I think you're misunderstanding what they are saying. They don't use background location data, but they do use your current location data. Try the "Find My Train" demo on their site - it asks for location permission.
Or their API - it also expects device location data:
> At a minimum, requests to the detect endpoint _must_ contain a device's location measurement. Additional fields can be included where available to improve the accuracy of the returned results as outlined below.
wait - so you think that the map is made up of people who are all sitting on that website using the Find My Train demo?
I think you are missing the point - what is collecting data on all those trains.