Privacy Policy

1. Introduction

WanderWith ("we", "our", "us", or the "Company") is a privacy-first collaborative travel planning platform founded in April 2026. We operate the WanderWith mobile application (available on Android via the Google Play Store) and the website located at www.wanderwith.online (collectively, the "Service").

This Privacy Policy describes in detail the types of personal information we collect from you when you access or use our Service, the purposes for which we process that information, the legal bases for processing, how we protect your data, and the rights and choices available to you regarding your information.

By accessing or using WanderWith, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with any part of this policy, you should discontinue use of the Service immediately. For questions, contact us at wanderwithplan@gmail.com.

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, email address, profile photograph, location data, and device identifiers.
• "User" or "You" means any individual who accesses, downloads, installs, or uses the WanderWith Service, whether as a registered account holder or as a guest visitor to our website.
• "Trip Data" means all information created, uploaded, or shared within a WanderWith trip workspace, including itineraries, schedules, budget entries, expense records, poll votes, chat messages, photographs, links, and any other user-generated content associated with a specific trip.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
• "Third-Party Service" means any external service, platform, API, or SDK integrated with or used by WanderWith to provide the Service, including authentication providers, cloud infrastructure, AI model providers, and analytics tools.

3. Data We Collect

A. Information You Provide Directly

• Account Registration Data: When you create a WanderWith account, we collect your email address, display name, and profile photograph. If you sign in through Google OAuth 2.0, we receive your Google account email address, display name, and profile picture URL as authorized by your Google account permissions.
• Profile Information: You may optionally provide additional profile details including a username, bio, travel mood preferences (e.g., "Explorer", "Foodie", "Culture Buff"), and profile customization settings.
• Trip Content & Itineraries: Destinations, travel dates, day-by-day schedules, activity descriptions, checklists, notes, and custom itinerary modifications you create or edit within trip workspaces.
• Budget & Financial Records: Expense titles, amounts, currency types, payer assignments, split configurations, and settlement records entered into the trip budget tracker. We do not collect or store bank account numbers, credit card numbers, UPI IDs, or any payment instrument details.
• Group Collaboration Data: Messages sent in trip-specific group chat channels, poll questions and votes, media files (photographs and videos) uploaded to shared trip galleries, and saved links bookmarked within trip workspaces.
• AI Interaction Data: Prompts, destination preferences, group size, travel dates, budget constraints, and dietary or accessibility filters you provide when using WanderWith's AI itinerary generation and AI co-pilot chat features.
• Communications: Information you provide when you contact our support team, submit feedback, report bugs, or correspond with us via email at wanderwithplan@gmail.com.

B. Information Collected Automatically

• Device Information: Device model, operating system type and version, unique device identifiers, screen resolution, and application version number.
• Usage Data: Features accessed, screens viewed, interaction timestamps, session duration, and crash reports used exclusively for debugging and stability improvements.
• Network Information: IP address (anonymized and not stored long-term), connection type (Wi-Fi, cellular), and general geographic region (country-level only, derived from IP for compliance purposes).

C. Information We Do NOT Collect

4. How We Use Your Data

We process your Personal Data solely for the following purposes:

• Service Delivery: To create and manage your account, authenticate your identity, synchronize trip data across devices, and provide core trip planning, group collaboration, budget tracking, and chat functionality.
• AI-Powered Features: To generate personalized travel itineraries, provide real-time AI co-pilot recommendations, and deliver contextual travel suggestions based on the destination, group size, budget, and preferences you provide. AI prompts are processed anonymously and are never used to train public machine learning models.
• Trip Collaboration: To facilitate invite link generation, group member management, real-time data synchronization, poll creation and voting, and shared media galleries among trip participants.
• Communication: To respond to your support inquiries, send essential service notifications (e.g., trip invitation alerts, password reset emails), and deliver critical product updates. We will never send unsolicited marketing emails or promotional spam.
• Safety & Compliance: To detect, prevent, and investigate fraud, abuse, security incidents, or violations of our Terms & Conditions, and to comply with applicable legal obligations.
• Product Improvement: To analyze aggregated, anonymized usage patterns (never individual-level data) to improve application stability, fix bugs, and prioritize feature development.

