feed. Network disruption, GPS errors, low reporting frequency, incorrect train selection and false contributions can affect accuracy. We may use timestamps and quality signals to evaluate submitted positions. Do not treat an on-screen train marker as an official operational or safety instruction.

6. Device Location, Background Access and Consent

The App may request approximate or precise location only for location-dependent functions. If a feature requires background location, users must be clearly told before enabling it, and the appropriate device permission must be obtained. You can revoke location permission in device settings and stop participating in a location-sharing feature through any controls made available. Turning off permission may disable certain functions but should not prevent access to unrelated timetable or station information. Implementation check: the operator must accurately disclose whether the released app actually collects background location, and when collection starts and stops.

7. Sharing a Trip With Others

A trip-sharing feature may expose a selected train, origin/destination, route progress, current or last-reported position, and estimated arrival information to people who receive the sharing link. A forwarded or unrestricted link can be seen by others. You should share links only with trusted people and avoid publicly posting precise journey information. Disabling sharing can stop subsequent updates, but cannot retrieve screenshots or copies already made by recipients. Implementation check: specify whether your links expire automatically and whether viewers need authentication.

8. Timetables, Stations and External Data

Railway schedules, stop lists, station amenities, route descriptions and arrival estimates may come from official publications, public materials, service providers and voluntary reports. These sources can be incomplete or outdated and train operations can change without notice. Confirm critical departure, arrival, platform and service information with Bangladesh Railway or the relevant station authority. This App is not an emergency alert or railway operations system.

9. Sharing With Service Providers and Authorities

Information may be processed by suppliers needed to run the platform, such as hosting, maps, authentication, analytics, notifications and security providers, if those services are actually integrated. A journey you deliberately share may be viewed by its recipients. We may disclose data in response to valid legal requirements or to investigate misuse where permitted by law. We do not intend to sell precise personal location data to advertisers or data brokers. Implementation check: list the actual suppliers and advertising practices before publication.

10. Retention and Deletion

Information should be retained only as long as necessary for its stated purpose or a lawful obligation. Different schedules may apply to live-location updates, completed trips, account records, service logs, requests and backups. When no longer needed, information should be deleted or de-identified securely, subject to lawful exceptions. Before publishing, insert the real retention periods: live GPS updates [___]; trip history [___]; server/security logs [___]; backup deletion [___]. Do not promise instant deletion if your backups or operational systems do not support it.

11. Security Measures

We aim to maintain safeguards suited to the sensitivity of location data, including access restrictions, protected transmission, account safeguards, service monitoring and incident-response practices as implemented. No internet service is entirely risk-free. Users should protect their devices and avoid disclosing private sharing links. Security incidents will be assessed and handled under applicable legal obligations.

12. Your Rights and Choices

Subject to applicable law and appropriate identity checks, you may seek access to personal data, correction of inaccurate data, withdrawal of consent, deletion where eligible, and information concerning processing or transfers. You can also manage device permissions. Send requests to the privacy contact in Section 17. We may need to retain limited information where a legal obligation or valid claim requires it.

13. Children and Passenger Safety

The sharing of a child's identifiable journey or precise location raises additional risks. Users under 18 should use location-sharing functions only with appropriate parent or guardian involvement and any authorization required by law. Do not submit another passenger's private location, contact information or images without a lawful basis. Report suspicious or abusive sharing to our support address.

14. Cookies, Analytics and International Processing

The website or app may use essential cookies/local storage and technical services needed to operate. Optional analytics, marketing or third-party tracking must be disclosed and consent obtained where required. Some actual service providers may process data outside Bangladesh; any such transfers must meet applicable legal requirements. Implementation check: identify real providers, cookie categories, countries and permissions before launch.

15. Service Disclaimer and Responsible Use

Train Kothay is intended to assist travel planning, not replace official railway communications. Train markers, speed, delays, predicted arrivals or station details can be wrong, delayed or unavailable. To the extent permitted by law, HR Automation does not guarantee uninterrupted availability or complete accuracy. Nothing here removes consumer or privacy protections that cannot legally be excluded. Users must not deliberately submit fabricated positions, harass passengers or use shared locations to stalk or endanger anyone.

