Privacy policy

What we keep

• Your account: your email address and a password. Passwords are stored scrambled, so nobody at Waypals can read them. If you sign in with Google, Google shares your name, email address, and profile picture with us, and nothing else. If you sign in with Apple (in the iPhone app), Apple shares only your email address, or a private relay address if you choose Hide My Email. Your name and picture fill in your profile when you set it up, and you can change or remove them; if you keep the picture, we store our own copy rather than linking to Google.
• Your profile: your name, username, home area (a town of 15,000 people or more, like "Seattle, WA" or "Lyon, France", never an address; if you choose it with Find my town or by dropping a pin, your location or pin is matched to the nearest town on your phone, read only once, and only the town is saved), bio, travel type answers, and favorite activities. Also your passport number, given in the order people joined (No. 0001 was the first), and when you joined, which decides the Founding Explorer stamp.
• Your birthday: used only to confirm you're 18 or over. It's never shown to anyone, including friends.
• Gender, if you choose to add it. Never shown to anyone.
• Your pins: the places you've collected as stamps or marked Want to go (your bucket list), which ones you love, who can see each one, and the date you collected it (for a Before Waypals stamp, a visit from before you joined, also the year you give, if any).
• Your photos and postcards: a profile photo if you add one, and the postcards you write (the words, the place, your photo or the place's photo if you pick one, who can see it, and when you wrote it).
• Secret stamps: which secret stamps you've found, when, which of your stamps earned each one, and whether you've seen the moment that shows it. They're found from your own stamps (which places, and for some the day), or from something you did in the app. Never from your location.
• Top stamps, reviews, likes and comments: the up to three stamps you show on your profile, the reviews you write (stars, words, and when), and the likes and comments you leave on friends' postcards.
• Your Year in review favourites, if you pick them: up to 10 of your own stamps for a year, in your order. Only you can see them. The Year in review story and its video are made on your phone; nothing about them is uploaded, and the video only includes stamps your friends can already see.
• Your own lists, if you make them with Waypals Plus: each list's name, description, places, cover, who can see it, and, for a copy you saved, whose list it came from. Your progress on a list is worked out on your phone and isn't stored.
• Friends: who you're friends with, friend requests you've sent or received, your close friends list if you make one, and messages you send to and receive from friends, including photos and videos sent in them (photos are redrawn on your phone first and videos have their location, date and device details removed on your phone, so neither carries where it was taken). If you joined with someone's invite link, who invited you, and when you reached 3 stamps (for the Travel Buddies stamp and the free months of Plus it gives the person who invited you, which we record). When you tell a friend you were at a place too, we keep who you told, the place and when, for 30 days of notifications and the daily limit.
• Google Timeline imports, if you choose to import one: your phone reads the file and keeps only visits to places on Waypals. The file never leaves your phone. To find places near your visits, the app asks for the public places in large squares (about 50 km across) around them, the same way the map does when you move it; those squares aren't saved. We save just the place and the day, as private "Were you here?" places only you can see, until you collect or dismiss them (or clear them all in Settings).
• Photo and Strava imports, if you choose to use them: your phone reads the location and date saved inside the photos you pick, or the routes in the Strava archive you pick, and keeps only visits to places on Waypals. The photos, routes and archive never leave your phone, and the places are found the same way as for Timeline imports (by asking for public places in large squares around your visits, which aren't saved). We save just the place and the day.
• Waypals Plus, if you pay for it: which plan you have (monthly, yearly, or founding member), whether it's active or in its free trial, when it renews or ends, whether you've had the yearly plan's free trial (so it's given once per account), and the customer number Stripe gives you. We never see or keep your card number.
• Gifts of Plus, if you buy or use one: each gift code, who bought it and when, when it expires, whether it was refunded, and who used it and when. We keep this only to make gifts work (one use, a year of Plus, refunds). The buyer sees only whether their code has been used, never by whom, and the person who uses it never sees who bought it; neither sees the other's account unless you tell each other yourselves. If either account is deleted, its link to the code is removed.
• The 18+ check, if you use Pals or Pen Pal (they come with Waypals Plus): only whether you're 18 or over (yes or no) and the date of the check. See "The 18+ check" below.
• The founding pen pal list, if you join it: that you asked to hear when Pen Pal opens, and when. Nobody else sees it; the Waypals team sees only how many people are on it.
• Pals and Pen Pal, if you switch them on: your short bio, interests and languages for other travelers, who you liked or passed on, your matches, and your messages. See "Pals, Pen Pal and messages" below.
• Phone notifications, if you switch them on: the push address your browser gives us for your phone (a link to your browser maker's push service, such as Apple's or Google's, plus two keys that lock each notification so only your phone can read it), when it was added and last used, and which kinds of notification you turned off. A notification only says who did what ("New message from Sam"): never what anyone wrote, and never a place or location. Switching them off, or signing out, removes that phone's address.
• Trips, if you plan one or join one: the trip's name, dates, places and notes, who you invited, who joined, and the messages written in the trip's chat.
• Business pages, if you ask to manage one: the business name, your role, the work email or website you give (seen only by the Waypals team, to check you work there), your note, and what you post on the page (note, hours, website, offers and events, replies to reviews).
• Groups and meetups, if you use them: the groups you start or join (name, description, who invited whom, when you joined and last read the group's messages), your group messages, and meetups (the place, day and time, a note, who was invited and each person's answer). Meetups never use your location or pins.
• Things you send us: feedback and suggestions for new places, including the public link you give about the place, whether you ticked "I've been here" (only the Waypals team sees it; if the place is added, your own stamp there gets a gold edge that only you see), and a map pin if you add one (with "I'm here now", that pin is where your phone is when you tap it). When the Waypals team adds a place you suggested, we record that it came from your suggestion and credit it to you. You see how many were added and which places; your friends see only your Scout rank (Scout, Trailblazer or Pathfinder) and whether you're a Founding Scout, never which places you suggested or where. Credits aren't shown while an account is banned or restricted.
• How you found Waypals: if the link you first opened had a short code on the end (like ?ref=instagram, or a friend's invite link), your browser remembers it for up to 30 days, and it's saved on your account when you sign up. We also give your account its own share code: random letters and numbers that say nothing about you, added to invite and list links you share, so we can count sign-ups that came from members' links. The Waypals team sees only how many people signed up from each code, never who. Members' share codes are counted together as one number.
• Page counts: we count which pages are opened, through Vercel Web Analytics, without cookies. It doesn't use your account, and the page addresses it gets are cut down first so they never carry a username, friend, list, trip, group or invite code. We see totals only (such as how many people opened the front page this week), never who.
• Error reports: if the app breaks, it sends a short technical note (what went wrong, on which screen, and your browser type) so we can fix it. It doesn't include your pins or messages.

