Privacy Policy
Last updated: 18 May 2026. Effective: 18 May 2026.
1. Who we are
WS Truck Spotting is a community platform operated by William Stobart & Son Ltd (the "data controller", "we", "us") in partnership with Accelerate Outcome (technical operator and data processor). This policy explains how we collect and use your personal data when you use www.wstruckspotting.com, the WS Truck Spotting iOS and Android applications, and associated services (together, the "Service").
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data protection contact: privacy@wstruckspotting.com.
2. What data we collect
- Account data: email address, display name, optional bio, optional profile avatar image.
- Age confirmation: a record that you confirmed you were aged 13 or over at the point you first name a truck.
- Authentication data: magic link tokens (stored as SHA-256 hashes), session tokens, login timestamps.
- User-generated content: truck name submissions, stories, sightings you post (including photos and any GPS coordinates embedded at the point of capture).
- Location data: the latitude and longitude attached to a sighting at the moment you submit it. We do not track your location in the background.
- Technical data: IP address, user-agent string, and approximate request timing. We use this for rate limiting, abuse prevention, and security logging.
- Rewards data: points totals, tier, and activity history derived from your engagement with the Service.
- Donation records: when naming a truck requires a donation, we keep the amount you chose, your Gift Aid election, the charity you donated to, and an internal reference that links the donation to your truck-name submission. Card details are entered on JustGiving and we never see them.
3. Why we use your data (purposes and lawful bases)
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Create and operate your account | Email, display name, session | Contract (Art. 6(1)(b)) |
| Send magic sign-in links | Email, token hash | Contract (Art. 6(1)(b)) |
| Display sightings and directory | Sightings, display name, avatar | Contract and legitimate interest in running a community platform (Art. 6(1)(b), 6(1)(f)) |
| Rate limiting, security, abuse prevention | IP, request metadata | Legitimate interest (Art. 6(1)(f)) |
| Attribute a charity donation to your truck-name submission and show a confirmation | Donation amount, Gift Aid choice, charity id, donation reference | Legitimate interest (Art. 6(1)(f)) |
| Image moderation (SafeSearch) | Uploaded sighting photos and avatars | Legitimate interest in preventing unlawful or harmful content (Art. 6(1)(f)) |
| Enforce a block and prevent re-registration after serious or repeated breaches | One-way (irreversible) hash of your email address only | Legitimate interest in keeping the community safe (Art. 6(1)(f)) |
| Age gating (must be 13+) | Age confirmation flag | Legitimate interest and legal obligation |
| Optional marketing (if we add it later) | Email, preferences | Consent (Art. 6(1)(a)) you can withdraw at any time |
We do not process special category data, and we do not make automated decisions that produce legal or similarly significant effects about you.
4. How long we keep it (retention)
- Account profile: until you request deletion, or we deactivate inactive accounts after 24 months.
- Sightings and submissions: kept while your account is active. Deleted or anonymised when your account is deleted.
- Session tokens: 7 days, then automatically purged.
- Magic link tokens: 1 hour, then invalidated and purged.
- Rate limiting and security logs: up to 30 days.
- Backups: rolling 30-day encrypted backups.
- Donation records: kept for 3 years to support charity reconciliation and any donor queries, then automatically anonymised so that only the aggregate (amount, date, charity) is retained.
- Image moderation rejections:if an uploaded photo is automatically rejected as unsafe, the image is never stored; we keep a short record (the reason and content labels) so administrators can see a user's moderation history. Deleted with your account.
- Block list: if your account is blocked for a serious or repeated breach, we erase your account but retain a one-way (irreversible) hash of your email address indefinitely. The hash cannot be reversed to recover your email and no other personal data is kept; its only use is to stop the blocked email from logging in or registering again.
5. Who we share it with (processors and sub-processors)
We use the following data processors to operate the Service. Each is bound by a data processing agreement (DPA) with appropriate UK GDPR safeguards.
- Vercel Inc. hosting, edge delivery, Vercel Blob file storage. Data hosted in London (lhr1) region.
- Neon Inc. managed Postgres database, London (eu-west-2) region.
- Resend Inc. transactional email delivery (magic links, notifications).
- Cloudflare Inc. DNS and edge network.
- Mapbox Inc. map tiles and geocoding (when you view the map).
- Google LLC (Google Cloud Vision SafeSearch) image moderation for uploaded content.
- Scania CV AB fleet telemetry provider (returns vehicle GPS to the Service; does not receive personal data about users).
- JustGiving (Blackbaud)charity donation processor. When you make a donation, JustGiving handles the payment, Gift Aid claim, and disbursement to the charity. Card details are entered on JustGiving’s domain and are never sent to or stored by us.
Some providers are based in the United States. Transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU-US Data Privacy Framework where applicable.
6. Your rights
Under UK GDPR you have the right to:
- Access a copy of your personal data (right of access).
- Correct inaccurate data (rectification).
- Request deletion of your data (erasure, the "right to be forgotten").
- Receive your data in a portable machine-readable format (data portability). You can use the export tool at
/api/account/export. - Restrict or object to our processing.
- Withdraw consent at any time where processing relies on consent.
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
To exercise any of these rights, email privacy@wstruckspotting.com. We will respond within one month.
7. Children
The Service is not intended for people under 13. We require users to confirm they are aged 13 or over before they can name a truck. If we learn that we have collected data from someone under 13 we will delete it.
8. Security
We encrypt data in transit (HTTPS/TLS) and at rest. Passwords are not used. Authentication is by single-use magic link. Session and magic link tokens are stored as cryptographic hashes.
9. Mobile applications
The WS Truck Spotting iOS and Android apps are wrappers around the same web Service. This section covers practices that are specific to the mobile apps.
Device permissions. The apps may request the following permissions. Each is requested only when you use the related feature, and you can revoke permissions at any time in your device settings.
- Camera: to take a photo when submitting a sighting.
- Photo library: to pick an existing photo for a sighting or avatar.
- Location (precise, while in use): to attach the current latitude and longitude to a sighting at the moment you submit it. We do not collect location in the background and we do not track your movements.
- Notifications: if and when push notifications are offered, to deliver service messages you have opted in to. You can disable them in device settings at any time.
Identifiers and tracking.The WS Truck Spotting apps do not use the iOS advertising identifier (IDFA) or the Android advertising ID, and we do not display the App Tracking Transparency prompt. We do not track you across other companies' apps or websites, and we do not share your data with data brokers or advertising networks.
Analytics and crash reporting. The apps do not include third-party analytics or advertising SDKs at the date of this policy. If we add diagnostic or crash-reporting tools in future we will update this policy and the in-store privacy labels before release.
Account deletion in the app.You can permanently delete your WS Truck Spotting account from inside the app: open Settings, then "Delete account". The action deletes your account immediately and irreversibly: your user record, sessions, magic link tokens, truck and spotter follows, rewards activity, avatar, and any sightings that have not received likes are removed. Sightings that other users have liked are anonymised — your name is unlinked and the photo is retained for the community record. You can also email privacy@wstruckspotting.com to request deletion.
In-app links to this policy.A link to this Privacy Policy is available from the "More" tab in the app and on the sign-in screen, without needing an account.
Store privacy disclosures. The Apple App Store Privacy Nutrition Label and the Google Play Data Safety section summarise the same practices described in this policy. If you spot a discrepancy, this policy is the authoritative version and we will correct the store disclosures.
10. Changes to this policy
We will post any material changes on this page and update the "last updated" date above. Significant changes will be notified by email.
11. Contact
Questions or requests: privacy@wstruckspotting.com. Postal: WS Transportation Ltd, United Kingdom.