Privacy Policy | WiseWay

Who is responsible for your data

WiseWay is currently operated under the WiseWay project name. The formal legal provider and data-controller identity, including its business address, will be published before the mobile application opens for commercial release.

Privacy and support requests are currently accepted at support@wisewayapp.com.

Information WiseWay processes

Depending on the features you choose, WiseWay processes:

account identifiers, including your Supabase user ID and email address;
profile data, including display name, avatar, bio, languages, interests, travel style, optional birth date and social preferences;
trip data, including destinations, dates, budget, travellers, preferences, itinerary items and notes;
photos, including avatars, trip covers and travel contribution photos;
social content, including friendships, groups, direct or activity messages, reactions, reports and blocks;
foreground location, city or country when you use nearby discovery or photo verification;
available photo metadata and authenticity signals, including EXIF/GPS information, dimensions, source and moderation status;
notification tokens and preferences, device platform, language, app/build context and bounded operational error data;
WiseWay Coin reward records and legacy entitlement records. The current release does not sell Coins or subscriptions.

WiseWay does not ask for background or “Always” location permission. Uploaded photos are rewritten before storage so original embedded EXIF is removed, but coordinates used for verification may be stored separately.

Why information is used

Information is used to:

create accounts, authenticate users and keep sessions secure;
provide trip planning, budgets, packing, destinations, audio guides and travel memories;
personalise recommendations and generate or edit itineraries when you choose AI-powered features;
enable friends, groups, messaging, sharing, nearby discovery and notifications;
moderate photos and content, investigate reports, enforce blocks and prevent abuse;
operate support, diagnose failures, enforce rate limits and protect the service.

Legal bases

Where GDPR applies, processing is expected to rely on performance of the service contract, legitimate interests in security and service operation, consent for optional permissions and consent-gated OpenAI features, and compliance with legal obligations. The precise legal basis can vary by feature and by the law that applies where you live.

AI-powered features

Some trip planning, image assistance and content-safety features use OpenAI through Supabase Edge Functions. Before the first OpenAI-backed request, the app presents a named, versioned choice. If you select “Not now”, those requests are blocked. You can later withdraw the choice from the in-app Legal screen.

Relevant trip constraints, preferences, place names, edit instructions or user content needed for moderation may be sent only for the feature you use and when the recorded consent state permits it. Provider-specific processing and retention are also governed by the applicable provider terms and data-processing arrangements.

Photos, location and public content

Pending avatars and travel contributions are stored in private areas. If a travel contribution is approved, a moderated copy and its place attribution may be made publicly available. Exact coordinates used for verification are not shown to ordinary users.

Device location is requested only in the foreground for a feature that needs it. You may deny the permission, although the related nearby or verification feature may then be unavailable.

Messages and social features

Direct messages, activity/group messages, friend relationships, reports, reactions and blocks are stored in Supabase and are restricted by participant, relationship and database access rules. Reports may include related account, message or content context for human review. Notification previews for direct messages do not include the private message body.

Service providers and transfers

WiseWay uses or integrates with:

Supabase for authentication, Postgres database, storage, realtime features and Edge Functions;
OpenAI for consent-gated AI and content-safety processing;
Google Places for place search and details;
Expo Push and Apple Push Notification service for optional notifications;
Resend for transactional welcome email;
Wikimedia/Wikipedia for destination imagery and information;
Open-Meteo for weather and geocoding, and the U.S. Department of State service for travel advisories;
a protected WiseWay administration/monitoring service for bounded operational events.

Data may be processed outside your country. Where GDPR applies, WiseWay will use an applicable transfer safeguard, such as an adequacy decision or standard contractual clauses, when one is required.

Analytics, diagnostics and security logs

The inspected release does not include a dedicated advertising, cross-app tracking, analytics or crash-reporting SDK. It does send bounded authenticated operational events and error context to WiseWay’s administration service and relies on provider logs for reliability and security. These records do not intentionally include passwords, access tokens or secret keys.

Retention and account deletion

Account-linked information is kept while needed to provide and secure the service. In the app, open Profile → Settings → Delete Account and complete both confirmation steps. The implemented server flow removes owned storage objects before deleting the Supabase Auth user, after which database cascades remove account-linked records.

Some limited security, moderation, delivery, legal or backup records may remain for a justified period and are deleted or anonymised when they are no longer needed. Backup copies may remain until the relevant provider’s normal backup cycle completes.

Your privacy rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent, and complain to a competent data protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal.

WiseWay may need to verify that a request relates to your account. Contact support@wisewayapp.com.

Children

WiseWay is not intended for anyone who cannot legally create an online account or consent to the relevant data processing in their country. Before public account registration opens, WiseWay will publish and enforce a specific minimum age for its launch countries. A parent or guardian should contact WiseWay if they believe a child created an account without required authorisation.

Security

WiseWay uses encrypted network transport, authenticated server requests, Row Level Security, private storage areas, rate limits, moderation controls and secure device session storage. No service can guarantee absolute security. Do not send passwords, recovery codes, passport data or payment-card details to support.

Changes and contact

This policy may change as the product, providers or legal obligations change. The last-updated date will be revised when a new version is published. Questions can be sent to support@wisewayapp.com.