Privacy Policy

1. Who we are

Wayfold (“Wayfold”, “we”, “us”) is a packing list, trip planner and travel planner app published by Quantum Synergy ([Quantum Synergy legal name, registered address]). We are the controller of the personal data described in this policy.

Privacy questions and requests: quantumsynergysols@gmail.com. [If required: UK representative: [name, address]. EU representative: [name, address]. Data protection officer: [name or “not appointed”].]

2. What we collect and why

2.1 Using Wayfold without an account

An account is optional. Without one, everything you create — trips, destinations, dates, travellers, diet and allergy profiles, packing lists, outfits, templates, the itinerary, saved places, bookings, expenses, the leaving-home checklist and your preferences (home country, nationality, units, currency, travel style) — is stored in a database on your phone. We don’t receive it.

Some features still need our servers to fetch information for you, such as weather, place search or AI suggestions. Those requests carry only what the feature needs (see 2.5 and 2.7) and are not linked to an account.

Your preferences, including your nationality (used for entry-requirement reminders), stay on your phone even when you have an account.

2.2 Your account (optional)

If you sign in to sync or share trips, we collect:

• your email address and a display name if you set one;
• how you signed in: an email sign-in code, Sign in with Apple or Google Sign-In, and the account identifier Apple or Google gives us. If you use Apple’s “Hide My Email”, we receive the relay address, not your real one;
• your plan (Free or Pro), when Pro ends, and how many AI generations you’ve used this month;
• your personal booking-import address (for example trips+abc123@…) if you use email import.

Sign-in codes are sent by email through [email delivery provider]. We store only a keyed hash of each code, never the code itself. We use account data to create your account, sign you in, keep you signed in, apply your plan, and contact you about your account.

2.3 Trip data synced to our servers

When you’re signed in, your trip data is uploaded to our servers ([hosting provider/region]) so it can sync across your devices and with people you share a trip with. It includes:

• trips, destinations (names and map coordinates), dates and trip type;
• travellers’ names and age groups (adult, child, infant, pet) — this can include your children. A first name or nickname is enough;
• diet and allergy profiles (see below);
• packing items, bags, outfits, “who brings what” and your personal packing templates;
• the itinerary: activities, times, places and notes;
• saved places (“Places to visit”);
• bookings you add or import: for example flight numbers, times, confirmation numbers, seats and notes;
• budgets and expenses, including who paid and how costs are split;
• leaving-home tasks.

2.4 Shared trips

When you invite someone to a trip, we create an invite link that expires after 7 days; we store only a hash of its token. Everyone in a shared trip can see that trip’s data — including travellers, diet and allergy profiles, bookings and expenses — and editors can change it. Members also see each other’s display name and email address. We record who is a member and their role. If you turn on shared-trip notifications, other members get a push such as “Sarah ticked 6 items”.

2.5 AI features (Anthropic / Claude)

Some features use Claude, an AI model from Anthropic, which processes data for us as a processor. Your phone never talks to Anthropic directly: the request goes through our servers, and only the content the feature needs is sent. We never send your email address, your account details or anything from the documents vault.

Under Anthropic’s commercial terms, Anthropic does not use this data to train its models and keeps it only for a limited period for safety and abuse monitoring. [Confirm wording against Anthropic’s current commercial terms and DPA.] We don’t use your data to train AI models either. Some AI answers that contain no personal data — food guides per country and city, and “Top things to do” per city and interests — are cached on our servers for 30 days and reused for all users. AI output can be wrong; you always review it before it’s added.

2.6 Booking import by email

With an account you can forward booking confirmations to your personal import address. Our inbound email provider, Postmark, receives the message and passes it to our servers. We read the subject, the text of the email and up to three PDF or image attachments, and send them to Anthropic (2.5) to extract the bookings. We then keep only the extracted bookings, the subject, the sender address, the received time and a message identifier, so you can review them in your inbox and add them to a trip. We don’t store the full email or its attachments. Postmark keeps inbound messages for [Postmark inbound retention — confirm] under its own terms. Please forward only emails you are entitled to share.

2.7 Weather, places, maps, flights and exchange rates

To fetch information for your trip, our servers send the minimum needed to these services. The request comes from our server, not your phone, and doesn’t include your name, email or account ID. Results are cached to reduce requests.

