Privacy policy

Last updated October 30, 2026

Who we are

Wayboard ("we", "our", "us") is a trade name of F. FURLAN PROGRAMAS E JOGOS LTDA, a company registered in Brazil (CNPJ 69.684.913/0001-70). We are the controller of your personal data in the Wayboard apps and on wayboard.app: we decide how it's used, as this policy explains. You can write to us at hello@wayboard.app.

What we collect, and why

• Your account: your email address and, if you sign in with Apple or Google, the name they share. To create your account and sign you in.
• Your trips and lists: destinations, dates, travelers' names, items and notes, once you sign in. To sync them between your devices and the web app. Without an account they stay on your device and never reach us.
• Personal needs you add, such as medication or contact lenses. They can reveal health information, so we use them only with your explicit consent: adding them gives it, removing them withdraws it.
• Sign-ins and security: the devices you're signed in on, and the language each one uses; a log of sign-ins (how you signed in, and whether in the app or a browser, on a phone or not), exports and account deletions, with a coded (hashed) form of your IP address; and, for a few minutes, how many requests come from your IP address. To keep you signed in, stop abuse, and count how many people use each language and each way of signing in (we only look at the totals).
• Errors: when something fails on our servers or in the apps, a report of what failed: the error, where in our code, the page or screen, the screens opened and buttons tapped just before it, the browser, app version and device model, and a random id for the app on that device, not linked to your account. It leaves out your IP address, your email address and what you type or sync. To find and fix bugs.
• Premium: whether it's active, under an anonymous id. You pay through the App Store or Google Play, so we never see your card.
• Place searches and weather: what you search for, and your trip's places and dates. We look them up for you without your account or IP address. Bookings you import are read on your phone; only airport codes reach us.
• Launch news: your email address and language, if you ask for it. We confirm by email right away, write once more when the apps are out, then delete it. Every email has a link to leave the list.
• Website visits and link clicks: we count them on our own server, as daily totals: the page and its language, where the visit came from (a search engine, another site, the app), the kind of device, and the country, which we work out from your IP address on the spot without keeping it. Clicks on partners' links pass through wayboard.app and are counted the same way. No cookies and no identifier, so no one can be picked out in them. To see what people read and find useful. Google Analytics only if you allow it (see Cookies).

Our legal bases: providing the service you asked for (your account, trips, Premium and searches); your consent (personal needs, launch news, Google Analytics), which you can withdraw at any time; and our legitimate interest in keeping Wayboard safe and working, improving it and its translations, and answering you (security data, error reports, counts of languages, of ways of signing in, of website visits and of link clicks, and emails you send us).

Signing in with Google or Apple

If you sign in with Google, Google shares four things with Wayboard: your name, your email address, whether Google has verified that address, and an identifier for your Google account (the "openid", "email" and "profile" permissions). We ask for nothing else: not your contacts, calendar, email, photos or files, and we keep no Google token that could act on your account. If you sign in with Apple, Apple shares an identifier for your Apple account and, if you choose, your name and email address (or a private relay address from Apple).

We use this only to create your account and sign you in. We keep your email address and name with your account, and the account identifier only in a coded (hashed) form. We don't use it for advertising, don't sell it, and don't share it with anyone except the service providers that run Wayboard for us (below). It stays until you delete your account; then it's deleted, and for Apple we also ask Apple to revoke Wayboard's access. You can remove Wayboard's access at any time in your Google Account (third-party apps and services) or in your Apple Account settings.

Wayboard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who else sees it

When you share a trip, or join one, the people on it see the trip, its list and each other's names.

Some to-dos, such as buying travel insurance, suggest a few companies, and blog posts link to some. Their links pass through wayboard.app, where we count the click (see Website visits and link clicks), then open the company's own site; they carry nothing about you or your trip. There, that company's privacy policy applies.

We don't sell your data or use it for advertising. Service providers handle it on our behalf, only to run Wayboard: hosting, email delivery, sign-in, purchases, error reports, and place and weather data. Some of them are outside your country, including in the United States; where the law requires it, those transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses.

Weather forecasts come from MET Norway, the Norwegian Meteorological Institute (CC BY 4.0); past years' weather from the POWER project of NASA's Langley Research Center; place names from GeoNames (CC BY 4.0); and the country of an IP address, for our counts, from IP Geolocation by DB-IP (CC BY 4.0).

Cookies

The web app uses only the cookies it needs to work: one keeps you signed in, and a short-lived one protects signing in with Apple or Google.

Our own count of visits uses no cookies. This website sets none unless you allow Google Analytics, which also counts visits: the pages you view, how you got here, your device and rough location. It sets two cookies, named _ga and _ga_ followed by an id, that last up to 13 months. Google processes this for us and not for advertising (how Google uses this data). You can change your answer at any time with Cookie settings, at the bottom of every page; saying no deletes those cookies.

How long we keep it

• Your account and trips: until you delete them. Deleted items leave our servers after 90 days.
• Sign-ins end after 60 days without use in the apps, 30 on the web (a year at most), and are deleted 30 days later.
• The security log: 180 days. Error reports: 90 days at most. Sign-in codes: a day at most.
• Launch news: until the launch email. Google Analytics' visit statistics: 14 months. Our own daily totals hold nothing about anyone, so we keep them.
• Deleting your account signs you out everywhere and deletes your data, with the keys that encrypt your trips and lists. Backups expire on a fixed schedule, and the trips and lists in them can't be read without those keys.

Your rights

Depending on where you live (for example the GDPR in the EU and UK, the LGPD in Brazil, or US state laws), you can see, correct, export or delete your data, object to or limit some uses of it, withdraw consent, and complain to your data protection authority. Export and deletion are in the app, under Profile. For anything else, write to hello@wayboard.app; we answer within 30 days.

Children

Wayboard isn't meant for children under 13 (16 in some countries). Parents can add their children to a trip to pack for them.

Changes

When this policy changes, we update it here with a new date, and tell you in the app if the change matters.