Privacy Policy

Information We Collect

We collect the information you provide when you sign in, create a trip, RSVP, customize an itinerary, approve a plan, or use coordination features. This may include your name, email address, profile image, home airport, passport country and travel interests; trip destinations, dates, transportation choices, notes, attendance and room-sharing preferences; reservation details; chat and activity content; and shared expenses, payments, settlements and receipt images. Information about these shared trip features may be visible to people who belong to that trip, according to their role and the feature being used.

How We Use Information

We use this information to operate the app, generate and display shared trip pages, personalize quotes and itinerary views, save traveler decisions, support reservations and group coordination, calculate shared expenses, provide account features, and maintain the security and reliability of the service. Searches may use itinerary locations, dates and preferences to request travel, lodging, map, weather, currency or other research results. Results are estimates unless a provider says otherwise; Waypoint does not book travel for you.

Sharing

Trip information may be visible to organizers and other people who have access to a trip or who are members of it. Some trip summaries can also be shared through a link when that feature is enabled. We do not sell personal information. We share information with service providers that host the app, authenticate accounts, process payments, deliver notifications, store data, provide travel research, or help operate features you choose to use.

Gmail and Google connections

If you connect Gmail and turn inbox scanning on, Waypoint uses read-only Gmail access to look for likely travel confirmations. For candidate messages, the sender, subject and up to 9,000 characters of message text may be sent to the configured AI extraction service to identify travel details. Waypoint stores structured results such as reservation details, sender, subject, message date and review status; it does not store the full message body in the import record. Gmail imports can include sensitive travel information.

Turning inbox scanning off stops future scans but does not itself revoke the Google permission or erase imports already created. The same Google connection may support Calendar features. You can revoke Google access in your Google Account settings and can request account deletion through Waypoint's account flow, subject to its ownership transfer and shared-record requirements.

Receipts, AI features, and notifications

Receipt images you attach are stored with the trip's expense records. For image receipts, Waypoint may send the image to the configured AI service to suggest a description, amount, currency and date. PDF receipts are not sent through this image-extraction step. AI-assisted trip planning and research may send your prompt and relevant trip details to the configured AI service. Review suggestions before saving them, and avoid including information that is not needed for the feature.

If you enable push notifications, Waypoint stores your device push token to deliver generic alerts about trip activity. Notification payloads are designed to omit message text and detailed trip information. Opening an alert loads current information from Waypoint.

Third-Party Services

Depending on the feature, service providers may include Supabase for authentication, database and file storage; Vercel for hosting; Stripe for web payments; Google for sign-in, Gmail and Calendar; Expo for push delivery; Sentry for configured crash reporting; OpenRouter and the selected AI model provider for assistant, research, email or receipt extraction; and travel, map, weather, currency and location data providers. Providers receive information needed for the feature and process it under their own terms and privacy practices. Provider availability and configuration can change as the service evolves.

Data Retention

We keep account and trip information while it is needed to provide the service and maintain the records travelers rely on. Gmail imports, receipt files, financial records, push-delivery records and local device data have different lifecycles. Some shared financial history may remain after a traveler leaves or deletes an account so other trip members can retain accurate records. Mobile devices keep an encrypted, account-scoped read-only cache that expires after seven days and is cleared when you sign out. You can use account settings to request deletion; the app explains required trip ownership transfers and records that may be retained before you confirm.

Cookies

The website uses session cookies to keep you signed in and a short-lived cookie to return you to the requested page after login. Payment pages may load Stripe, which may set its own cookies. Waypoint does not use advertising or cross-site tracking cookies. You can clear cookies in your browser at any time, though doing so will sign you out.

Your Choices

You can update your RSVP, availability, airport, and room-sharing preferences inside the app, disconnect inbox scanning, revoke push notifications, export available account information, and request account deletion. You may also sign out at any time. For other account or data requests, contact the app operator.

Security

We use reasonable technical and organizational measures to protect information. No online service is perfectly secure, so you should avoid adding highly sensitive information to trip notes or itinerary fields.

Changes

We may update this Privacy Policy as the app changes. The updated version will be posted on this page with a revised date.