Privacy Policy
Effective 2026-12-01 · Draft for review before launch
Waypack (“we”) is operated by Hejitech. This policy explains what we collect when you use the Waypack apps, the Waypack MCP server used by AI agents, and waypack.app.
What we collect
| Data | Why | Kept |
|---|---|---|
| Name and email address from your Google or Apple account (Apple may give us a private relay address) | Sign-in and account identification | Until you delete your account |
| Trip bundles your agent uploads (itinerary, places, notes, confirmation numbers you include) | To deliver them to your devices | Until you delete the trip or account |
| Offline map extracts for your trip areas | Offline maps | Deleted 30 days after the trip ends (re-created on request) |
Places and coordinates sent to geocode / compute_route | Sent to our routing provider (OpenRouteService) to answer the request; cached without your identity | Cache up to 30 days |
| Subscription and payment records (via Stripe; we never see your full card number) | Billing for Waypack Pro | As required for tax and accounting records |
| Basic server logs (IP, timestamps, errors) | Security and abuse prevention | Up to 30 days |
What we don't do
- We don't sell or rent your data, and we don't use it for advertising.
- Trip pages run on your phone with no analytics or trackers, and can't send data to the internet.
- Your location (GPS) stays on your device; it's used only to draw the blue dot on your map.
- We don't train AI models on your trips.
Your AI agent
Your agent (e.g. Claude, Cursor) is a separate service with its own privacy terms. Waypack only receives what the agent sends to the Waypack MCP server while you're signed in.
Where data lives
Account and trip records: Supabase (Postgres). Files: Cloudflare R2. Server code and website: Cloudflare Workers. Payments: Stripe. These providers process data on our behalf under their data-processing terms. Data may be processed in the United States.
Security
Trips are private to your account and reachable only through short-lived signed links. On your phone, trips are served only to the Waypack app over a local, token-protected connection.
Your choices
- Delete a trip: ask your agent (
delete_trip). - Delete your account: on your account page or in the app (Settings → Delete account). This cancels any subscription and deletes your account, trips and maps from our servers. You can also do this from your account page on waypack.app.
- Access or export: email privacy@waypack.app.
Children
Waypack isn't directed to children under 13 and we don't knowingly collect their data. Trips may mention children's ages when you include them in a plan; that information is stored as part of your trip.
Changes
We'll post changes here and update the date above. Material changes will be announced in the app.