• Open-Meteo (weather): the destination’s coordinates and dates only.
• Photon by komoot, based on OpenStreetMap, or Foursquare (place search, “Things to do”, familiar chains and “eat nearby”): your search text and the approximate coordinates of the destination or plan stop you’re searching around.
• Directions: the coordinates of the stops; travel times are estimated on our server, or by an OpenStreetMap-based routing server if we configure one.
• AeroDataBox via RapidAPI (flight tracker, Pro): the flight number and date only. For Pro members, our server checks flights departing in the next 36 hours and sends a push if there’s a delay, gate change or cancellation.
• Exchange rates from the European Central Bank via Frankfurter, and open.er-api.com: no personal data is sent.

We never use your phone’s GPS location. Wayfold works with the coordinates of the places you plan, not where you are.

Maps. The in-app map uses Apple Maps on iPhone and Google Maps on Android. Like any map, it loads map tiles for the area on screen directly from Apple or Google, which receive your device’s IP address and the area you view under their own privacy policies. When you tap “Open in Google Maps” or “Open in Apple Maps”, the places of that day are passed to that app or website.

2.8 Purchases (Paddle)

The app has no in-app purchases. Pro subscriptions and Lifetime are sold only on our website (the Upgrade page), where you sign in with your Wayfold account email. Payment is handled by Paddle (Paddle.com Market Ltd and its affiliates), which is the merchant of record and reseller for these orders. Paddle collects the details it needs to take payment and meet its tax and legal obligations — your name, email address, billing address or country, and payment details — as an independent controller under Paddle’s privacy policy.

From Paddle we receive only what we need to give you Pro: a Paddle customer ID, the subscription or transaction ID and its status, the plan, and the relevant dates (for example when a trial ends, when the subscription renews, or when it was cancelled). We link this to your Wayfold account so Pro works in the app when you sign in with the same email. We never see or store your card or bank details. The upgrade page keeps your sign-in only in the open browser tab and sets no tracking cookies; Paddle’s checkout loads from Paddle and uses its own cookies to process the payment securely.

Purchases made earlier through the Apple App Store or Google Play are still honoured. For those, Apple or Google handled payment, and we keep the resulting plan and expiry date on your account.

2.9 Notifications

Reminders such as “time to pack”, leaving-home tasks and document expiry are scheduled on your phone and work offline. If you’re signed in and allow notifications, we store a push token for your device (and whether it is iOS or Android) to send shared-trip updates, booking-import alerts and flight alerts through Expo’s push service, which passes them to Apple Push Notification service or Firebase Cloud Messaging.

2.10 The documents vault

Passport pages, licences, insurance and tickets you add to the vault are encrypted on your phone (AES-256-GCM) with a key kept in the iOS Keychain or Android Keystore that is tied to this device and excluded from backups. Opening the vault needs Face ID, Touch ID, your fingerprint or your device passcode. Vault files and their details (holder name, document type, expiry) are never uploaded, synced or shared — not with us, not with trip members, not with the AI provider. Because we never have them, we can’t recover them if you lose your phone, and they are removed when you delete them or uninstall the app.

2.11 Partner links (Skyscanner, Booking.com, Rentalcars.com)

“Find flights”, “Find hotels” and “Find car hire” open the partner’s website or app, prefilled with the destination, dates, number of adults and children’s ages from your trip. Some links carry our affiliate ID, and we may earn a commission if you book — this never changes the price you pay. Once you leave Wayfold, the partner’s own privacy policy applies. We don’t receive your booking or payment details from partners.

2.12 Support emails and server logs

If you email us, we use your email address and message to help you. Our servers keep standard technical logs (such as IP address, time, request path and errors) for security, rate limiting and fixing problems, for [server log retention, e.g. 14 days].

2.13 Analytics and crash reports

Wayfold currently contains no analytics, crash-reporting or advertising SDKs. If we ever add analytics or crash reporting, we will ask for your consent first where the law requires it (including in the UK and EU) and update this policy before it is switched on.

3. Phone permissions

Wayfold asks for a permission only when you use the feature that needs it:

4. No ads, no tracking, no selling

Wayfold has no advertising SDKs and shows no ads. We don’t track you across other companies’ apps or websites, so we don’t ask for App Tracking Transparency permission. We don’t sell your personal information and don’t share it for cross-context behavioural advertising.

5. Legal bases (GDPR and UK GDPR)

6. Who we share data with

We share personal data only with service providers that process it for us under contract, and only for the purposes above:

• [hosting provider/region] — servers and database.
• Anthropic — AI features and booking parsing (2.5).
• Postmark — receiving forwarded booking emails (2.6).
• [email delivery provider] — sending sign-in codes.
• Apple and Google — sign-in, push delivery and maps.
• Paddle — merchant of record for Pro and Lifetime purchases on our website. Paddle processes payment details as an independent controller; we exchange only the customer, subscription and plan details described in 2.8.
• Expo — push notification delivery (2.9).
• Open-Meteo, komoot (Photon), Foursquare, AeroDataBox / RapidAPI, Frankfurter and open.er-api.com — reference data, with no directly identifying data (2.7).