5. Legal Basis for Processing

We process your Personal Data under the following legal bases as applicable under the General Data Protection Regulation (GDPR), the Information Technology Act, 2000 (India), and other applicable data protection laws:

• Contractual Necessity: Processing necessary to perform our contract with you (i.e., providing the WanderWith Service as described in our Terms & Conditions).
• Consent: Where you have provided explicit consent, such as when you voluntarily create an account, upload media to shared galleries, or opt into AI-powered features.
• Legitimate Interests: Processing necessary for our legitimate interests, including application security, fraud prevention, crash analytics, and product improvement, provided these interests are not overridden by your fundamental rights and freedoms.
• Legal Obligation: Processing necessary to comply with a legal obligation to which we are subject, such as responding to lawful government requests or court orders.

7. Third-Party Services

WanderWith integrates with the following third-party services to provide core functionality. Each service has its own privacy policy governing their data handling practices:

We carefully vet all third-party integrations for their privacy and security standards. We do not integrate any third-party analytics SDKs (such as Google Analytics, Facebook Pixel, or Amplitude) into our mobile application.

8. Data Security & Encryption

We implement industry-standard technical and organizational security measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your device and our cloud infrastructure is encrypted using Transport Layer Security (TLS) 1.3 protocol.
• Encryption at Rest: Database records are encrypted at rest using AES-256 encryption provided by our cloud infrastructure partner.
• Row-Level Security (RLS): Our database enforces row-level security policies ensuring that each authenticated user can only access trip records they own or have been explicitly invited to. No user can view, modify, or delete another user's private trip data.
• Authentication Security: Passwords are never stored in plaintext. Authentication tokens are managed by Amazon Cognito using short-lived JWTs and secure session refresh.
• Access Controls: Internal access to production databases and user data is restricted to authorized personnel only, protected by multi-factor authentication and audit logging.
• Incident Response: In the unlikely event of a data breach, we will notify affected users within 72 hours of discovery, consistent with GDPR Article 33 notification requirements, and take immediate remedial action.

9. Data Storage & Offline Caching

WanderWith's cloud backend infrastructure is hosted on secure, SOC 2 Type II compliant data centers. Trip data, including itineraries, chat messages, and uploaded media, is stored in cloud databases with automated daily backups and geographic redundancy.

Offline Functionality: WanderWith caches trip itineraries, emergency contact information, and essential trip metadata locally on your device's storage. This local cache enables you to view your trip plans, checklists, and contacts without an active internet connection. Locally cached data remains on your device until you explicitly clear app data, uninstall the application, or delete your account.

Media Storage: Photographs and videos uploaded to shared trip galleries are stored in Amazon S3 through time-limited upload instructions. Media access is limited according to trip and sharing permissions.

10. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law:

• Active Account Data: Retained for the duration of your active account. Your profile, trip data, and collaboration history remain accessible as long as your account exists.
• Deleted Account Data: Upon account deletion (see Section 11), all Personal Data and Trip Data associated with your account is permanently erased from our production databases within 30 calendar days. Backup copies are purged within 90 calendar days.
• Anonymized Analytics: Aggregated, anonymized usage statistics (which cannot be used to identify any individual) may be retained indefinitely for product improvement purposes.
• Legal Retention: Where we are required by applicable law, regulation, or valid legal process to retain certain data for a specified period, we will comply with such requirements.

12. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your Personal Data under the GDPR, the Indian Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable data protection regulations:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request deletion of your Personal Data, subject to certain legal exceptions.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your Personal Data under certain circumstances.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your Personal Data for specific purposes, including direct marketing (though WanderWith does not engage in direct marketing).
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at wanderwithplan@gmail.com. We will respond to verified requests within 30 calendar days.

13. Children's Privacy

WanderWith is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect, solicit, or maintain Personal Data from children under 13. If we become aware that we have collected Personal Data from a child under 13 without verified parental consent, we will take immediate steps to delete such information. If you believe a child under 13 has provided us with Personal Data, please contact us at wanderwithplan@gmail.com.

14. International Data Transfers

WanderWith's cloud infrastructure may process and store data in data centers located outside your country of residence. By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your home jurisdiction. We ensure that all international transfers comply with applicable data protection regulations, including the implementation of appropriate safeguards such as Standard Contractual Clauses (SCCs) where required by the GDPR.

15. Cookies & Tracking Technologies

Website (www.wanderwith.online): Our website may use strictly necessary cookies to maintain session state and provide essential website functionality. We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

Mobile Application: The WanderWith mobile application does not use cookies. Authentication state is managed through secure token storage on your device.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our website and updating the "Last Updated" date at the top of this page. For significant changes that affect your rights, we may also send you a notification via email or an in-app alert. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.