Privacy policy

What this is

Wanderlog is a private, invite-only app for a small group of friends to map trips they've taken. It isn't a commercial service, it has no advertising, and it doesn't sell or share data with anyone.

What it stores about you

• From Google sign-in: your name, email address, and profile photo URL. Passwords are never seen or stored — Google handles authentication.
• Your home base, if you set one: a place name and its coordinates, at city level.
• Your trips: place names and coordinates, dates, travel mode, an optional trip name, and which group members you tag as co-travelers.
• Group membership: which crews you belong to, your map colour, and when you joined.

There is no analytics, no tracking pixel, and no third-party script on any page. The only cookie is the one that keeps you signed in.

Who can see it

Members of a crew can see each other's trips, home base, and name — that's the point of the app. Your data is not visible to anyone outside a crew you've joined. Joining requires a secret invite link; there is no public directory and no way to browse other people's travels.

Where it lives

• A private server in Nuremberg, Germany, hosted by Hetzner. Data is stored in a Postgres database on that machine and is not copied to any other service.
• Google handles sign-in and therefore knows you use this app, under their own privacy policy.
• Searching for a place sends just that search text to OpenStreetMap's Nominatim geocoder to turn it into coordinates. Your identity isn't sent with it.
• Map tiles are served by OpenFreeMap, which necessarily sees your IP address, as any website you load resources from does.

Getting a copy

Settings has a “Download my data” button that hands you everything stored about you as a JSON file — your profile, home base, trips, and crew memberships. Other members' trips aren't included: they're visible to you in the app, but they belong to them.

Deleting it

You can erase your account at any time from Settings. That permanently removes your trips, home base, memberships, and sign-in records. If you own a crew with other people in it, the crew is handed to its longest-standing member so their trips survive; if you're its only member, the crew is deleted with you.

Database backups are kept on the same server for up to 14 days for disaster recovery, so deleted data can persist in those backups until they rotate out.

Questions

Ask whoever invited you — they run this instance and can answer, or delete your data on request.