Privacy

Wayfarer helps you plan trips by chatting with an AI assistant. To do that it needs to know about you and your trips, and it keeps them so you can come back to them.

• Your trips, travel journal, ratings and photos are private to you. We do not sell your data and we do not show advertising.
• The assistant only gets the details each task needs. Your journal and photos are never sent to it.
• Health-related details are optional. They are only collected, stored and shared with the assistant if you say yes, and you can take that back at any time.
• You can download everything we hold about you, or delete your account and all of it, from Settings.

Wayfarer is run by [full name or company name], of [address], Guernsey. We are the “controller” of your personal data, which means we decide how and why it is used.

You can contact us about anything in this policy at [privacy contact email].

We are registered with the Office of the Data Protection Authority in Guernsey, registration number [number]. We follow the Data Protection (Bailiwick of Guernsey) Law, 2017 and, where it applies to you, the UK and EU GDPR.

We collect only what the service needs:

• Your account: your email address and a password. The password is handled by our sign-in provider and is never stored or visible to us in plain text.
• Your travel profile: what you tell us about how you like to travel, such as the kinds of holiday you enjoy, pace, climate, where you like to stay, interests, dietary needs, who you travel with and your usual budget.
• Health-related information (optional): allergies, conditions, medication, vaccinations, mobility and fitness, and access needs. See “Health-related information” below.
• Your trips: the details you enter (destination, dates, travellers, budget, wishes), every plan and saved version, the conversations you have with the assistant (typed text, or the text of what you say when you use voice), and the extra information we find for a trip: travel information, events and holidays on your dates.
• Your travel journal: diary entries, your ratings of places and your photos, plus the countries and distances worked out for a trip. These are private to you.
• Photos: shrunk on your device before they are saved, which also removes the camera's location and device details. Only the picture and any caption you write are kept.
• Usage records: how many requests you make to the assistant, how long they take and how much text they use, so we can apply fair-use limits, manage costs and find slow or failing features. The person running the service can see these figures for each account, along with the account's email address, but not the content of your conversations or trips. While the service is in a closed test, each new account is also approved by hand.
• Technical data: your browser and device type and your IP address appear in the logs kept by our hosting provider, and when your browser loads maps and pictures from other services (see “Who else handles your data”).

The law asks us to give a reason for each use. Ours are:

• To provide the service you asked for (building your profile, researching and planning trips, saving them, keeping your journal, photos and Travel log): because we need it to deliver our service to you (“contract”).
• To keep the service safe, working and affordable (fair-use limits, spotting errors, preventing misuse): our legitimate interest in running a reliable service, balanced against your privacy.
• To use your health-related information, if you choose to give it: your explicit consent, which you can withdraw at any time.
• To meet our legal duties, for example responding to a request from you or a regulator: legal obligation.

Health details are “special category” data, so we treat them with extra care. You are asked before any are collected, you can skip the question, and the service works fully without them.

If you give them, they are stored with your profile and used only where they matter for your trip, for example allergy phrases and accessibility notes in your travel information, or avoiding a strenuous hike if you have said mobility is limited. They are not used for anything else.

If you withdraw consent, from your profile or Settings, the details are deleted. If you have not consented they are never saved to your profile and never sent to the assistant from it. (A message you type into a chat is sent like any other message, so please only write what you are comfortable sharing.)

The assistant is powered by Anthropic's Claude models. When you use it, we send Anthropic your messages, your trip details and the parts of your profile that the task needs. For example, a search for events on your dates sees your interests but never your health details; travel information sees diet, who you travel with and, only with your consent, your health details.

Your journal entries, ratings and photos are never sent to the assistant.

When planning, the assistant searches the web through Anthropic's search tool to find real places, opening times and prices. What it finds is saved with your trip. Prices are estimates, not quotes, and the assistant can be wrong: please check anything important with the provider or an official source before relying on it.

Nothing the assistant does has a legal or similarly significant effect on you, and a person is not making decisions about you from it. The travel information is guidance, not medical, legal or financial advice.