16. Changes to the Policy and Applicable Law

We may update this policy when features, processors, risks or legal requirements change, and will revise the date shown above. Material changes will be communicated and fresh consent obtained where legally required. The policy is intended to be interpreted under applicable laws of Bangladesh, including the Personal Data Protection Act, 2026, subject to relevant commencement and implementation provisions. Other laws may apply depending on user location.

17. Privacy Contact and Complaints

Application: Train Kothay (ট্রেন কোথায়)
Organisation: HR Automation
Privacy Contact/Officer: Kazi Md. Shakawat Hossain
Address: 548, Shaheenbagh, Tejgaon, Dhaka, Bangladesh
Privacy Email: kazimdshakawat@empulsehris.com
Support: support@empulsehris.com
Telephone: +880 1716 017126
Website: https://traintracking.empulsehris.com

Use these contacts to raise privacy requests, report a suspected data exposure or request correction of inaccurate journey information.

18. Advertising and Google AdMob

The Android app uses Google AdMob through the Google Mobile Ads SDK to display banner, native, interstitial and app-open advertisements. Advertising supports this free service. Google may process device identifiers, IP-based approximate location, ad interactions and diagnostic information to deliver ads, measure performance and prevent fraud. See Google's Privacy Policy and Google Mobile Ads data disclosures.

We do not pass your precise GPS coordinates, location reports or selected train to advertising requests. This does not prevent Google from deriving approximate location from network information. Where required, Google's User Messaging Platform presents privacy choices before ads are requested. When applicable, you can reopen these choices from Settings → Advertising privacy choices.

Ads do not unlock essential timetable or tracking features. Live tracking and location-sharing controls do not display full-screen ads. Ad availability varies by network connectivity, consent choices, advertiser availability and account approval.

Operator's pre-publication checks: Complete the bracketed retention values and verify live/background GPS handling, sharing-link rules, actual service providers and analytics. Remove this box once reviewed.

19. Guest accounts, profiles and synchronized data

On first use, we create a guest installation record using a random private credential. FCM registration tokens are stored separately for notifications and may change. A token is not treated as proof of your personal identity. Installation and last-seen records help us measure active use; guest counts and reinstalls do not represent an exact count of people.

You may optionally register using your name, email or phone number and a password. Contact details are not verified by SMS or email in this release. Passwords are hashed. Existing accounts are linked only after password authentication. Adding a registered contact to a different guest does not grant access to that account.

Favorites, recent searches (up to 50), viewed trains, and personal shared-journey history synchronize between web and mobile after sign-in. Guest information stays with that installation until you register or sign in. The mobile app caches saved items and queues changes while offline. Browser sign-in uses HttpOnly cookies and server-side sessions.

You can clear recent activity in Saved & history. To delete your account and its personal saved data, use My profile → Delete account and saved data, or follow the instructions at Delete account. Registered accounts require the current password. Deletion removes personal contacts, favorites, search/journey history, raw location reports and notification registrations; an inactive internal user record remains for database integrity. Aggregate train-position estimates do not identify individual users.

Notifications depend on permission, connectivity and valid device registrations. Service notices are queued only for opted-in, recently active installations. We do not promise delivery solely because an FCM token exists.

Journey wallet and community features

Uploaded e-ticket PDFs are stored privately for your account until you delete the journey or account. Tickets can contain identity, contact, payment and QR information; only upload your own ticket or a ticket you are authorized to store. The original PDF is retained for your later viewing. Extracted journey metadata excludes PNR, NID and passenger names. A route, class, passenger category and base fare per seat may contribute to public historical fare estimates without linking your identity or ticket. XTRA and inseparable mixed-category prices are excluded. Historical prices are not current official quotes.

