Privacy Policy

Information we process

We may process:

• Saves and permitted copies of authored trips or collections. Only the author sees the number of distinct people who saved their content, inside Stats. The author also receives an in-app update identifying the person who saved or copied it by their username. Save identities and totals are not public. Server-only pseudonymous receipts prevent duplicate counting.
• Account information, including your email address, authentication provider identifier, username, name, and profile image.
• Content you create, including trips, days, stops, notes, saved itineraries, collaboration invitations and activity, trip documents and filenames you choose to upload, and feedback or support messages.
• Safety reports you submit, including the reported account or public trip, selected reason, optional details, submission time, and account identifiers needed to investigate abuse. Reported-profile names, usernames, and public-trip identifiers and titles may be preserved as a review snapshot.
• Private account-block relationships and automated public-content moderation events used to prevent unwanted interactions and enforce Wayvie's safety rules.
• Subscription information, including product, entitlement, purchase, and restore status. Apple processes App Store payment details; Wayvie does not receive your full payment-card information.
• Limited technical information needed for security, app operation, diagnostics, performance, and reliability. This can include app version/build, device model and OS, pseudonymous Firebase installation identifiers, crash stack traces, app-start and screen timing, supported network request timing and URL paths without query strings or fragments, safe error codes, and aggregate feature attempt/outcome counts. Firebase Performance Monitoring associates performance events with a pseudonymous Firebase installation identifier and uses IP addresses to determine the country from which events originate. This diagnostic country information is separate from the precise device location used locally for nearby places. Wayvie does not attach account identity, trip content, precise location, or free-form user text to crash/performance reports.
• Website usage information through Vercel Web Analytics, such as page visits and basic technical information. It is used for aggregate site operation and is not used for advertising or cross-site tracking.

Wayvie does not sell personal information, share it for targeted advertising, run targeted advertising, or track people across other companies' apps or websites.

Why we process information

We process information to:

• Create and secure accounts and provide trip planning, synchronization, sharing, collaboration, support, and subscription features. The legal basis is performing our agreement with you.
• Maintain service security, prevent abuse, diagnose failures, and improve reliability. The legal basis is our legitimate interest in operating a secure and dependable service.
• Respond to support and privacy requests. The legal basis is performing our agreement, complying with legal obligations, and our legitimate interest in supporting users.
• Maintain transaction or other records when the law requires it. The legal basis is compliance with legal obligations.
• Process optional information when you specifically choose to provide it. Where consent is the applicable basis, you may withdraw it at any time without affecting earlier lawful processing.

How information is shared

We disclose information only as needed to provide the service:

• Apple provides App Store distribution, Sign in with Apple, and in-app purchases.
• Google/Firebase provides authentication, cloud data storage, backend functions, security controls, aggregate reliability counters, Crashlytics crash diagnostics, Performance Monitoring, and related infrastructure.
• Meta provides Facebook Login when you choose that sign-in method. Wayvie uses Facebook Limited Login and does not use it for advertising.
• Vercel hosts the public website and provides aggregate website analytics.
• Namecheap provides email forwarding for the public support address.
• Resend may deliver operational notifications for feedback and safety reports submitted through the app.
• When you create a private trip invite link, anyone who receives that unexpired link can view the trip itinerary, including dates, places, schedules, and trip or place notes, before signing in. Documents, checklists, and member administration are not included in this preview. The first person who accepts consumes the link and joins with the access level you selected.
• Every accepted collaborator on a trip can access every trip document stored with that trip. The app warns you not to upload passports, national IDs, payment cards, or other highly sensitive documents.
• Authorities, regulators, or courts may receive information when legally required or when necessary to protect users, Wayvie, or others.

These providers process information under their own service terms and data-protection commitments. We do not allow them to use Wayvie information for targeted advertising on our behalf.

Retention

• Account and trip information is retained while your account exists.
• Private trip invite links expire after seven days, become unusable when accepted, and are removed when the owning trip or account is deleted.
• A trip document is retained until the trip owner deletes the document or deletes the owning trip or account. Deleting a document removes ordinary collaborator access promptly. A downloaded offline copy can remain on a collaborator's offline device until the app can reconcile access, the collaborator removes the download, signs out, switches account, or uninstalls the app.
• When you delete your account, associated information is removed from active Wayvie systems promptly, except information that must be retained for legal, security, or transaction-record purposes.
• Residual recovery copies are isolated from ordinary use and are not restored to recreate user-deleted content. Cloud Storage may retain an inaccessible soft-deleted trip-document object for the configured seven-day recovery window before permanent deletion processing.
• Support correspondence is retained for up to 24 months.
• Security and abuse records are retained for up to 12 months, unless they are needed longer for an active investigation or legal claim.
• Purchase and accounting records are retained only for the period required by applicable law.
• Firebase Crashlytics retains crash reports and associated identifiers for 90 days before starting removal from live and backup systems. Firebase Performance Monitoring retains IP-associated performance events for 30 days and installation-associated and de-identified performance data for 60 days before starting removal from live and backup systems. Wayvie’s aggregate reliability interaction information is retained for up to 90 days. Author save totals are lifetime content signals: unsaving does not reduce them. Server-only hashed deduplication receipts remain with the author insight until the author deletes their account, including when a saver later deletes theirs; they contain no saver name or email. Identifying save notices are removed when the saver deletes their account; lifetime totals remain until the author deletes theirs.
• Wayvie no longer offers Google Data Portability collection import. Updated builds remove legacy import credentials and prepared local drafts created by earlier beta builds; collections already imported remain ordinary private Wayvie collections under the retention rules above.

Information may be retained longer when necessary to establish, exercise, or defend legal claims, comply with law, or complete a request you initiated.

Your choices and rights

You can update available profile information in the app and delete your account through Settings → Account actions → Delete Account.

You may contact hello@getwayvie.com to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about how your data is used or shared. These rights apply according to the law governing your request. We may need to verify your identity before completing it.

People in the European Economic Area may complain to their local supervisory authority. Because Wayvie is operated from Portugal, you may also contact Portugal's Comissão Nacional de Proteção de Dados at cnpd.pt.

People in Brazil may exercise the rights available under the Lei Geral de Proteção de Dados (LGPD) and may contact Brazil's Autoridade Nacional de Proteção de Dados at gov.br/anpd.

International processing

Some providers may process information outside Portugal, the EEA, or Brazil. Where required, transfers rely on an applicable adequacy decision, approved contractual protections such as standard contractual clauses, or another lawful transfer mechanism provided by the service provider.

Children

Wayvie is not intended for children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it where required.

Security

We use reasonable technical and organizational safeguards designed to protect information. No storage or transmission system can be guaranteed completely secure.

Changes

We may update this policy when the service or legal requirements change. We will update the effective date and provide additional notice when required.

Contact

Controller: Pedro Antunes, Portugal

Email: hello@getwayvie.com