Privacy & Disclosures
What Wayfind is
Wayfind is a local discovery app that helps visitors find great places nearby. You can use most of it without an account. WAYFIND LLC is the data controller for the personal information described here.
What we collect
If you create an account: your email address. If you choose Sign in with Apple, Apple may provide the email address you choose to share (including a private relay address) and, on the first authorization, the name you choose to share. Authentication credentials are managed by Supabase and Apple; Wayfind does not receive or store plaintext passwords. Supabase stores salted password hashes for password-based accounts.
If you use features: places you save, like, or write tips about, and coupons you keep. Your search location is used to find nearby places and power results. Preferences for signed-out visitors (saved spots, likes, settings) are stored on your own device and never leave it unless you sign in.
How long we keep it
• Account data (email, saved places, tips): kept while your account exists; deleted when your account is deleted.
• On-device data (signed-out saves and preferences): stays on your device until you clear it; we never see it.
• Analytics events: retained by PostHog per our project settings.
• Server logs (Vercel): short-lived operational logs.
Legal bases
Where laws such as the GDPR apply, we process personal data on these bases: performing our service for you (accounts, saved places), our legitimate interest in understanding and improving the product (analytics, security), and your consent where required (marketing email, if ever introduced).
Your rights
You can request access to, a copy of, or deletion of your personal data at any time. Email privacy@gowayfind.com from the address on your account and we will verify the request and respond. Deletion removes your account, saved places, and tips from our systems.
Signed-out data lives on your device: clearing your browser storage removes it completely.
Sale or sharing of personal information
We do not currently sell or share personal information for cross-context behavioral advertising, as those terms are defined under applicable law (for example, the CCPA/CPRA). We reserve the right to do so in the future.
International transfers
Wayfind's providers (Vercel, Supabase, Apple, PostHog, Google, Resend) process data in the United States. If you use Wayfind from outside the US, your data is transferred to and processed in the US.
Location data & analytics
Your precise device location (if you grant it) is used in your browser to rank nearby places and is sent to Google's Places service to run your searches. Analytics events describe features used and screens viewed. This page does not state whether location coordinates are included in analytics events. See “Sale or sharing of personal information” above for how location data is treated with respect to sale or sharing.
Analytics, consent & opt-out
We use PostHog to understand how the app is used (screens viewed, features tapped) so we can improve it. Analytics are for product improvement only. Web performance metrics (page speed measurements) are also collected.
Device recognition
To remember your preferences and recognize a returning device, we store a random, anonymous device identifier in your browser — in local storage and a first-party cookie that can last up to two years. It contains no personal information and is first-party only: we never use it for cross-site or cross-app tracking, and we never use fingerprinting or “evercookie” techniques to recreate it after you delete it. If you sign in, that device is linked to your account so your saved spots and preferences follow you across sessions and devices. Opt out: turn on “Do Not Track” in your browser and we switch to a session-only identifier that is not kept between visits; clearing your browser’s site data removes it entirely.
Children
Wayfind is not directed at children and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact privacy@gowayfind.com and we will delete it.
Security practices
All traffic is encrypted in transit (HTTPS). Accounts and data are hosted by Supabase with row-level security policies limiting each user to their own records. Passwords are never stored by Wayfind in any form (see above). Access to production systems is limited to the operator.
Emails
We send account emails (confirmation, password reset) through Resend and Supabase. No marketing email without your consent.
Affiliate disclosure
Some links to tickets, tours, hotels, and experiences (for example via Viator, GetYourGuide, Stay22 and its booking partners, and Travelpayouts and its partner brands such as Tiqets, Klook and TicketNetwork) are affiliate links. If you book through them, Wayfind may earn a commission at no extra cost to you. Commissions never influence our merit-based Wayfind Score. Where a placement is sponsored or commercially promoted, it is clearly labeled as such.
Service providers
Wayfind runs on Vercel and uses Google Maps Platform for places and maps, Supabase for accounts and data, Apple for optional Sign in with Apple authentication, PostHog for analytics, Resend for email, and Stay22 and Travelpayouts for booking-link optimization and affiliate tracking. Stay22 and Travelpayouts are third-party scripts that may set cookies to attribute bookings. Each processes only what is needed to provide the service.
Contact
WAYFIND LLC · privacy@gowayfind.com