Account: your phone number (used to sign you in) and, if you add them, your name, email, and date of birth.

Travel profile: passports you add — only the issuing country and expiry date (we deliberately do not store passport numbers) — plus your expiry-alert preference.

Activity: destinations you open, search terms, and the countries you save or mark visited — used to show "recent" and "popular" content, and to colour your map.

Check-ins, if you use them: the city you posted and when. See "Check in" below.

We use your phone number only to send a one-time verification code when you sign in. By entering your number and tapping "Send code", you consent to receive this authentication SMS from Wanderer.

Message and data rates may apply, and frequency is limited to your sign-in attempts. We do not send marketing or promotional texts, and we never share your number with third parties for their own marketing.

Standard carrier keywords are supported: reply STOP to opt out and HELP for help. Opting out of the verification SMS means you will not be able to sign in.

If you turn on “Fill in your map from your photos”, Wanderer reads two things and nothing else: the date tag and the location tag attached to your photos. Your photos are never opened, decoded, copied or uploaded.

The matching happens entirely on your iPhone, against country outlines built into the app. There is no geocoding service and no lookup — no coordinate from your library is ever sent to us or to anyone else.

What reaches our servers is only what you tick on the review screen: a list of countries, and an approximate month (for example “2019-07”) for each. Never a date, never a place, never a coordinate.

You can withdraw at any time from Account → My countries → “Delete what we found in my photos”, and you can revoke photo access in iOS Settings → Privacy → Photos.

Checking in is always deliberate — you pick a city and post it. Wanderer does not track you in the background and does not follow you between cities. If you tap “Use my location” we read your device location once, at that moment, only to find the nearest city; the coordinate is used to name the city and is not stored.

What we store is a city and a timestamp. Never a street, an address, or a coordinate.

Who sees it: you, and the friends you have both agreed to share with. Sharing is symmetric — it takes both people to start it and either person to stop it, at once, without notifying the other. Nobody else, including other Wanderer users in the same city, can see your check-in.

It expires by itself after three days and is deleted. You can also remove a check-in yourself at any time.

Check in is limited to people aged 16 and over, which is why we ask for your date of birth.

You must be at least 13 to hold a Wanderer account, and 16 to use check in. Wanderer is a general-audience travel app; it is not directed to children, and we do not knowingly collect personal information from anyone under 13.

We ask your date of birth for exactly these two checks and to personalise nothing else. If we have your age wrong — a typo, a mis-tapped year — email hello@wandererapp.co and we will correct it. You are not stuck with a wrong answer.

If we learn that an account belongs to someone under 13, we delete it and the data attached to it.

To authenticate you with a one-time SMS code (no passwords are stored).

To personalize entry/visa requirements to your passport and to remind you before a passport expires.

To compute anonymous, aggregate "popular this week" trends across all travelers.

Your data is stored in Supabase (Postgres) and protected by row-level security, so only you can read or change your own profile, passports, searches, and saved countries.

We do not sell your data or share it with advertisers.

You can edit or remove any passport and your profile at any time from the Account screen.

You can remove a check-in, or remove someone from your check-in circle, at any time from the Check in screen. Removing someone is immediate and they are not told.

You can delete your account and all associated data from Account → Delete account. Deletion is immediate and permanent.

If you used the photo sync, Account → My countries → “Delete what we found in my photos” removes every country the scan added, without touching countries you marked yourself or anything else in your account. The scan earns no miles, so there is nothing else to reverse.

If you are a California resident you may ask us what personal information we hold about you and how we use it, ask for a copy of it, ask us to correct it, and ask us to delete it. You may also authorize someone to make a request on your behalf.

We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We have never done either.

We will not discriminate against you for exercising any of these rights — no reduced service, no worse content, no different price. We run no financial incentive or loyalty program: Wanderer miles are earned by playing the games and by inviting friends, never by giving us information about yourself, so there is nothing you are paid to hand over and nothing you lose by declining.

To make a request, email hello@wandererapp.co from the address or phone number on your account, or delete everything yourself from Account → Delete account.