Privacy Policy

Only what the app needs to work. In full:

• Your account. Email address, and a password unless you sign in with Google. The password is hashed by our authentication provider and is never visible to us.
• Your profile. Name, email, optional phone, city, state, country, your age, and the kinds of trips you like.
• Who travels with you. Counts only — how many adults, teens, kids, toddlers and pets. We do not collect names or ages for anyone but you. In particular we hold no identifying information about children.
• Your calendar. Date ranges you mark as busy, and school break dates you enter.
• Your trips. Name, dates, destination, amount spent, and any lodging details you add — including the address and booking link.
• Trip content. Expenses, checklists, notes and messages you write on a trip.
• People you add to a trip. Their name and the email or phone you enter for them. See other people's information below.
• Wishlist and travel map. Places you want to go and places you mark as visited.
• Google, if you choose to connect it. Signing in with Google gives us your name and email address. If you connect Google Calendar we store the Google account's email address and an encrypted access token, and read your events to keep the days you are busy, each labelled with the event's title. We do not keep attendees, locations or descriptions. Disconnecting removes the token and those busy days; do it at any time from the calendar page, or from your Google account settings.
• Billing, if you subscribe to Wanderyay Plus. Stripe takes your payment. We store your Stripe customer and subscription IDs, your plan, and its renewal date. We never see or store your card number.
• Technical logs. Our hosting and database providers record IP addresses and request details for security and reliability. We do not use them to build a profile of you.

We do not use advertising trackers, analytics that follow you across other sites, or cookies beyond the one that keeps you signed in.

To run the app you asked for: to keep your trips available on every device you sign in from, to work out when your household is free, to split expenses between the people on a trip, and to suggest places that suit the ages of the people travelling.

We do not sell or share your personal information, in the ordinary sense or in the specific sense those words carry under California law. We have never done so and have no plans to.

• Supabase hosts the database and handles sign-in.
• Vercel hosts the website.
• Resend delivers account emails such as confirmations and password resets, trip invitations and trip reminders.
• Stripe processes Wanderyay Plus payments. It receives your email address and the card details you enter on its checkout page, which never pass through Wanderyay.
• Google handles sign-in if you choose “Continue with Google”, and supplies your busy times if you connect Google Calendar. Wanderyay's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show when you are free; it is not shared, sold, or used for advertising or to train AI models.
• Anthropic receives trip details when you ask the app to build a day-by-day itinerary — the destination, dates, how you are travelling, and the traveller counts and preferences from your profile. It does not receive your name, email, address, or anything about your expenses, messages or notes. This only happens when you press the button.

Anyone you share a trip with can see that trip: its dates, lodging, itinerary, expenses, checklist, notes and messages. They cannot see your profile, your busy dates, your school calendar, your wishlist or your travel map.

When you add someone to a trip, you enter their name and contact details. That is their personal information, not yours, and you are the one deciding to put it here. Only add people who would be comfortable with it, and remove them when a trip is over if they would rather not be listed.

If someone contacts us asking to be removed from a trip they did not create, we will remove them.

If you are a California resident, the CCPA gives you the right to know what we hold, to get a copy, to correct it, and to have it deleted. We extend all of these to everyone, because it would be strange not to.

• Get a copy. Your profile page has a button that downloads everything we hold about you as a JSON file. No request, no waiting.
• Correct it. Edit your profile and trips directly in the app.
• Delete it. Your profile page has a delete button. It removes your account, your profile, your trips and everything on them, immediately and permanently. There is no recovery period and no hidden copy.
• No discrimination. Exercising any of these does not change what the app does for you.

One limit worth stating plainly: deleting your account does not delete trips that other people created and invited you to. Those belong to them. Your participation is removed, and messages you sent stay visible to the people still on the trip under the name you used, so the conversation still makes sense.

Until you delete it. We do not expire trips or archive old accounts. When you delete your account it is gone from the live database straight away; encrypted backups held by our database provider roll off on their own schedule, within 30 days.

Wanderyay is for adults planning family trips. You must be 18 or over to create an account. We do not knowingly collect information from children, and the app deliberately does not ask for the names or ages of the children in your household — only how many are travelling, so it can pitch suggestions at the right level.

Access is enforced by the database itself rather than only by the app: every table has row-level policies, so a mistake in the interface cannot expose someone else's trips. Traffic is encrypted in transit. Passwords are hashed by our authentication provider and never stored by us.

No system is perfect. If you find a problem, tell us at the address below and we will take it seriously.

If this policy changes in a way that affects what we collect or who sees it, we will say so in the app before the change takes effect, not merely update the date at the top of this page.

Questions, corrections, or a request we have not made self-service: privacy@wanderyay.com