1. So it's Trainline on a persons phone that is tracking this info and using it to enrich this service? I use Trainline and didn't know it was doing that, but I do have location permissions on because I was told that powered the search picker when I started using the app.
2. What did they use _before_ Trainline? Or was Trainline selling user location data to them?
Or their API - it also expects device location data:
> At a minimum, requests to the detect endpoint _must_ contain a device's location measurement. Additional fields can be included where available to improve the accuracy of the returned results as outlined below.
I think you are missing the point - what is collecting data on all those trains.
This is matching your phone's location to the already public train data.
But what is getting that?
"You" here means another app that integrates their API (or you as an individual using the demo on their website). How the other app gets it is up to the other app - ideally it also just queries it directly and requires location permission.