Or their API - it also expects device location data:
> At a minimum, requests to the detect endpoint _must_ contain a device's location measurement. Additional fields can be included where available to improve the accuracy of the returned results as outlined below.
I think you are missing the point - what is collecting data on all those trains.
This is matching your phone's location to the already public train data.
But what is getting that?
"You" here means another app that integrates their API (or you as an individual using the demo on their website). How the other app gets it is up to the other app - ideally it also just queries it directly and requires location permission.