Privacy Policy

Wondavu is an installable progressive web app (PWA) that helps travelers discover nearby travelers, join group chats, find events, and feel the vibe of every place. If you have questions about this policy or your data, contact us at privacy@wondavu.com.

a) Information you give us

• Account data: email address, password (stored as a one-way hash), display name, username.
• Profile data: avatar photo, bio, country flags, traveler identity preferences, and any quotes you write.
• Trip plans & itineraries:destinations, dates, preferences you submit through the “Where to next?” questionnaire, saved stays, restaurants, and experiences.
• Social content: group-chat messages, direct messages, photos, reactions, and reports you submit.
• Verification info (optional):any identity materials you choose to upload for the “Verified traveler” badge.

b) Information collected automatically

• Approximate location:when you tap “What’s near me” or open the map, we ask your browser for geolocation. We never store your precise coordinates unless you explicitly check in to a place.
• Device & usage data: browser type, screen size, language, time zone, and which pages you visit. Used to keep the app fast and debug issues.
• Cookies & local storage: a session cookie from Supabase (our auth provider) keeps you signed in; local storage holds your theme choice, dismissed splash screens, and cached UI preferences. These do not track you across other websites.

c) Information from third parties

If you sign in through a social provider (e.g. Google), that provider shares basic profile info (name, email, avatar) with us per their own privacy terms.

• To create and secure your Wondavu account.
• To show you relevant travelers, group chats, events, and recommended places near you.
• To match you with travel plans and itineraries that fit your questionnaire answers.
• To send service notifications (account verification, password resets, safety alerts) — we do not send marketing emails without your consent.
• To prevent fraud, abuse, harassment, and policy violations.
• To improve Wondavu based on aggregated usage.

We do not sell your personal information. We share data only with the following categories of recipients, and only as needed to operate Wondavu:

• Other Wondavu travelers: your public profile (display name, username, avatar, bio, countries, identity) is visible to other signed-in users. Your private messages are visible only to recipients.
• Supabase: our backend provider. Stores account, profile, chat, and itinerary data. See Supabase Privacy.
• Vercel: our hosting provider. Serves the app and records basic request logs. See Vercel Privacy.
• CARTO & OpenStreetMap: provide the map tiles. We send your map viewport (not your identity) to load tiles. See CARTO Privacy.
• Law-enforcement / legal requests: we may share data when legally required, or to protect the safety of our users or the public.
• Successor entities: if Wondavu is acquired, merged, or sold, your data may be transferred to the successor under the same protections as this policy.

Your data is stored on Supabase’s managed Postgres infrastructure and on Vercel’s global edge network. Depending on your region, your data may be processed in the United States, the European Union, or other jurisdictions where these providers operate. We rely on standard contractual clauses and the providers’ security certifications.

• Account data: retained for as long as your account is active.
• Chat messages: retained until you or the other participant deletes them, or until the group is removed.
• Itineraries & saved places: retained until you delete them.
• Request logs: retained by Vercel for up to 30 days for debugging and security.
• Deleted accounts:we delete or anonymize your data within 30 days of an account-deletion request, except where we’re required to keep it for legal or fraud-prevention reasons.

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or out of date.
• Delete your account and associated data.
• Export your data in a portable format.
• Objectto certain processing, including for direct marketing (we don’t do this anyway).
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, email privacy@wondavu.com from the email associated with your account. We respond within 30 days. EU/UK residents may also lodge a complaint with their local data-protection authority; California residents have the rights described in the CCPA/CPRA.

We use industry-standard safeguards: TLS in transit, encrypted storage at rest, hashed passwords, scoped row-level security in Postgres, and audit logging. No system is perfectly secure, so we also encourage you to use a strong, unique password and to enable additional account-protection features when offered.

Wondavu is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact privacy@wondavu.com and we will delete it.

We use only the cookies and local-storage entries necessary to run the app:

• Authentication cookie (Supabase) — keeps you signed in.
• Theme & preferences — remembers your dark / cute / orange / sketch theme choice, dismissed splash, etc.
• Diagnostic logs (Vercel) — basic request logs.

We do not use third-party advertising cookies, cross-site tracking pixels, or behavioral-ad networks.

If you are outside the United States, your information will be transferred to and processed in countries where our providers operate. We rely on standard contractual clauses or equivalent mechanisms to keep your data protected.

We’ll update this policy as Wondavugrows. When we make material changes, we’ll notify you in-app or by email before the changes take effect. The “Effective date” above always reflects the current version.

Questions, requests, or concerns? Reach us at privacy@wondavu.com.