Privacy policy

This explains what Wayfare (run by the Wayfare team) collects, why, and your choices. In short: we collect what's needed to run events, trips and bookings, we don't sell data, we don't show ads, and we don't use third-party trackers.

What we collect

• Account: your email address and the name you choose.
• What you create: events, trips, stops and places, RSVPs and answers to hosts' questions, messages, photos, reviews, quote requests and their replies.
• RSVPs without an account: the name you give and, if you choose, your email so the host can send updates.
• Usage: first-party records of actions like opening a shared link, RSVPing or creating an event, so we can see what works. We store a random ID in a cookie for visitors who aren't signed in. We don't store IP addresses in these records.
• Abuse prevention: your IP address is held briefly to rate-limit requests (for example sign-in attempts) and deleted automatically, usually within hours.
• Feedback and reports: what you write, the page you were on and your browser type.

Who can see what

• Public events and trips, reviews, and your display name on them are visible to anyone.
• Private and unlisted events are visible to people who have the link or an invite. Group chats are visible only to their members.
• Hosts see the names of people going and their answers, and email addresses of people who RSVP'd from a link and left one, so they can contact them about the event.
• When you send a quote request, the venue receives your name, email and the details you wrote.

Service providers

We use these companies to run the service; they process data on our behalf and only as needed:

• Vercel (hosting) and Supabase (database, photo storage, realtime updates).
• Resend (sending email).
• Anthropic (the assistant): your messages to the assistant and the event details it reads are sent to Anthropic's API to generate replies. Anthropic doesn't use API data to train its models by default.
• OpenFreeMap and OpenStreetMap services (map tiles, place search and routing), which see the map areas and searches your browser requests. Wikipedia/Wikimedia for some place photos.
• Humanitix, only if you connect your account, to read your own events.

Some of these providers store data outside Australia, including in the United States.

Cookies

• A sign-in cookie that keeps you signed in (essential).
• A random visitor ID for first-party usage counts (no advertising, no cross-site tracking).

Emails

We send sign-in codes, invites you or a host send, and, unless you turn them off in Settings, updates about events and trips you're part of. Venues receive enquiries only when a user sends one, and every enquiry has an unsubscribe link.

How long we keep it

• Your account data until you delete your account. Deleting it removes your profile, the events and trips you created, your reviews and your messages.
• Usage records for up to about 13 months. Expired sign-in codes and sessions are deleted automatically.
• Data may be kept longer where the law requires it.

Your choices and rights

• Download all your data or delete your account in Settings.
• Turn off notification emails in Settings, or unsubscribe from any external email.
• You can ask to access or correct your information, or complain about how we handle it, at the feedback form. In Australia you can also contact the OAIC (oaic.gov.au); elsewhere, your local data protection authority.

Security

Data is encrypted in transit, sign-in uses one-time codes instead of passwords, and connected-service keys are stored encrypted. No system is perfectly secure; if something goes wrong that affects you, we'll tell you.

Changes

We'll update this policy as the service develops and change the date above.