What we don't do

• We don't track your location. Waypals never reads your phone's GPS in the background. A place is only added to your passport when you tap Collect stamp. If you tap "Show where I am" on the map, your phone shares your location with the page so it can show you on the map; it stays on your phone, is never saved or sent to us, and stops when you leave the map. If you tap "Closest to me" in Explore, your phone reads your location once to sort places by distance; it stays on your phone and is never saved or sent to us (at most, the app asks for the places in the state or province you're in, by its name, as it does when you browse one). If you tap "Use where I am" in Plan from a route, your phone reads your location once and turns it into the nearest town; only that town is used, and your location is never saved or sent. If you tap "Verify I'm here" on a stamp, your phone reads your location once and sends it to our database, which compares it with the place and keeps only the answer (verified or not, and when). The location itself is never saved. If you scan the QR code on a Waypals sign at a place and collect its stamp, the stamp is marked verified by that sign without reading your location at all; we keep only the mark, a total of how many stamps each sign has verified (never who), and for 2 days how many signs you scanned, to stop misuse. Apart from a map pin you choose to add to a place suggestion, your location is never saved.
• Only public places can be pinned. Parks, trails, museums, venues, and similar. Homes and exact coordinates can't be pinned, so your pins can't reveal where you live.
• We don't sell or rent your data, show ads, or use advertising trackers.
• Your photos don't carry your location. Photos from a phone camera usually hide details inside the file, including the exact spot where they were taken. Before a photo leaves your phone, Waypals redraws it as a new, smaller picture, which leaves all of that behind. Only the redrawn copy is uploaded; the original never is.
• We don't collect health data. Places on Waypals leave out clinics, hospitals, and other health-care locations.
• Religious places are limited to famous landmarks. Local congregations aren't on Waypals. Well-known cathedrals, missions and similar landmarks people visit as sights can be pinned, and like every stamp they follow your privacy settings.