Public pages may load Google AdSense advertising and use advertising cookies or similar identifiers according to your consent choices. Private ticket and chat pages do not load the website advertising script. Recent train-room presence is used to display an active-viewer count; presence entries are short-lived. Train-room messages, your display name and profile photo, replies and approved station photos are public. Private messages are accessible to participants and service administrators for support or abuse review; they are not end-to-end encrypted. Exact phone/email lookup requires a registered account, limits requests, and does not expose a contact directory. Use block/report controls. Station reports check a fresh location but do not publish your raw coordinates. Uploaded photos are re-encoded to remove metadata and await moderation. Account deletion removes personal tickets, images and messages; already received notifications, third-party copies or shared screenshots may remain outside our control.

Journey reminders and arrival alerts require your permission and may be delayed by phone settings, battery restrictions, poor connectivity or stale GPS. Optional project donations provide no digital benefit and are disabled until a public payment destination is configured.

Referral sharing and optional rewards / রেফারেল শেয়ার ও ঐচ্ছিক পুরস্কার

If you choose promotional sharing, a random referral code links the public install/trip link to your account without exposing your name, phone number or user ID in that link. We may process the code, Google Play Install Referrer data, installation/account identifiers, an FCM token hash, first/last use and return-activity dates to attribute installs, remove known duplicates and review reward eligibility. Link opens use a random first-party cookie for up to 30 days; stored visit counts use its hash. Clicks, attributed installs and qualified activity are separate and do not guarantee a reward.

Account deletion removes associated referral links and attribution records. Sharing a trip uses the train’s public estimated location and a map snapshot; it does not add your contact details or personal GPS trail to the banner. Installed sharing apps are checked locally to offer sharing buttons, and that app list is not sent to our server. You choose the social app and confirm the recipient/post yourself. Campaign rules and the organizer’s contact are at /rewards.

প্রচারমূলক শেয়ারে একটি এলোমেলো রেফারেল কোড আপনার অ্যাকাউন্টের সাথে ইনস্টল লিংক মেলায়; লিংকে আপনার নাম, ফোন বা ইউজার আইডি দেখানো হয় না। ইনস্টল ও অ্যাকাউন্টের পরিচয়, Google Play-এর রেফারেল তথ্য, FCM টোকেনের হ্যাশ এবং ব্যবহারের তারিখ দিয়ে নকল রেফারেল বাদ দেওয়া ও যোগ্যতা যাচাই করা হতে পারে। ক্লিক, রেফার করা ইনস্টল ও যোগ্য সক্রিয় ব্যবহার আলাদা; পুরস্কার নিশ্চিত নয়। অ্যাকাউন্ট মুছলে সংশ্লিষ্ট রেফারেলের তথ্য মুছে যায়। ট্রিপের ব্যানারে ট্রেনের প্রকাশ্য আনুমানিক অবস্থান থাকে, ব্যক্তিগত ফোন/ইমেইল বা GPS চলাচলের ইতিহাস নয়। কোন শেয়ার অ্যাপ ইনস্টল আছে তা ফোনেই যাচাই হয়; সেই তালিকা সার্ভারে পাঠানো হয় না। শেয়ার অ্যাপে আপনি প্রাপক বেছে পোস্ট নিশ্চিত করেন। নিয়ম ও যোগাযোগ এখানে।

Passenger help and lost-and-found

When you submit a report, we store your account reference, report category, title, description, optional train/station reference, submission times, review status and staff replies. Support requests and staff replies are private to your account and administrators. Lost/found notices become public only after review; public fields exclude your account ID and staff replies. Do not include contact numbers, identity documents, payment data or ticket QR codes in public reports. You may withdraw a notice. Account deletion removes your associated reports. Guest reports move with your account when you sign in and merge your installation.