Anthropic's terms and privacy information are at anthropic.com/legal.

Voice chat uses your browser's built-in speech recognition and speech synthesis. Depending on your browser, your device or the browser's maker may process the audio to turn it into text. We receive and keep only the resulting text, never the recording.

By default, replies are read aloud by a speech provider so they sound natural: the text of the assistant's reply (not your voice, and not your name or email) is sent, a sentence or two at a time, to be turned into audio for your device: [name the speech provider(s) in use, Google Cloud Text-to-Speech and/or ElevenLabs]. The reply text can mention your trip, and may include details you have shared. If the provider cannot be reached, your browser reads the reply instead. We keep a count of the characters spoken, with the date, to apply a daily limit, but not the audio or the text. In Settings you can choose your device's own voice instead, and then nothing is sent to a speech provider.

We use these providers (“processors”) to run the service. They only act on our instructions, except where noted:

• Supabase: our database and sign-in. Your account, profile, trips, conversations, journal and usage records are stored in the EU (Ireland).
• Cloudflare: hosts the app and stores your photos in the EU. Its network handles every request to the site, so it also sees technical data such as IP addresses.
• Anthropic: the AI assistant and its web search, as described above. It is based in the United States.
• SerpApi: when you look for live flight or hotel prices, our server sends it the details of the search only (airport codes, dates, the area of the hotel and number of travellers), never your name, email or profile. Results are kept for a few hours so repeated searches are quicker. It is based in the United States.
• Google Maps: where switched on, maps and place details (such as photos and ratings) are loaded by your browser from Google, which then sees your IP address and the places you look at. Google acts as its own controller for this.
• Wikipedia and Wikimedia, and OpenStreetMap: pictures of places and map tiles are loaded by your browser straight from them, so they see your IP address. They act as their own controllers.

Supabase and your photos are kept in the EU. Anthropic, SerpApi and Google are in the United States, and Cloudflare operates worldwide. Guernsey, the UK and the EU recognise each other's data protection as adequate. For transfers to the United States we rely on the safeguards each provider offers, such as approved standard contractual clauses or its participation in the data privacy framework: [confirm the mechanism for each before launch].

We use only what is needed to run the service: a sign-in cookie that keeps you signed in, and a few small items kept in your browser (for example which itinerary view you last chose, whether you have dismissed the getting-started list, an unsent diary entry, and a note that a long search is still running). We do not use advertising or tracking cookies, and we do not use analytics.

We keep your data until you delete it or delete your account.

• Deleted trips and versions wait in the bin for 30 days so you can change your mind, then they are removed for good (you can also delete them for good straight away).
• Deleting your account removes your profile, trips, conversations, journal, ratings, photos and usage records. It cannot be undone.
• Live price search results are reused for up to six hours, and expired ones are cleared the next time you search.
• Backups: our database provider keeps backups for a limited time, after which deleted data is gone from them too [state the period].
• Hosting and security logs are kept by Cloudflare for a short period [state the period].

You have the right to:

• See what we hold about you and get a copy: use “Download my data” in Settings.
• Correct it: edit your profile and trips at any time.
• Have it deleted: delete your account in Settings.
• Take your consent back, for health-related information, at any time, from your profile.
• Restrict or object to how we use it, or ask for it to be moved to another service: contact us and we will help.
• Complain: to the Office of the Data Protection Authority in Guernsey (odpa.gg), or, if you live in the UK, the Information Commissioner's Office (ico.org.uk), or the regulator where you live in the EU. We would appreciate the chance to put things right first.

Everything travels over encrypted connections. Each person can only reach their own rows in the database, and only a small number of people can reach the systems that run the service. No system is perfectly secure; if there is a breach that puts you at risk we will tell you and the regulator as the law requires.

Wayfarer is not for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us details, contact us and we will delete them.

If we change what we do with your data (for example by adding a new provider) we will update this page and the date at the top, and tell you in the app if the change matters to you.