Who can see what

• You can see everything in your account.
• Friends (people you've both agreed to be friends with) can see your name, username, passport number, home area, bio, travel type, and the stamps you've shared with friends. They see the month and year you collected a place, and the exact day only if you turn on "Show friends the exact day" in Privacy Shield (off unless you do), and whether a stamp is verified (and how: Verify I'm here, a Waypals sign, or a Google Timeline, photo or Strava import).
• Close friends are friends you pick for a private list. Stamps set to Close friends are seen only by them, with the same rules as other shared stamps. Only you can see the list, and nobody is told when you add or remove them. Removing or blocking a friend takes them off it.
• Messages with friends are private between the two of you, and so are photos and videos in them: only the two of you can open them, through links that expire after an hour. Only friends can write to each other. If you stop being friends, the conversation stays readable but closes; if you block someone, it's hidden from both of you. Slurs and threats are never sent, there's a daily limit of 500 messages, and a reported conversation is copied to the Waypals team as described under "Pals, Pen Pal and messages" below.
• Stamps stay private from friends when you set them to Only me (or Close friends, for friends not on your list), hide them, when they're inside your Home Safe Zone (on for new accounts; you can switch it off in Privacy Shield), or until your sharing delay has passed.
• Place and collection pages can be opened by anyone, even without an account, and search engines can list them. They show only the place or collection itself and a total, like "12 have been". The total leaves out hidden and Only me stamps, stamps inside someone's Home Safe Zone or sharing delay, and any number under 3. People without an account never see names, reviews or postcards.
• Postcards set to friends are seen only by friends who can see your stamp at that place, and only once your sharing delay has passed since you wrote them. They see the month and year, never the day. Postcards set to Only me are seen by you alone. Postcard photos are stored privately and shown through links that stop working within an hour.
• Top stamps and reviews are seen only by friends who can see that stamp (reviews also wait out your sharing delay), with the month and year only. Comments on a postcard are seen by its author and by people who are friends with you and can see that postcard. The author of a postcard sees who liked it.
• Your profile photo is shown to your friends and to people you send a friend request to. It's stored as an image at a long, unguessable web address, so anyone given that exact address could open it.
• People who aren't your friends can find you only by your exact username, and see nothing but your name and username until you're friends (unless you turn on a public profile, described below).
• Your @username link (waypals.app/@ and your username) can be opened by anyone, even without an account. It shows only your first name and a plain avatar with your initials, or your profile photo if you turn that on in Privacy Shield. Never your passport, stamps, home area or passport number. Anyone signed in can use it to send you a friend request, which you approve or decline. Turn the link off in Privacy Shield and it stops working straight away.
• Travel Buddies: if you joined with a friend's invite link, you both see that you're Travel Buddies once you've collected 3 stamps, with the month only. The friend who invited you never sees your stamps beyond what you already share with friends.
• Secret stamps you've found are seen by friends like your other stamps, with the month and year only, after your sharing delay, and only while they can see every stamp that earned it. Nobody sees which ones you haven't found, and there's no list of who found one: the Waypals team sees only how many people have.
• "Were you with someone?": after you collect a stamp you can tell a friend you were there together. They see your first name and the place's name in their notifications, never the date, and only if they haven't collected it yet.
• Reports: anyone who can see a postcard, review or comment can report it to the Waypals team, and a copy of its words goes with the report. You can see the reports you've made, and where they stand, in the Safety Center. For a reported postcard, the team sees that postcard, its photo, and a copy of its words (kept even if it's deleted, so a report can still be reviewed), and may hide it or remove a profile photo that breaks the terms.
• Sponsored collections: some collections are presented by a sponsor, such as a tourism board, for a season. Sponsors never see who you are or your pins. They get anonymous monthly totals only: how many stamps were collected at each place in the collection each month, and how many people finished it each month. Only stamps you share with friends count, and only those collected during the season. The totals never include names, usernames, email addresses, profiles, home areas or exact dates, and any number under 3 is left out (shown as "fewer than 3"). Your progress in a collection is worked out on your phone and isn't stored.
• Your own lists are seen by you alone unless you share one. Shared with friends, your friends see it. Shared by link, anyone signed in to Waypals who has the link sees it; you can turn the link off or make a new one at any time, which stops the old one working. Your friends see your name and username on it; everyone else sees your first name only. People who see a list see its name, description and places, never your stamps or progress. Those with Waypals Plus can save their own copy, which credits you by name. Your username shows on a copy only to the person who saved it, to you and to your friends, and the credit goes if you've blocked each other. Anyone who can see a list can report it; the Waypals team then sees a copy of it and may hide it.
• Trips are seen only by the friends invited to them. Once you join a trip, its people see your name and photo, the trip's places and notes, which places you added, and what you write in the trip's chat (you read its messages from when you joined; slurs and threats are never sent, there's a daily limit of 300 trip messages, and a reported message is copied to the Waypals team with the recent messages the reporter could see). A trip never shows anyone your pins or passport. Removing a friend or blocking someone takes them off your trips.
• Businesses never see who collected, bucket-listed or reviewed their place. They get totals only (how many collected it, how many have it on a bucket list, how many reviews and the average rating), leaving out private stamps, with any number under 3 left out. A business sees a review only if the reviewer is a friend of the person managing its page, as anyone would; its reply shows under the review to whoever can see that review, labeled with the business's name, not the manager's. What a business posts on its page is seen by everyone who opens the place. Anyone can report a business's page or reply; the team sees a copy and may hide it.
• Groups are seen only by the people in them. Members invite their own friends, so a group can include people who aren't your friends: they see only your first name and photo, never your username, passport or pins. You read messages sent from when you joined. If you block someone, you stop seeing each other in groups; banned and suspended accounts disappear. Slurs and threats are never sent, there's a daily limit of 300 group messages, and a reported message is copied to the Waypals team with the recent messages the reporter could see. If a group's owner leaves, the longest-standing member becomes the owner.
• Meetups are seen only by the friends invited, or the people in the group they're for, and only at public places on Waypals. Everyone invited sees each other's answers (first name and photo only for people who aren't their friends). Removing a friend or blocking someone cancels invitations between you.
• Pals and Pen Pal: other travelers see only what's listed under "Pals, Pen Pal and messages" below, and only if you switch them on.
• Public profile (off unless you turn it on in Privacy Shield; needs Waypals Plus and the 18+ check): other members who also have Plus and are 18+ checked can see your first name, profile photo, travel type, the state or country of your home area, how many public stamps you have, and only the stamps you mark Public, with the month and year. They can also read your reviews and postcards about those stamps, and like and comment on those postcards (your postcards still wait out your sharing delay). Hidden stamps, Only me and Close friends stamps, stamps inside your Home Safe Zone or your sharing delay, and hidden places never show. Never your username, email, birthday or exact dates. People you've blocked, and members without Plus and the 18+ check, never see it. Turn it off and it disappears straight away. Members without Plus and the 18+ check never see public profiles and never appear on one.
• Automatic hiding: if 3 or more different members with Plus who are 18+ checked report the same postcard, review, comment, list or business post, it's hidden until the Waypals team reviews it.
• Trusted local editors: members the Waypals team trusts (18+ checked) may see place suggestions for their region (the place's name, town, details and map pin, never who suggested it) and tell the team whether each looks like a public place. They can't add or change places.
• These rules are enforced by the database itself, not just by the app's screens.

