Privacy Policy

Who we are

Wayfaro is operated by Mehdi Amari, trading as MEDCORP, a sole trader registered in France (SIREN 521 536 185). We are the data controller for the personal data described in this policy. You can reach us at any time at privacy@wayfaro.app.

Your account and how you sign in

Wayfaro needs an account so your trips and trip credits stay attached to you across devices. You can create one in three ways:

• Sign in with Apple — Apple shares your name and an email address. If you choose “Hide My Email”, Apple gives us a private relay address instead of your real one.
• Sign in with Google — Google shares your name, email address, and profile picture.
• Email and password — we email you a six-digit code to confirm the address. Passwords are hashed by our authentication provider (Supabase); we never see or store them in readable form.
• Before you sign in, the app may create a temporary anonymous session so you can look around. Anything created in that state is ephemeral and is not carried over when you later sign in.

We never ask for your phone number, postal address, or payment details.

What we collect

We keep this to what the service actually needs.

• Account data: your email address, and the name and profile picture your Apple or Google account chooses to share.
• Trip preferences you enter during onboarding: destination, travel dates, who you're travelling with, travel style, budget level, and any special needs you describe in your own words.
• The itineraries Wayfaro generates for you, including any edits you make to them.
• Purchase records for trip credits: the transaction identifier and receipt from the Apple App Store or Google Play, linked to your account. We never see your card number or billing address — payment is handled entirely by Apple or Google.
• Support conversations: if you open the in-app chat or email us, we keep your messages and the address you wrote from.
• Basic technical data needed to operate the service, such as server request logs.
• Product analytics and error reports: which screens you visit, how far you get through onboarding, which features you use, your device model, OS and app version, and crash and error reports — linked to your account.

How we use your data

• To create and secure your account and sign you in.
• To generate and deliver your personalized itinerary.
• To grant, reserve, and refund the trip credits you purchase.
• To operate, secure, and debug the service.
• To respond when you contact support.
• To understand how the app is used — for example where people abandon onboarding — so we can improve it, and to detect and fix crashes and errors.

That's it. We don't use your data for advertising, we don't build marketing profiles, and we never sell or share your personal data with data brokers. There are no advertising or ad-tracking SDKs in the app; the only third-party analytics service we use is PostHog, described below.

Who processes your data

To run the service and build your itinerary we rely on a small number of providers. Each one receives only the data it needs for its part of the job.

None of these providers is permitted to use your data for its own advertising. Several are based outside the European Economic Area; for those transfers we rely on the European Commission's standard contractual clauses or an equivalent safeguard.

Data retention

Your account, trip preferences, and itineraries are kept for as long as your account exists, so the app can keep showing you your trips. Purchase records are kept for as long as accounting and fraud-prevention obligations require. Server logs are kept for a short period for security and debugging.

You can ask us to delete your account at any time — from the account deletion page on this site, or by emailing privacy@wayfaro.app. When you do, we delete everything linked to your account except records we are legally required to keep.

Your rights

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to:

• access the data we hold about you;
• have it corrected or deleted;
• receive a copy in a portable format;
• restrict or object to certain processing;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@wayfaro.app from the address on your account, or use the account deletion page on this site. We may ask you to confirm your identity first, so that we never disclose or delete someone else's data. We honor deletion requests from everyone, not only where the law requires it.

Children

Wayfaro is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as Wayfaro evolves. We will post the new version on this page and update the date above. If a change is material, we will say so prominently in the app or on this site.

Contact

Wayfaro is operated by Mehdi Amari (MEDCORP), based in France. For anything related to your data, email privacy@wayfaro.app.