Privacy policy

What we collect

Your account: your email address, your name if you give one (or the one Google or Apple shares), your password in scrambled form (we never store the password itself), and which sign-in methods (Google, Apple, email and password) are linked to it.

What you create in the app: the cities you mark, your trips and their stops, dates and notes, your flights and your home city.

Your subscription: whether you have Wayfold Plus, which plan, whether it is a trial and when it ends. The store handles the payment; we never see your card or store account details.

Sign-in sessions: each time you sign in, we keep the time, your IP address and your browser or app type with that session, to keep your account secure and to keep you signed in.

Technical logs: when you use the service, our server and the network provider in front of it record your IP address, the time and your browser or app type, for a limited time.

Your theme and language stay on your device. The web app uses one cookie, a session cookie that keeps you signed in. It is strictly necessary and is not used for tracking.

Why we use it

To run your account, keep your map in sync across your devices, show you your statistics, give you Plus when you have subscribed, and send the emails that sign-in needs (verification and password reset).

To keep the service secure and working, for example by limiting repeated sign-in attempts.

We do not sell your data and we do not use it for advertising.

On what basis

We handle your data to provide the service you asked for (the contract between you and us), and to keep it secure and working, which is our legitimate interest. Signing in with Google or Apple is your choice.

Where it is kept

On a server in the European Union, run by our hosting provider. Continuous backups of the database are kept with a storage provider (Backblaze), away from that machine. Only the operator has access to the server and the backups.

Who else handles it

Providers that handle data for us: our hosting provider (Mikrus), Backblaze (backups), Cloudflare (the network and security in front of the service), Resend (our sign-in emails) and RevenueCat (your subscription status).

Google and Apple, only if you choose to sign in with them. The Apple App Store and Google Play process purchases under their own terms; we receive only your subscription status, through RevenueCat.

When you look up a flight by its number, that number is sent to a public flight-data service (adsbdb), with nothing that identifies you.

This website sets no cookies and uses no analytics. The demo on this page saves nothing and sends none of your data to us; like any web page, loading it contacts the server that hosts it.

Outside the European Union

Some of these providers (for example Cloudflare, Resend, RevenueCat, Backblaze, Google and Apple) are based in or work from the United States, so your data may be processed outside the European Economic Area. When that happens we rely on the safeguards the law provides, such as the provider's certification under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

You can export everything you have created to a file from the app, at any time.

You can delete your account from the app (Settings, then Account, then Delete account). It removes your account and everything you created from our server straight away. It does not cancel a Plus subscription: cancel that in the App Store or Google Play first. Records of a purchase kept by the store and by RevenueCat stay with them, under their own rules.

You can ask us for access to, correction of or deletion of your data, and object to how we handle it, by writing to jakub.soboczynski@icloud.com; we answer within one month. You may also complain to the supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO).

How long we keep it

Until you delete your account. Backups made before then are replaced on a rolling schedule, so your data is gone from them within about 14 days. Technical logs are kept only for a short time.

Children

Wayfold is not meant for children under 16. If you think a child has made an account, write to jakub.soboczynski@icloud.com and we will delete it.

Changes

If this policy changes in a way that matters, we will say so in the app or by email before it applies.