Privacy
Privacy notice
ETA is designed to keep as little as possible. Your destination never leaves your phone.
Who we are: ETA (eta.me.uk) is run by Steven Smith, who is responsible for your data. Contact: hello@eta.me.uk. Last updated 21 October 2026.
Kept on your phone only
- Your destination and the journey’s progress, places you save, and the map position you last looked at.
- Your location readings during a journey (used on the phone to work out distance and the estimate).
- Your choice about ads cookies.
These are stored in your browser’s local storage. We can’t see them. Clear them by clearing this site’s data in your browser.
What reaches our server
| What | Why | How long |
|---|---|---|
| Postcode or place you search for | Passed to postcodes.io to find it on the map. Not stored. | Not kept |
| Your email address (encrypted) and the name you choose — only if you create an account | To sign you in and to tell your contacts who the alerts are from | Until you delete your account |
| Your contacts’ names and email addresses (encrypted), and whether they confirmed | To email them for you, only after they confirm | Until you or they remove them, or you delete your account |
| A “Tell my people” journey: who to tell, an optional nickname for the destination, start/end times, which emails were sent | To send the alerts once each | Deleted 7 days after the journey started |
| Your latest position, accuracy and estimate — only if you switch on a live ETA link | To show it on the live page | Overwritten every update; deleted when the journey ends, and journeys end after 24 hours at most |
| A record that an email was sent (who to, what kind, when — not its text) | Daily limits and abuse protection | 90 days |
| A one-time sign-in link (hashed) and your encrypted email | To sign you in | 1 day |
| Rate-limit records with a scrambled (keyed hash) form of your IP address | To stop abuse | 3 days |
| Signed-in devices (a label like “Chrome on Android”) | To keep you signed in | 90 days after last use |
| A “never email me” block: a keyed hash of the address | So we never email someone who asked us not to | Kept indefinitely so the request keeps working |
Like most websites, our web server also keeps standard access logs (such as IP address, page requested and time) for security and fixing problems.
If someone added you as a contact
A person who knows you gave us your name and email address so ETA can send you arrival alerts from them. We emailed you once to ask; you only get alerts if you said yes. Every email lets you stop alerts from that person, or block your address from ETA completely. If you said no, we keep your address only as a scrambled block so they can’t invite you again.
Other services involved
- Map pictures are loaded by your browser straight from OpenStreetMap’s tile servers (or another tile provider if we change it). They see your IP address and which map squares you look at — so roughly the area on screen — as with any online map. See the OpenStreetMap tile usage policy.
- postcodes.io receives your search text from our server (not from your phone, so it doesn’t see your IP address).
- Email is sent through our web host’s mail system and delivered by your contacts’ email providers.
We don’t sell data, and we don’t use analytics or tracking scripts.
Ads and cookies
The app uses only essential cookies: eta_b (protects forms, 90 days), eta_s (keeps you signed in, 90 days) and eta_f (a one-off message, 2 minutes).
Some guide pages show up to two banner ads from 5od (5od.co.uk), a small ad service run by ETA’s owner. They’re contextual: 5od picks a banner to suit the page, not you. 5od itself sets no cookies; your browser sends it the site, ad position, size and page address (see 5od’s privacy page). The banners come from advertisers on the Awin affiliate network, which may set cookies when a banner loads or is clicked. That’s why banners load only after you choose “Accept ads cookies”; if you reject, nothing is requested from 5od or Awin. Change your choice with “Cookie settings” at the bottom of any guide page. The app screens, live pages and contact pages never show ads.
Legal basis
- Account, contacts and journeys: to provide the service you asked for (contract).
- Contacts’ details before they confirm, rate limits, logs and block lists: our legitimate interests in running the service you asked for and preventing misuse.
- Ads cookies: your consent, which you can withdraw at any time.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Most of this you can do yourself: edit your name and contacts, or delete your account in the app. Otherwise email hello@eta.me.uk. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office.
Security
Email addresses are encrypted in our database and looked up with keyed hashes; sign-in and confirmation links are stored only as hashes. The site uses https throughout. ETA is for people aged 13 and over.