Privacy Policy

Switchyard for Railway · Last updated May 4, 2026

Switchyard is an independent third-party iOS client for Railway. This policy describes what data the app and its server handle, and what they don't.

What stays on your device

Your Railway OAuth tokens (access and refresh) are stored in the iOS Keychain on your device. They are never transmitted to or stored on the Switchyard server. The app talks directly to Railway's GraphQL API to read and modify your data; the Switchyard server is not in that path.

What the Switchyard server stores

The server exists for one reason: to deliver push notifications. It stores only what's needed to do that:

• Your Railway user ID — used as a stable key to associate device tokens and preferences with your Railway account.
• Apple Push Notification (APNs) device tokens — used to send push notifications and Live Activity updates to your device.
• A per-user webhook secret — a random identifier Railway uses to deliver webhook events to the server on your behalf.
• Notification preferences — Live Activity on/off, and the list of project IDs you've muted.
• Transient deployment IDs — used briefly to route Live Activity updates to the correct ongoing activity, then cleared.

The server does not store your Railway tokens, your projects, your services, your logs, your variables, your metrics, or the contents of webhook payloads beyond what's needed to forward a notification.

Authentication

Authenticated requests to the Switchyard server are verified by exchanging your Railway access token for your Railway user ID at request time. The server does not retain the access token.

Third parties

• Apple Push Notification service (APNs) — receives device tokens and notification payloads in order to deliver them to your device.
• Railway — the app reads and writes your Railway data on your behalf using the OAuth scopes you grant. Railway's own privacy policy applies to that data.

The Switchyard server does not use analytics, advertising, or tracking SDKs.

Logs

The server emits short-lived operational logs (HTTP method, path, status, duration). Webhook secrets in URLs are redacted. Logs are not retained long-term and are not used for analytics.

Deleting your data

Sign out in the app to unregister this device — the app will tell the server to drop this device's push tokens, and your local Railway tokens are wiped from the iOS Keychain.

To remove all server-side data associated with your Railway account (push tokens across all devices, notification preferences, webhook secret, mutes), open the Account tab and tap Delete account. This does not affect your Railway account itself — only the data Switchyard stores about you. If you'd prefer to do this by email, write to the address below and include your Railway account email.

Children

Switchyard is not directed at children under 13 and we do not knowingly collect data from them.

Changes

If this policy changes materially, we'll update the date above and, where appropriate, surface the change in-app.

Contact

Questions or data deletion requests: info@traduko.se