Privacy policy
Last updated September 24, 2026
The short version
- You sign in with Apple, Google or a code sent to your email. There are no passwords.
- Your trips are encrypted on our servers, each with its own key.
- We never sell your data. The apps have no ad networks, analytics or tracking.
- You can export everything, or delete your account, from the app at any time.
What we collect, and why
- Your account: your email address and, if you sign in with Apple or Google, the name they share. To create your account and sign you in.
- Your trips and lists: destinations, dates, travelers' names, items and notes. To sync them between your devices and the web app.
- Personal needs you add, such as medication or contact lenses. They can reveal health information, so we use them only with your explicit consent: adding them gives it, removing them withdraws it.
- Sign-ins and security: the devices you're signed in on, and the language each one uses; a log of sign-ins, exports and account deletions, with a coded (hashed) form of your IP address; and, for a few minutes, how many requests come from your IP address. To keep you signed in, stop abuse, and count how many people use each language (we only look at the totals).
- Premium: whether it's active, under an anonymous id. You pay through the App Store or Google Play, so we never see your card.
- Place searches and weather: what you search for, and your trip's places and dates. We look them up for you without your account or IP address. Bookings you import are read on your phone; only airport codes reach us.
- Launch news: your email address and language, if you ask for it. We write once, when the apps are out, then delete it.
- Website visits: only if you allow them (see Cookies).
Our legal bases: providing the service you asked for (your account, trips, Premium and searches); your consent (personal needs, launch news, website visits), which you can withdraw at any time; and our legitimate interest in keeping Wayboard safe, improving its translations and answering you (security data, language counts, and emails you send us).
Who else sees it
When you share a trip, or join one, the people on it see the trip, its list and each other's names.
Some to-dos, such as buying travel insurance, suggest a few companies. Their links open the company's own site and carry nothing about you or your trip; there, that company's privacy policy applies.
We don't sell your data or use it for advertising. Service providers handle it on our behalf, only to run Wayboard: hosting, email delivery, sign-in, purchases, and place and weather data. Some of them are outside your country, including in the United States; where the law requires it, those transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses.
Cookies
The web app uses only the cookies it needs to work: one keeps you signed in, and a short-lived one protects signing in with Apple or Google.
This website sets no cookies unless you allow Google Analytics, which counts visits: the pages you view, how you got here, your device and rough location. It sets two cookies, named _ga and _ga_ followed by an id, that last up to 13 months. Google processes this for us and not for advertising (how Google uses this data). You can change your answer at any time with Cookie settings, at the bottom of every page; saying no deletes those cookies.
How long we keep it
- Your account and trips: until you delete them. Deleted items leave our servers after 90 days.
- Sign-ins end after 60 days without use in the apps, 30 on the web (a year at most), and are deleted 30 days later.
- The security log: 180 days. Sign-in codes: a day at most.
- Launch news: until the launch email. Website visit statistics: 14 months.
- Deleting your account signs you out everywhere and deletes your data and the keys that encrypt it. Backups expire on a fixed schedule, and can't be read without those keys.
Your rights
Depending on where you live (for example the GDPR in the EU and UK, the LGPD in Brazil, or US state laws), you can see, correct, export or delete your data, object to or limit some uses of it, withdraw consent, and complain to your data protection authority. Export and deletion are in the app, under Profile. For anything else, write to [email protected]; we answer within 30 days.
Children
Wayboard isn't meant for children under 13 (16 in some countries). Parents can add their children to a trip to pack for them.
Changes
When this policy changes, we update it here with a new date, and tell you in the app if the change matters.