Privacy Policy
Waypoint (“Waypoint”, “we”, “us”) is a personal photo-mapping service operated by an individual. This policy explains what we collect, why, and your choices. Waypoint is a small, independent service — we don’t sell your data, we don’t run ads, and we don’t data-mine your photos.
What we collect
- Your photos and their embedded data (EXIF), including precise GPS location and the date/time each photo was taken. This is the core of the product: we read the location and timestamp to place each photo on a map and along a day-by-day timeline. We store your photos and generate resized copies (thumbnails and display sizes) to show them to you and to anyone you choose to share a trip with.
- Account information — your email address, an optional display name, and a securely hashed (never plain-text) password.
- Device and session information — when you use the companion app, we record basic details such as your device model, operating-system version, and app version, along with sign-in sessions, so the account owner can see active devices and keep the account secure.
- Technical logs — IP addresses and standard server logs, used to operate the service, prevent abuse, and rate-limit sign-ins and other requests.
- Cookies — a small number of strictly-necessary cookies for your login session, share-link unlocking, and remembering your light/dark theme. We do not use advertising or cross-site tracking cookies.
How we use it
- To provide the service: process your photos, build your map and timeline, and let you view and share your trips.
- To send you transactional email (email verification, password reset, and a link when someone shares a trip with you). We use these only to operate the service, not for marketing.
- To keep the service secure and reliable, and to enforce our Terms.
Who we share it with
We share your information only with the service providers we rely on to run Waypoint, and only as needed:
- Hosting — our servers and your stored photos are hosted by our hosting provider.
- Email — transactional emails are delivered through Resend.
- Maps — map tiles are served by CARTO and OpenStreetMap; loading a map sends your device’s IP address to those tile servers, as with any web map.
- Web fonts — some pages currently load fonts from Google Fonts and rsms.me, which receive your IP address when the fonts load. We plan to self-host these.
We share a trip’s photos with the specific people you send a share link to. We do not otherwise sell, rent, or trade your personal information. We may disclose information if required by law.
How long we keep it
We keep your photos and account data for as long as your account is active. When you delete a trip it goes to Trash and is recoverable for 30 days, after which it is permanently deleted. Email-verification, password-reset, and share links expire. If you close your account, we delete your trips and photos.
Your choices and rights
You can access and update your account, delete individual trips, and request that we export or delete your data. To make a request, or for any privacy question, contact us at privacy@waypoint.pics. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we honor those requests.
Children
Waypoint is not intended for children under 13, and we don’t knowingly collect information from them. If you believe a child has provided us information, contact us and we’ll remove it.
Where your data is processed
Waypoint is operated from the United States and our users may be located anywhere in the world. By using Waypoint you understand that your information is processed on our servers to provide the service.
Changes
We may update this policy from time to time. When we make material changes we’ll update the version date above and, where appropriate, ask you to review the updated policy.
Contact
Questions? Email privacy@waypoint.pics.