The 18+ check

• When: only the first time you open Pals or Pen Pal, never at sign-up. It's included in Waypals Plus and done once.
• How: on Stripe's own secure page (Stripe Identity), you take a live photo of a driver's license, passport or ID card. There's no selfie and no face scan, so no biometric data is collected.
• What we keep: only whether you're 18 or over (yes or no) and the date of the check. To work that out, our server receives the details Stripe reads from the ID for a moment, uses only the date of birth, and keeps none of it. We never see your ID photo, and we never keep your name on the ID, its number or your date of birth.
• Deleted right after: as soon as the answer is known, we ask Stripe to delete the check, including the ID photos and details. Stripe may keep limited records for fraud prevention and legal reasons under its own privacy policy.
• If the check says under 18: Pals and Pen Pal stay off for your account, and the Waypals team is told the answer didn't match your account birthday so they can take a look. No date of birth is kept for this either.
• Checked by the team instead: in rare cases the Waypals owner marks an account 18+ checked after seeing the ID in person, when your account birthday already says 18 or over. We keep the same yes or no and date, plus a note that the owner did it. Nothing from the ID is kept.
• Others see only an "18+ checked" badge on your Pals and Pen Pal profile. It confirms age, not who you are.

Pals, Pen Pal and messages

• What other travelers see: your first name, profile photo, travel type, the state or country of your home area (never the area itself, never where you are), your bio, interests and languages, and the "18+ checked" badge. Never your username, email, birthday or exact dates.
• Places in common: if you leave "Use my shared stamps" on, we compare the stamps you share with friends (never Only me, hidden or Home Safe Zone ones, and only after your sharing delay) with the other person's. Each of you sees only places you have both been.
• Who can find you: only other members with Plus and an 18+ check who have Pals or Pen Pal on. Never people you've blocked (or who blocked you), your existing friends, or suspended accounts. Turn Pals or Pen Pal off and you're hidden straight away.
• Messages are private between the two of you. Nobody else can read them, including other members. If a conversation or message is reported, a copy of the conversation (up to the last 50 messages) goes to the Waypals team with the report, so they can review it even if the conversation is later deleted. Reports are kept while the team reviews them and as a record of what was decided.
• Limits: to keep things calm and stop spam, there are daily limits (10 new conversations and 200 messages), first messages wait until they're accepted, and links, emails, phone numbers and social handles can't be sent in a conversation's first 3 messages. Messages are checked automatically for a short list of slurs and threats, which are never sent.
• Leaving: you can unmatch or delete a conversation at any time; it ends for both of you. Once both people have left it, it's deleted. Deleting your account deletes all your conversations and messages.

