Privacy Policy

Wayfinder is built so that your movement, your reflections, and your story stay yours. This policy explains what we collect, why, and the choices you have.

What we collect

• Account: your account identifier, email address, profile name and the purpose you choose during setup. • Movement sync: step counts, location area labels and derived constellation data. Current GPS samples used for sync are stored temporarily on your device. • Health (optional): heart rate and distance, read from Apple Health only with your explicit permission. This data is read-only — Wayfinder never writes to Health. • Your words: journal entries and the reflections you choose to write. • Atlas backup (optional): approximate discovered cells and first/last observation dates, linked to your account only after you enable backup.

How we use it

Your data is used only to create your experience: to draw your daily constellation, generate your readings, and build your personal growth timeline. We do not sell your data, and we never use your health or movement data for advertising.

Automatic Atlas — optional preview

When you explicitly enable Atlas and allow Always location access, iOS delivers occasional significant location changes, including in the background. We also request a location when you return to the app, at most once a minute. We convert usable observations into approximate 500-metre cells, not a complete route. All transport modes count. Zones are stored locally for your account and excluded from device backups. If you enable account backup after the separate disclosure, cell identifiers, approximate centres and first/last observation dates are stored with your account on Supabase for backup and multi-device restore. No raw GPS fixes, Health data, map tiles or Atlas diagnostics are uploaded by Atlas backup, and Atlas cells are not sent to our AI provider. Restoring does not enable location recording. Apple Maps supplies the basemap under Apple’s privacy terms. Short journeys and imprecise observations may be missed. Signing out pauses collection. Deleting the app removes the local copy; only discoveries already synchronized with an enabled account backup can be restored.

Where it lives

Your account, synced movement summaries, readings, journal entries and optional Atlas backup are stored with our backend provider (Supabase) under row-level security, so other app users cannot access your records. Authorized backend administrators and the hosting provider may have privileged access; this is not end-to-end encryption. Subscriptions are handled by Apple and RevenueCat; we do not receive your payment card details, but process subscription status and purchase records to provide paid access. Authentication emails, including password reset messages, are delivered through Resend. This involves your email address and the authentication email content.

Optional AI-generated readings and reviews

We ask for your separate permission before sharing data with Anthropic to generate new readings or reviews. Daily readings use a movement summary that can include step count, distance, area and stop labels, movement patterns and recent reading feedback. Weekly and monthly reviews can also include your profile name, stated purpose and aggregate movement patterns. These summaries are not anonymous. Atlas backup cells are not included in these AI requests. You can decline or withdraw AI permission in Profile. This stops new AI generation without removing saved readings or disabling Atlas and other non-AI features. If you withdraw while offline, this device blocks new generation immediately and synchronizes the withdrawal when it reconnects. Withdrawal does not recall data already sent to the provider.

Your choices

You can revoke Health or Location access in iOS Settings and pause Atlas recording independently of backup. In Atlas, Stop backup and remove cloud copy keeps this device’s local atlas but removes the account backup; enabling again requires permission. Delete atlas removes this device’s zones and any enrolled account backup. Offline deletion is queued and completes after reconnection; other enrolled devices reconcile on their next connection, so disconnected copies cannot be erased instantly. Deleting your account from Profile removes its server-side Atlas records and the local copy on this device. Provider backups may retain deleted data according to their retention schedules. Contact us about data held on disconnected devices or other privacy requests.

Contact

Questions about your privacy? Reach us at privacy@wayfinderapp.life.