Privacy

The waitlist

This page is served by Cloudflare. It has no ads, no analytics and no trackers. If you join the waitlist, we keep:

• Your name and your e-mail, to write to you when there's a spot in the beta.
• Where you'd like to travel, only if you write it: it helps us decide what to prepare first.
• The language of the page you joined from, to write to you in that language.
• Which version of this text you accepted, and when.
• A fingerprint of your IP address: a summary that can't be reversed, used only to stop mass sign-ups. Your IP address itself is not stored.

Where

At Cloudflare, in a database (D1) in Wayfolio's account. We don't sell it, share it or use it for advertising.

Who sees it

Only Wayfolio's administrator.

How long

Until there's a spot for you: then your details move to Wayfolio so we can invite you (from then on, the app section applies) and they are deleted from Cloudflare. If there's no spot within 180 days, they are deleted anyway; you can join again whenever you like.

Anti-robot check

To keep robots out we use Cloudflare Turnstile, which only loads once you start filling in the form. To run the check, Cloudflare sees your IP address and details of your browser, under its Turnstile privacy policy. We only receive the result.

Cookies and what stays in your browser

No tracking cookies. If you choose a language, that choice is kept in your browser and in a cookie called lang, so the page opens in that language next time. The light or dark theme also stays in your browser only. Neither of them identifies you.

How to ask for deletion

Write to us at [email protected] from the address you signed up with and we'll delete your details from the list. You can also ask us what we keep about you.

When you use the app

When there's a spot and you join Wayfolio, this is what the app keeps.

What we keep and what for

• Your account: name, e-mail and how you sign in (your password is stored as a fingerprint that can't be reversed, or your Google account). So you can sign in and be recognized on your trips.
• Your sessions: which devices you signed in on and since when, so you can sign them out from Account.
• Your trips: itinerary, bookings, flights, expenses, to-dos, notes and the documents you upload. That's the app.
• Your medical card and travel insurance, if you add them (also those of someone in your care, like a child): allergies, medication, emergency contacts, the policy as a PDF and anything else you fill in. So you have them at hand on the trip.
• Logs without content: which important actions you took and when (signing in, inviting someone, sharing the medical card), with part of the IP address, never the full one; and how many days you used the app. They're for security and to know whether the app is used. Never what you wrote.

The medical card and the insurance

• On the server they are encrypted, with a key of their own, separate from everything else.
• They are seen only by the people you choose, trip by trip, and only until the trip is closed (an owner closes it, or it closes on its own a week after the last day). You can stop sharing whenever you want and see who opened them.
• They never go through trip syncing, exports, notifications, the calendar or the assistants (Claude, ChatGPT).
• The administrator can only open them from the admin panel, by writing a reason and confirming their password. It is logged and you get an e-mail.

On your phone

Your phone keeps a copy of your trips, your medical card and insurance, what others shared with you and the parts of the interactive map you looked at or saved for offline use, so everything works without signal. That copy is not encrypted by the app: it's protected by your phone's lock. What others shared is deleted on its own when it expires, when the trip is closed or when they stop sharing it with you (as soon as the phone finds out, online), and if your session stops being valid. Tapping Sign out deletes everything from your account.

Where

On a single server, with encrypted backups (with age): without the key, a backup can't be read.

Who sees your trips

• Each trip is seen only by the people you invite, with the role you give them (edit or view only).
• The administrator can view trips to provide support; every time they do, it is logged.
• Nobody sees your password, not even the administrator.

Outside services

No ads, no third-party analytics, no trackers. Almost everything is requested by our server, not your phone (the exception is the video thumbnails in “What it looks like”, which your phone requests straight from Google), and none of them receives your name or health data:

• Google, only if you sign in with your Google account: Google knows you signed in here and gives us your name and e-mail.
• Apple, Google or Mozilla (depending on your browser), only if you turn on notifications: they deliver the notification to your phone, encrypted; they can't read it.
• Resend, the service that sends the account e-mails (invitations, codes, alerts): it sees your address and the e-mail we send you.
• Open-Meteo (the weather): it receives the coordinates of the trip's places.
• OpenStreetMap (Nominatim): what you search for when adding a place, and the name or address of your accommodation, to locate it.
• OpenStreetMap and Overpass (the offline maps): only the area of the world of each map being built.
• OpenFreeMap (the interactive map, in Map and on each place's page) and Cloudflare, the network that distributes it: the map pieces go through our server, so they don't see your IP address or which areas you look at; they only see our server. Our server keeps a shared copy of the map pieces without noting who requested each one, and doesn't log coordinates. “Near me” uses your location on screen only: it isn't stored or sent to the app; our server sees, as with any area you look at, the map pieces being shown.
• YouTube/Google (the thumbnails in “What it looks like”): the phone requests them straight from Google; they see your IP address and which videos are shown (not the site you're coming from).
• Frankfurter (European Central Bank exchange rates): only which currencies.
• Google Maps, only if you tap a “directions” or “show on map” link: Google Maps opens with that place.

Assistants (Claude, ChatGPT)

They're optional: only if you connect them from Account → Connections (or create a token). Then the assistant can read and add data on your trips, and whatever it reads is also subject to that company's rules. The medical card and the insurance never go through them. You can disconnect them whenever you want.

Cookies

Just one, your session cookie, when you sign in.

How long we keep it

• Your account and your trips, for as long as you have the account.
• An account that never confirmed its e-mail: 7 days. Closed sessions: 30 days.
• Security logs: 400 days. Days of use: 2 years. Rejected access requests: 90 days.
• A medical card or insurance you delete: it can be recovered for 30 days; after that it is overwritten and deleted for good.
• Who is a member of each trip and their status changes (no content): always.

How to close your account

You can delete your medical card and insurance yourself whenever you want. To delete your account, write to the administrator who invited you (or reply to the invitation e-mail). Your medical card, insurance and personal documents are deleted; what you added to a shared trip (expenses, check-marks) stays in that trip for the others, without your account.