Services we use

A few companies run parts of Waypals for us. They handle your data only to provide their service:

• Supabase: stores your account and data, including your photos.
• Vercel: hosts the app, and counts page views without cookies (see "Page counts" above). Like any website host, it sees your internet address and browser details, not your account.
• Resend: sends account emails, like confirming your email or resetting your password.
• Google: only if you choose Continue with Google.
• Apple: only if you choose Continue with Apple in the iPhone app.
• Stripe Identity: only if you take the 18+ check for Pals or Pen Pal. See "The 18+ check" above.
• Stripe: only if you pay for Waypals Plus. You pay on Stripe's own page, so your card details go to Stripe and never to Waypals. Stripe gets your email address and user number from us, to link the payment to your account, and sends receipts.
• Google Play: only if you buy Plus from the Android app. Google shows its own screen before you go to Stripe's page, and we tell Google about the payment as its rules require: the amount, your country and a code Google gave the app, never your name, email or card.
• Apple, Google or Mozilla push services: only if you switch on phone notifications. Your browser's maker delivers each one to your phone. They can't read it: it's locked for your phone.
• Cloudflare Turnstile: a quick check on the sign-in and sign-up screens that you're a person, not a bot. It sees your internet address and browser details, not your account.
• Anthropic: when we add a place to Waypals, Claude may draft its description from public facts about the place and the details in the suggestion (its name, town, and any note). Your name and account are never sent.
• GeoNames: the list of towns you can choose a home area from comes from GeoNames (geonames.org, CC BY 4.0). It's a file Waypals serves itself, so GeoNames never sees who you are or what you pick.
• OpenFreeMap: your phone loads map tiles directly from it, so it sees your internet address and which map area was loaded, like any website.
• Wikimedia Commons: place photos come from Wikimedia Commons, credited on each place. We keep our own copy of each one and your phone loads it from us, so Wikimedia doesn't see which places you look at. A place added in the last few hours may still load its photo from Wikimedia until our copy is made.
• Nominatim (OpenStreetMap's place search): only when you suggest a place and type a town, so the map can start there. Your phone sends the town you typed; it sees your internet address and that text, like any website, and nothing about your account.
• OSRM (the Project OSRM route server): only if you use Plan from a route on Trips. Your phone asks it for the driving route between the start and destination you picked, which are always a public place or a town center ("Use where I am" is turned into the nearest town on your phone first). It sees your internet address and those two points, like any website, and nothing about your account.
• OpenStreetMap (through its public Overpass servers): the "Good to know" facts on a place page (entry fee, dogs, wheelchair access, hours, restrooms, parking) come from OpenStreetMap, credited on each place. Our server looks the place up by its name and location, about once a month per place, and keeps the answer. Your phone never contacts OpenStreetMap for this, and nothing about you or your account is sent.

Where your data is stored

Waypals is run from the United States. Your account and data are stored and processed in the United States by the services listed above (Supabase stores them, Vercel runs the app, Resend sends account emails, and Stripe handles payments and the 18+ check), including if you live in Canada or elsewhere.

Your choices

• Download your data at any time from Settings, as a file you can keep.
• Delete a postcard from its menu at any time; its photo is deleted with it. Remove your profile photo in Edit profile.
• Delete your account from Settings. These are deleted straight away and can't be recovered:
  • your profile, photos, postcards, top stamps, reviews, likes and comments;
  • your pins, friendships, close friends list and messages with friends;
  • your own lists, trips you planned (and your place on friends' trips);
  • your group memberships, group messages, meetups you planned and your answers to others (a group you own passes to its longest-standing member);
  • your Pals and Pen Pal conversations and messages, 18+ check result and Plus membership;
  • the code of the link you signed up from, and your own share code.
  Any Plus subscription stops so you aren't charged again. Stripe keeps its own record of past payments, as payment law requires. Copies in routine backups are removed as those backups expire. Some records are kept without your name or account attached: feedback, place suggestions and error reports you sent, reports you made or that were made about you (with the copied words), and the Waypals team's own log of actions it took.
• Change your profile, pins, and privacy settings in the app. Birthdays are locked once set; contact us if yours is wrong.

Age

Waypals is for people 18 and over. We don't knowingly keep accounts for anyone younger, and we delete them when we find out.

Changes

If we change this policy in a way that matters, we'll tell you in the app before it takes effect.

Contact

Email hello@waypals.app, or use Send feedback in Settings.