Legal
Privacy Policy
Last updated: October 1, 2026
The short version
- We collect what Waymark needs to work: your account details, the cities you collect, and photos you choose to upload.
- Your location is read only when you use the app. Waymark does not track you in the background.
- Location sharing with friends is off by default and you can turn it off at any time.
- We don't sell your data, show ads, or use analytics or advertising trackers.
- You can delete your account and its data from inside the app.
1. Who we are
Waymark ("Waymark", "we", "us") is a mobile app for collecting the cities you visit. This policy explains what personal data the Waymark app and its servers collect, why, and what choices you have. If you have any questions, contact us at help@waymark-support.fyi.
2. Data we collect
Account information
- Email address and display name. Used to create and identify your account.
- Password. If you sign up with email, we store only a secure hash of your password, never the password itself.
- Sign in with Apple / Google. If you use one of these, we receive an account identifier and your email address (or Apple's private relay address) from that provider. We never receive your Apple or Google password.
- Profile picture. Optional. Only if you upload one.
Location
- When you collect a city. We receive your GPS coordinates and their accuracy at the moment you tap collect. These are used to verify that you are in the city and are stored with that visit.
- On the map. Your location is used on your device to show your position. It isn't sent to us for this purpose.
- Location sharing (optional, off by default). If you turn on location sharing, the app sends your current location to our servers when you open it, and it is stored as your last known location together with a timestamp. While sharing is on, other Waymark users can see this location. When you turn sharing off, it is no longer shown to anyone.
- Waymark uses "While Using the App" location permission only. It does not collect your location in the background.
Your collection
- The cities and landmarks you collect, the dates you collected them, and past trips you add manually.
Photos
- Camera and photo library. Used only to take or pick photos and to link albums to your cities. Only photos you choose to upload leave your device.
- Uploaded city photos. Stored on our servers along with whether the photo was taken at collection time. Your city photos are private unless you choose to share them with friends.
Friends and social features
- Friend requests and friendships, and notifications such as "your friend collected a new city".
- Other Waymark users can find you by searching for your display name. Search results show your display name and profile picture.
Other information
- Push notification token. If you allow notifications, we store a device token so we can send them.
- Feedback and reports. Messages you send through in-app feedback, and reports you file about photos.
- Password reset codes. Stored temporarily and only as a hash. They expire after 10 minutes.
- Technical logs. Our servers may briefly log standard request information, such as IP address and request time, for security and to fix problems.
3. How we use your data
- To run your account and sign you in.
- To verify and record the cities you collect, and to calculate your WayScore and leaderboard position.
- To show your collection and shared photos to your friends, and to send you notifications about friend activity.
- To send transactional emails, such as password reset codes.
- To answer support requests and review reported content.
- To keep the service secure and prevent abuse.
We do not sell your personal data, use it for advertising, or use it to build advertising profiles. Waymark contains no third-party analytics or advertising SDKs.
4. Who can see your data
- Friends (people whose friend requests you've accepted) can see your display name, profile picture, the cities you've collected, and any city photos you've chosen to share.
- Leaderboards show your display name, profile picture and number of collected cities to your friends.
- Other Waymark users can find you in search, and can see your last shared location while location sharing is turned on.
5. Service providers
We rely on a few trusted providers to run Waymark. They process data only on our behalf and only as needed to provide their service:
| Provider | Purpose | Data involved |
|---|---|---|
| Fly.io | Hosts our servers and database (region: Frankfurt, Germany) | All account and app data |
| Cloudflare (R2) | Stores uploaded images | Profile pictures and city photos |
| Resend | Sends transactional email | Email address, password reset codes |
| Apple | Sign in with Apple, push notifications, maps | Sign-in identifier, device token, notification content |
| Google Sign-In | Sign-in identifier and email | |
| OpenStreetMap (Nominatim) | Works out which city a set of coordinates is in | Coordinates of a collection (sent by our server, not linked to your account) |
Some of these providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
We may also disclose information if required by law or to protect the rights and safety of our users or others.
6. How long we keep data
- We keep your account data for as long as your account exists.
- When you delete your account, your profile, collected cities, landmarks, friendships, notifications and push tokens are deleted. Your profile picture and city photos are deleted from our storage.
- Feedback you've sent and reports you've filed may be kept after your account is deleted, but they are no longer linked to you.
- Password reset codes expire after 10 minutes.
7. Your choices and rights
- Location: turn location sharing on or off in the More tab, or change location permission in your device settings.
- Photos: remove a photo, or stop sharing it with friends, at any time.
- Friends: remove a friend at any time.
- Notifications: turn push notifications off in your device settings.
- Delete your account: go to More → Delete Account. This happens immediately and can't be undone.
Depending on where you live (for example in the EU, UK or California), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to complain to your local data protection authority. To exercise any of these rights, email help@waymark-support.fyi.
Where the GDPR applies, we process your data to provide the service you've asked for (performance of a contract), on the basis of your consent (for example location sharing, push notifications and photo uploads, which you can withdraw at any time), and for our legitimate interests in keeping Waymark secure and preventing abuse.
8. Security
Data is sent over encrypted connections (HTTPS), passwords and reset codes are stored only as hashes, and access to our systems is restricted. No system is perfectly secure, but we work to protect your information.
9. Children
Waymark is not directed at children under 13 (or the minimum age required in your country), and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. When we do, we'll change the "Last updated" date above, and if the changes are significant we'll let you know in the app.
11. Contact
Questions or requests about your privacy: help@waymark-support.fyi