Privacy Policy

1. Who We Are

WayR (the mobile app and way-r.com) is operated by Nikola Petrovski, an individual developer based in North Macedonia ("we", "us"). We are the controller of the personal data described here.

Contact for any privacy question or request: [email protected]

2. Data We Collect

• Account data: email address, name, username, and a securely hashed password (never the password itself), or the identifier Google or Apple gives us when you sign in with them. If you use WayR without an account we create an anonymous account tied to a random device ID.
• Location: your precise location, only while the app is open and only after you allow it. We use it to show you on the map, give directions, find nearby places and events, and detect when you reach a tour stop. Stops you have visited are saved with your trip on our servers.
• Trips and preferences: destinations, dates, starting point, travel preferences and interests, generated trips, saved and viewed places, and achievements.
• Content you add: places, photos, notes and live notes you create (public ones are visible to other users nearby), location reports and reviews, links or images you submit for location detection, feedback and support messages.
• Purchases: ticket balance and the transaction identifiers Apple, Google or Paddle send us to confirm a purchase. We never receive or store your card details.
• Device and technical data: device ID, operating system, app version, push notification token, IP address and request logs used for security and troubleshooting.

3. How We Use Your Data and Why

• To provide the service you ask for: create and navigate trips, sync them across devices, manage tickets and purchases (performance of our contract with you).
• To keep WayR secure and fair: prevent fraud and abuse such as farming free tickets, enforce rate limits, moderate user content (our legitimate interests).
• To improve WayR: fix bugs and understand which features are used (our legitimate interests).
• To send push notifications and in-app messages about your trips, rewards and new features. You can turn notifications off at any time in Settings (your consent).
• To keep purchase records for accounting and tax purposes (legal obligation).

We do not sell your personal data, we do not show third-party ads, and we do not use advertising trackers.

4. Who We Share It With

We only share what each provider needs to do its job for us:

• Hetzner Online GmbH (Germany): hosts our servers and database.
• Cloudflare: network security and delivery of our API.
• AI providers (OpenRouter, Perplexity, OpenAI): receive your trip request, preferences and any link or image you submit for location detection, to generate trips and place details. They do not receive your name or email.
• Google (Maps, Places, Sign-In) and Mapbox: maps, place data and directions; they receive the locations and places needed for each request.
• Apple and Google: sign-in and in-app purchases. Paddle: purchases made on our website, as Merchant of Record.
• Expo: delivers push notifications.
• Ticketmaster and PredictHQ: receive an approximate location to find events near you.
• Our email delivery provider: sends login codes and support replies.

When you tap a partner offer (for example tickets, tours or transport), you leave WayR for the partner's website, which has its own privacy policy. We may earn a commission from such partners; they do not receive your WayR account data from us.

We may also disclose data if required by law or to protect our rights and users' safety.

5. International Transfers

Our servers are in the EU. Some providers (for example AI providers, Google, Cloudflare and Expo) process data in the United States or other countries. Where required, these transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

6. How Long We Keep It

• Account data, trips, places and preferences: until you delete your account.
• Request logs: only the most recent entries are kept; older ones are overwritten automatically.
• Purchase and ticket ledger records: kept for accounting, with your account identity removed once you delete your account.
• Device-level anti-abuse records (for example whether a device already received free tickets): kept so that deleting and re-creating an account cannot be used to abuse free offers.
• Backups: deleted data disappears from backups as they rotate out.

7. Deleting Your Account

You can delete your account at any time in the app: Settings → Delete Account. Deletion is immediate and permanent: your trips, saved and added places, photos, notes, messages, preferences, achievements and unused tickets are removed, and your email and name are erased from our records. If you cannot access the app, email [email protected] from the address on your account and we will delete it within 30 days.

8. Your Rights

Depending on where you live (including under the EU and UK GDPR and North Macedonia's Law on Personal Data Protection) you have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to withdraw consent at any time. Email [email protected] to use any of these rights. You can also complain to your local data protection authority; in North Macedonia this is the Personal Data Protection Agency.

9. Security

Data is encrypted in transit (HTTPS), passwords are stored only as salted hashes, and access to our servers is restricted. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

10. Children

WayR is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact [email protected] and we will delete it.

11. Changes

We may update this policy. We will change the date above and, for significant changes, tell you in the app before they take effect.