I think you're misunderstanding what they are saying. They don't use background location data, but they do use your current location data. Try the "Find My Train" demo on their site - it asks for location permission.

Or their API - it also expects device location data:

> At a minimum, requests to the detect endpoint _must_ contain a device's location measurement. Additional fields can be included where available to improve the accuracy of the returned results as outlined below.

https://docs.signalbox.io/docs#/operations/Detect_detect

wait - so you think that the map is made up of people who are all sitting on that website using the Find My Train demo?

I think you are missing the point - what is collecting data on all those trains.