Wayfarer privacy

Last updated: 15 September 2026

Wayfarer uses your email to sign you in, and your chosen name and username to identify your profile. New photo visits start private. You choose sea or land travel and which photos to publish. Sharing a visit makes its selected photos, place, date and caption accessible to other sailors. Other private album photos are not published automatically.

Photos and visit verification

Photo location analysis runs on your device. Scanning does not upload your library or its local identifiers. Historical visits require selected photos with capture dates and locations. New check-ins require the in-app camera and a recent, precise location. The server checks photo hashes, dates and location evidence, and uses Apple App Attest to verify app requests and resist replay. Photo metadata can be edited and is not conclusive proof of travel. Earlier records are not automatically verified.

Selected photos are resized and reencoded to remove unnecessary EXIF data before private album storage. Verification metadata is stored separately with your visits. Uploads waiting for verification remain drafts. A chosen avatar is stored separately and cached on your device. Removing an app photo or visit does not remove the original from the device photo library.

Location and contacts

The foreground map can show your location to you. Live sharing starts only when you explicitly select mutual friends. It runs only while the app is in the foreground and stops when you leave the app, sign out or revoke permission. Only the latest live position is stored; no live movement history is created. A position older than 30 seconds is not shown as live. Blocking, unfollowing or removing a recipient revokes access. Live location does not replace a past photo visit’s location.

New GPS recording and trip planning are retired. Earlier plans and GPS tracks remain available in Old records and data export. They are not automatically published.

Contact matching sends SHA-256 hashes of normalized email addresses to find accounts that opted in to discovery. Raw contacts and matching requests are not stored. Hashing does not make an email anonymous.

Service providers and controls

Supabase provides authentication, database, private realtime channels and file storage; Vercel runs the API; Apple provides device permissions, App Attest, fallback maps and App Store billing. Mapbox provides map tiles and country/city naming for selected location groups. Naming results may be stored using permanent geocoding. Natural Earth and GeoNames provide discovery geography and basic place data. Approximate coastal suggestions do not confirm travel by boat. Data may be processed outside your country.

You can change visit visibility, block accounts, stop live sharing, adjust permissions in iOS Settings and export your data from the app. A supported account deletion request has a 14-day cancellation period. Deleting an account does not cancel an App Store subscription.

Contact

Use Help → Contact support in Wayfarer for privacy or account requests.