Your travel history isn't a product. It's just yours.

Wayworn is designed with privacy as a starting point, not a feature. Your travel history — visited locations, photos, trips, and places — is created and stored on your device and, when iCloud Sync is enabled, in your personal iCloud account; it is never sent to the developer's servers. The only personal data held on our own servers comes from the optional account and albums feature described below, which is used only if you choose to.

This website, and the Community Albums area of the app, let you build curated albums of places, save them, and optionally publish them for others to import. Browsing and importing public albums is anonymous — no account is needed and no personal information is sent. Creating, saving, editing, or publishing albums requires a free wayworn.app account. When you have an account:

• Account details. We store your email address and, if you set one, a public username. You sign in with email and password, or with Apple or Google. We never see your password — it is stored only as a secure hash — and the app stores only an access token on your device.
• Albums you create or publish. The album's title, description, tags, and the places it contains (their names and map coordinates) are stored in our database. If you publish an album, that content — shown under your username — becomes publicly visible to other users, and a share link (an unguessable token) is created. Making the album private again rotates the token so the old link stops working.
• Reports. If you report a public album, the reason and any details you provide are stored so we can moderate content.

Your automatically detected travel data — visited locations, trips, photo records, and location history — is never sent to our servers.

All app information — including visited locations, photo records, trips, favourites, personal places, and places to see — is stored on your device. This travel data is never sent to the developer's servers.

iCloud Sync is off by default; if you enable it in Settings, your data is also synced to your personal iCloud account via Apple's CloudKit service, stored in your private iCloud database and not accessible to the developer or any third party. You can disable iCloud Sync at any time in Settings.

Wayworn requests access to your photo library to read location metadata (GPS coordinates) and dates from your photos and videos. Your actual photos and videos are never copied or uploaded — only the embedded location and date metadata is read. The Geotag Tool can write GPS coordinates to media missing location data, only when you explicitly use it. The Trip Montage feature temporarily accesses full-quality images to generate a video on your device; the video is saved locally and is not uploaded anywhere.

Wayworn requests “when in use” location permission to set your home location, find nearby places, and detect your current country when exploring. Location access uses coarse accuracy (approximately 100 metres) and is only requested while you are actively using the app — Wayworn never accesses your location in the background.

GPS coordinates extracted from your photos are used to match photos to countries and points of interest, display your travel history on the map, detect trips, and generate trip itineraries. Country matching is performed entirely on your device using bundled geographic data. This data is stored locally and is not sent to external servers, unless iCloud Sync is enabled, in which case it syncs to your personal iCloud account.

Wayworn uses the following Apple services. When these features are used, data is sent to Apple's servers and handled under Apple's privacy policy:

• MapKit — GPS coordinates are sent to Apple for reverse geocoding, location search, nearby points of interest, and loading map tiles.
• WeatherKit — trip coordinates and dates are sent to Apple to retrieve weather data for your trips.
• CloudKit / iCloud — when iCloud Sync is enabled, your data is synced to your personal iCloud account, stored in your private CloudKit database.
• HealthKit — if you grant permission, Wayworn reads step count, walking distance, and flights climbed to display activity statistics for your trips. Wayworn never writes data to HealthKit.

Aside from the optional accounts and albums feature described above, Wayworn does not send your data to any service other than Apple's.

Account and album data is stored on servers located in the United Kingdom — our hosting (Vercel) and database (Neon) both run in UK regions — and is processed on our behalf under data-processing agreements. Some limited processing involves providers outside the UK: in particular, verification and account emails are sent via Resend (United States). Where personal data is transferred outside the UK, the transfer is protected by appropriate safeguards, such as Standard Contractual Clauses. All other Wayworn data stays on your device or in your personal iCloud account.

We use only strictly necessary cookies: a sign-in session cookie, security cookies (a CSRF token and short-lived cookies that protect the Apple/Google sign-in flow, including a one-time consent cookie captured at sign-up), and an admin session cookie for the content-management area. We use no analytics, advertising, or tracking cookies, so we do not show a cookie banner. If we ever introduce non-essential cookies, we will ask for your consent first.

Wayworn may download regional point-of-interest data packs from Apple-hosted servers to provide location data for different countries and regions. These downloads contain geographic data only and do not include any of your personal information.

When you create a backup, the file is generated locally on your device. The backup contains your visited locations, photo records (including GPS coordinates), trips, personal places, places to see, and favourites. You choose where to save or share the file — Wayworn does not upload backups to any server. If you save a backup to a cloud service, your location history will be stored on that service.

Wayworn does not integrate with any third-party analytics, advertising, or tracking services, and does not sell or share your data with data brokers. The external services involved are: Apple's own services (MapKit, WeatherKit, CloudKit, HealthKit); the developer's own wayworn.app backend (hosting by Vercel, database by Neon, both UK); email delivery by Resend (US); and, if you use them, the sign-in provider you choose (Apple or Google). Each processes data only as needed to provide these features.

Wayworn is developed by an independent developer based in the United Kingdom. Your travel data remains on your device and, when iCloud Sync is enabled, in your personal Apple iCloud account — both under your direct control — and the developer has no access to it. Where you choose to use the optional accounts and albums feature, the developer acts as the data controller for the limited account information (email address and username) and the album content you create or publish, and processes it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where Wayworn processes personal data on your device (such as photo GPS coordinates and location history), the legal basis is your consent, given by granting photo library and location permissions through the operating system; you can withdraw it by revoking those permissions. Processing of health data via HealthKit is based on your explicit consent.

For the optional accounts and albums feature, the legal basis for storing your account details and albums is the performance of our agreement with you to provide that feature, together with your consent given when you create an account. The legal basis for moderating reported content and keeping limited moderation records is our legitimate interest in keeping the feature safe and lawful for everyone.

Data stored on your device remains until you delete it (using “Reset All Data” in Settings, or by deleting the app). For the optional account, your account details and albums are kept for as long as your account exists. When you delete your account, they are deleted — except: (a) any albums you chose to keep published, which remain visible but are no longer linked to your account; and (b) limited moderation records, such as reports of content, which we retain for a reasonable period for safety and audit purposes. Backups and GeoJSON files you export are under your own control and are not retained by the developer.

Under UK data protection law, you have the right to access, correct, and delete your personal data.

• Access — view your data within the app or on the website at any time.
• Deletion — use “Reset All Data” in the app or delete the app for on-device data; delete your account (in the app under Settings → Delete Account, choosing whether to keep or delete any albums you have published, or on the website) to remove your account and albums.
• Portability — use the Backup feature in the app, or the Export GeoJSON option on the website.
• Withdrawal of consent — revoke photo, location, or health permissions in your device's Settings app, or sign out of the website.

You can also contact us to exercise any of these rights, and you have the right to complain to the UK Information Commissioner's Office (ICO).

Wayworn's core travel features process and store data entirely on your device and are suitable for users of any age. The only feature that collects personal data is the optional wayworn.app account, which is intended for users aged 13 and over — the developer does not knowingly collect personal data from children under 13 through it. If you believe a child under 13 has created an account, please contact us and we will delete it.

Any changes to this privacy policy will be reflected on this page and, where relevant, in an app update. We encourage you to review this policy periodically.

If you have questions about this privacy policy, or wish to make a data-protection request, please contact us at hello@wayworn.app.