Privacy policy

What we collect

Your account: your email address, your name if you give one (or the one Google or Apple shares), your password in scrambled form (we never store the password itself), and which sign-in methods (Google, Apple, email and password) are linked to it.

What you create in the app: the cities you mark, your trips and their stops, dates and notes, your flights and your home city.

Your subscription: whether you have Wayfold Plus, which plan, whether it is a trial and when it ends. The store, or for purchases on the web our payment provider Polar, handles the payment; we never see your card or store account details.

Your language: whether the app shows Polish or English, so that we can write to you in it, for example in sign-in emails and notices about these texts.

Sign-in sessions: each time you sign in, we keep the time, your IP address and your browser or app type with that session, to keep your account secure and to keep you signed in.

Network traffic: our server keeps no request logs and no visitors' IP addresses. Cloudflare, which sits in front of the service, handles your IP address on every connection to deliver the traffic and protect the service from attacks.

Error reports: when something goes wrong in the web app, we send a description of the error to Sentry so that we can fix it. A report holds nothing that identifies you (details below).

Your settings: your choice of language (including "follow my device"), theme and accent color, and whether the map shows all your flights, so that they follow you to every device you sign in on. Each device also keeps a copy in its own storage so that the app opens the way you left it.

The web app uses one cookie, a session cookie that keeps you signed in. It is strictly necessary and is not used for tracking. We use no analytics or marketing cookies.

Why we use it

To run your account, keep your map and your settings in sync across your devices, show you your statistics, give you Plus when you have subscribed, and send the emails that sign-in needs (verification and password reset).

To keep the service secure and working: we limit repeated sign-in attempts, make backups and fix the errors that reports show us.

We do not sell your data and we do not use it for advertising.

On what basis

Your account, your map, sync, settings and Plus: performing our contract with you, that is, providing the service you asked for (Art. 6(1)(b) GDPR). On the same basis we send the emails that sign-in needs and handle signing in with Google or Apple, if you choose it.

Security, limiting sign-in attempts, backups and error reports: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Polar, as the seller, issues and keeps the records of web purchases. If tax or accounting law requires us to keep purchase data, we do so under Art. 6(1)(c) GDPR.

Giving an email address is required to create an account; without it we cannot provide the service. Everything else you give is up to you. We make no automated decisions about you and do no profiling.

Where it is kept

On a server in the European Union, run by our hosting provider. A nightly backup of the database is kept with a storage provider (Backblaze), away from that machine. Only the operator has access to the server and the backups.

Who else handles it

Providers that handle data for us: our hosting provider (Mikrus), Backblaze (backups), Cloudflare (the network and security in front of the service), Resend (our sign-in emails), Sentry (error reports from the web app), RevenueCat (your subscription status for phone purchases) and Polar (payment and subscription for purchases on the web).

Sentry (Functional Software, Inc., USA) collects error reports from the web app to keep it working; the data is stored in the European Union (Germany). A report holds a description of the error, the app version, the browser and system type, and the page address without its parameters. We do not send Sentry your account, email address, cookies, headers, request contents or address parameters, and Sentry does not store the IP address a report came from.

Google and Apple, only if you choose to sign in with them. The Apple App Store and Google Play process purchases under their own terms; we receive only your subscription status, through RevenueCat.

Polar is the seller of Plus purchases made on the web. When you pay there, Polar receives your email address, your name and your billing country, handles the payment under its own terms, and tells us your subscription status. We never see your card details.

When you look up a flight by its number, that number is sent to a public flight-data service (adsbdb), with nothing that identifies you.

This website sets no cookies. It uses Cloudflare Web Analytics, which counts page views and visitors without cookies and without following you across sites or storing anything on your device; the figures are aggregate and we cannot tell who you are from them. The demo on the home page saves nothing and sends none of your data to us; like any web page, loading it contacts the server that hosts it.

Outside the European Union

Some of these providers (Cloudflare, Resend, Sentry, RevenueCat, Polar, Backblaze, Google and Apple) are based in or work from the United States, so your data may be processed outside the European Economic Area.

We pass data only to providers that give it the protection the GDPR requires: under the European Commission's adequacy decision (the EU-US Data Privacy Framework) or under standard contractual clauses approved by the Commission.

Your rights

You have the right to access your data, to have it corrected, deleted, restricted and handed over to you in a portable form, and to object to the handling based on our legitimate interest. To use them, write to [email protected]. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

You can export everything you have created to a file from the app, at any time.

You can delete your account from the app (Settings, then Account, then Delete account). It removes your account and everything you created from our server straight away. It does not cancel a Plus subscription bought in the App Store or Google Play: cancel that there first. A Plus subscription bought on the web ends at once when you delete your account, and this does not refund the payment by itself (see the terms of use). Records of a purchase kept by the store, by RevenueCat and by Polar stay with them, under their own rules.

How long we keep it

Your account and everything you create: until you delete your account. Backups are replaced every night, so after you delete your account your data is gone from them within 14 days.

Sign-in sessions (time, IP address, browser or app type): until you sign out or the session expires, 30 days after it was last used; expired sessions are deleted every day.

Error reports in Sentry: up to 90 days.

Subscription status: until you delete your account. Orders and invoices are kept by the seller (Polar, Apple or Google) for as long as tax law requires.

Children

Wayfold is not meant for children under 16. If you think a child has made an account, write to [email protected] and we will delete it.

Changes

If this policy changes in a way that matters, we will say so in the app or by email before it applies.