সহায়তা বা হারানো-পাওয়া রিপোর্টে অ্যাকাউন্টের পরিচয়, ধরন, শিরোনাম, বিবরণ, ঐচ্ছিক ট্রেন বা স্টেশন, সময়, পর্যালোচনার অবস্থা ও উত্তর সংরক্ষিত হয়। সহায়তার অনুরোধ ও উত্তর শুধু আপনার অ্যাকাউন্ট ও প্রশাসক দেখতে পান। হারানো-পাওয়ার পোস্ট পর্যালোচনার পর প্রকাশ হয়; সেখানে অ্যাকাউন্ট আইডি বা কর্মীদের উত্তর প্রকাশ হয় না। জনসমক্ষে যোগাযোগ নম্বর, পরিচয়পত্র, অর্থের তথ্য বা টিকিটের QR দেবেন না। রিপোর্ট সরাতে পারবেন। অ্যাকাউন্ট মুছলে যুক্ত রিপোর্ট মুছে যায়।

If the passenger enables “Allow calls to my mobile for order confirmation”, their profile number is shared only with the assigned responder in private chat. অর্ডার নিশ্চিত করতে কলের অনুমতি দিলে যাত্রীর প্রোফাইলের নম্বর শুধু সাড়া দেওয়া সেবাদাতার ব্যক্তিগত চ্যাটে শেয়ার হয়।

Food, bedding and train-service requests / খাবার ও বেডিং অনুরোধ

Registered passengers can share request text, selected items, name, train, coach and seat with people checked in on the same train. We store the account and train references, item selections, request text, delivery/receipt status and timestamps. Nearby-train lookup coordinates are processed for matching and are not stored by that lookup; voluntary journey location sharing is covered above.

Food delivery, bedding and train-staff roles are self-declared, not identity verification or railway endorsement. Opted-in service people receive matching requests only while checked in on the same train. Notifications may include the requester’s name, train, coach, seat and a request excerpt through Firebase and Apple/Google notification services. Phone settings control background banners; private unread-request polling also supports in-app alerts.

A responder explicitly chooses Respond & chat before a snapshot of their mobile number is shared privately with the requesting passenger. Numbers are excluded from the shared train request board. Request records and shared-contact snapshots become eligible for cleanup after 30 days; cleanup runs with request access and the notification worker. Chat messages follow the existing chat/account-deletion rules. Roles remain until changed or the account is deleted. Account deletion removes related requests, contact snapshots and alert receipts. Passengers can report or block abuse and cancel eligible requests.

Item illustrations are request-writing shortcuts, not a current official menu or stock list. Availability and prices must be confirmed with the responder. Train Kothay does not process food/bedding payments or claim to be the official railway caterer.

নিবন্ধিত যাত্রী নিজের অনুরোধ, নাম, বাছা জিনিস, ট্রেন, বগি ও আসন একই ট্রেনে চেক-ইন করা ব্যক্তিদের দেখাতে পারেন। অনুরোধ, সরবরাহ/হাতে পাওয়ার অবস্থা ও সময় সংরক্ষিত হয়। কাছের ট্রেন খোঁজার অবস্থান ওই খোঁজে সংরক্ষিত হয় না। সেবার পরিচয় নিজের ঘোষণা, পরিচয় যাচাই বা রেলের অনুমোদন নয়। সম্মতি দেওয়া সেবাদাতারা শুধু একই ট্রেনের সংশ্লিষ্ট অনুরোধ পান। বিজ্ঞপ্তিতে নাম, ট্রেন, বগি, আসন ও অনুরোধের অংশ থাকতে পারে। সাড়া দিয়ে চ্যাটে সম্মতি দিলে সেবাদাতার মোবাইল নম্বর শুধু ওই যাত্রীর ব্যক্তিগত চ্যাটে শেয়ার হয়। ৩০ দিন পরে অনুরোধ ও শেয়ার করা নম্বর পরিষ্কারের যোগ্য হয়; অনুরোধ দেখা ও বিজ্ঞপ্তির কর্মী চালু থাকলে পরিষ্কার হয়। অ্যাকাউন্ট মুছলে সংশ্লিষ্ট অনুরোধ, নম্বর ও সতর্কবার্তা মুছে যায়। চ্যাটের বার্তায় আগের নিয়ম প্রযোজ্য। ছবি শুধু অনুরোধ লেখার শর্টকাট, সরকারি মেনু বা মজুতের নিশ্চয়তা নয়; কী পাওয়া যাবে ও দাম সেবাদাতার সঙ্গে নিশ্চিত করতে হবে। অ্যাপ পেমেন্ট নেয় না।