People you share a trip with see that trip’s data (2.4). We may also disclose data if the law requires it, to protect someone’s safety, or as part of a merger or acquisition, in which case this policy continues to apply.

7. International transfers

Our servers are in [hosting provider/region], and some providers (including Anthropic, Expo and Postmark; Paddle is in the UK) are in the United States. When personal data from the UK, EU or EEA is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or on the EU–US Data Privacy Framework and its UK extension where the provider is certified. [Confirm the mechanism for each provider.] You can ask us for a copy of the relevant safeguards.

8. How long we keep data

• On your phone: until you delete it or uninstall the app. Signing out removes synced trips from the phone (they stay in your account).
• Account and synced trip data: while your account exists. When you delete your account it is removed from our live database straight away, and from backups within 30 days.
• Imported bookings in your inbox: until you delete them or your account.
• Push tokens: until you sign out, the token stops working, or you delete your account.
• Sign-in codes: expire after 10 minutes; the hashed records are deleted [sign-in code cleanup — confirm, e.g. within 30 days].
• Server logs: [server log retention, e.g. 14 days].
• Purchase records: the Paddle customer and subscription IDs, plan, status and dates are kept while your account exists. Paddle keeps its own order and invoice records under its terms as merchant of record; any records we must keep for tax or accounting are kept for as long as the law requires.
• Support emails: up to [24] months after the conversation ends.

Full details of what account deletion removes are on Delete your account.

9. Your rights

UK, EU and EEA. You have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (this doesn’t affect processing before you withdraw). You can also complain to a data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk), or the authority where you live in the EU.

How to exercise your rights:

• Export: in the app, Profile → Export my data gives you everything in your account as a JSON file.
• Correct: edit your name and trip data directly in the app.
• Delete: Profile → Delete account, or request deletion on the web without the app.
• Anything else: email quantumsynergysols@gmail.com. We may need to confirm the request comes from the account’s email address. We reply within one month (45 days for California requests).

10. California (CCPA/CPRA) and other US states

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to limit the use of sensitive personal information; and to opt out of its “sale” or “sharing”.

• Do Not Sell or Share: we don’t sell or share personal information (as those terms are defined in the CCPA), and haven’t in the past 12 months. There is nothing to opt out of, but we honour Global Privacy Control signals anyway.
• Categories we collect: identifiers (email, account ID, push token); customer records (name); commercial information (subscription status); internet activity (server logs); approximate geolocation of destinations you plan (not your device location); and sensitive personal information you choose to enter (diet and allergy profiles). Sources: you; Apple or Google when you use their sign-in; and Paddle when you buy Pro on our website (plan and subscription status only).
• Sensitive personal information is used only to provide the features you ask for, never to infer characteristics about you.
• We disclose personal information only to the service providers in section 6, for the business purposes in section 2.
• We won’t treat you differently for exercising your rights. An authorised agent may make a request for you with your written permission.

Residents of other US states with privacy laws (such as Virginia, Colorado, Connecticut and Texas) have similar rights; use the same contact to exercise them.

11. Security

• All traffic between the app and our servers uses TLS (HTTPS); release builds refuse plain HTTP.
• Sign-in codes are stored only as keyed hashes, expire after 10 minutes and allow 5 attempts. Refresh tokens are stored only as hashes and rotated on every use; reusing an old one signs out the whole session.
• Invite links are stored only as hashes and expire after 7 days.
• The documents vault is encrypted on your device and never leaves it (2.10).
• Access controls and rate limits protect the API.

No system is perfectly secure. If a breach affects your data, we will tell you and the regulator as the law requires.

12. Children

Wayfold is a general-audience app and is not directed at children under 13. You must be at least 13 to create an account (or older where your country requires it). We don’t knowingly collect personal information from children under 13, in line with the US Children’s Online Privacy Protection Act (COPPA). Parents can add basic details about children travelling with them, such as a first name, age group and, optionally, allergies, to plan the trip; please keep this to the minimum. If you believe a child under 13 has given us personal information, contact us and we will delete it.

13. Changes to this policy

We will post changes on this page and update the “Last updated” date. If a change is significant, we will tell you in the app or by email before it takes effect.

14. Contact

Quantum Synergy — [Quantum Synergy legal name, registered address]
Email: quantumsynergysols@gmail.com