Wandelo Privacy Policy
Wandelo turns your daily steps into journeys through real places. This policy explains exactly what we collect and what we never do with it.
What we collect
- Step counts — read from Apple Health (HealthKit) or Health Connect with your explicit permission. Steps are the only health data we read. We store daily totals, split into device-tracked and manually-entered counts.
- Account basics — your email address and sign-in identity (Apple, Google, or email), your username, your chosen tier, and your timezone (so your week resets at your Monday midnight).
- App events — anonymous product analytics (screens viewed, features used) and crash reports. These never contain step counts, distances, journey progress, or any health-derived value. This exclusion is enforced in code by an allowlist and scrubber, not by policy alone.
- A home region, only if you choose one — optional, and picked by you from a list of broad regions like “New England” or “Scotland.” We use it to suggest walks near you. It is never a street, a town, or a coordinate, it is never derived from your device, and you can change or clear it at any time in Profile → “Where you walk from.” Analytics record only that you set one, never which.
What we never do
- We never read your location. Not GPS, not Wi-Fi, not your IP address. Your position on a journey map is computed from step counts alone, and the home region above is only ever what you picked yourself.
- We never sell your data, to anyone, for anything.
- We never share your personal numbers with employers or sponsors — Wandelo has no workplace leagues, no sponsors, and no advertisers. Walkers you invite into a squad are a different matter, and “What other walkers can see” below says exactly what they see.
- Manually-entered steps never count toward your progress — and are labeled honestly in the app rather than quietly dropped.
What we share, and only with your consent
Wandelo has no reward partners, and nothing in the app is claimed from another business. Nothing you earn has cash value, so there is nothing to redeem and nobody to redeem it with. We share nothing about you with any other company beyond the service providers listed below. We never ask for a delivery address, and there is nowhere in Wandelo to enter one.
If you set a home region, it may be counted in anonymous regional totals — “1,400 walkers in the Pacific Northwest” — that we may one day show a tourism partner. Never your name, never your steps, never a total small enough to be about any one person: any figure describing fewer than 25 people is not reported at all. You can decline this and keep the local suggestions, with the toggle beside the region picker.
What other walkers can see
Wandelo has friends, squads and communities. Each one makes some of your walking visible to other people, and none of it is public: there is no Wandelo profile on the open web, and nothing below is visible to anyone who isn't signed in and connected to you in one of these three ways.
Your name. You choose a username when you start, and that is how you appear everywhere below. Someone has to type it exactly to find you — there is no browsing of walkers, no “people you may know”, and no search by email. If you never set one, you appear as “A walker”.
Friends see your profile: username, avatar, banner, title, streak, which journeys you've finished, your badges, and the gear you're wearing. They also see your achievements as they happen in their friend feed. A friend never sees your step count. You can switch the feed off with “Show my activity to friends” — that switch covers the friend feed and nothing else.
Squads are up to ten walkers on a shared route, joined by invite code — nobody can find or join your squad without it. This is the one place in Wandelo where other people see your step counts: everyone in the squad sees everyone's steps for today, this month, and since they joined, beside their name. The squad's road is those steps added together, which is what a squad is for. If that's more than you want to share, leave the squad — nothing else in the app shows your steps to anyone.
Communities are larger groups anyone signed in can browse and join, with no approval step. Joining means other members can see your achievements and your totals — journeys finished, companions, flora — and you can see theirs. No step counts. Treat a community as a room with the door open.
Blocking and muting. Blocking works both ways at once: neither of you can see the other's profile, feed entries or member row, and neither can send the other a friend request, postcard or wave. If you already share a squad, their name disappears from your board — but their steps keep counting toward the road, because that road belongs to the whole squad and not only to them. Muting is quieter: it keeps someone's updates out of your feeds without changing anything for them.
Where your data lives
Your data is stored with Supabase (hosted on AWS, US region), protected by row-level security: your rows are readable by you alone. Journey progress is computed server-side from your step totals, and every change is recorded so it can be audited.
Service providers we use
A small number of companies process data on our behalf to keep Wandelo running. Each one receives the minimum it needs to do its job, and none may use your data for anything else:
- Supabase — our database and sign-in, hosted on AWS in the US. This is where everything described above lives.
- Sentry — crash reports, so we can fix bugs. Reports are scrubbed before they leave your device and never contain health data.
- PostHog (US) — product analytics. It receives only allowlisted events — never step counts or any health value — and we do no ad tracking of any kind.
- Expo — delivers our push notifications and our over-the-air app updates. It holds the device token needed to reach your phone, and its update service sees your device and app version each time the app checks for one.
- Apple and Google — only if you use “Continue with Apple” or “Continue with Google” to sign in. They confirm who you are and pass us your email; they receive nothing about your walking.
Your controls
- Revoke health access at any time in iOS Settings → Privacy & Security → Health, or in the Health Connect app on Android.
- Pause tracking any time with the in-app injury pause — paused weeks never count against you.
- Delete your account and every trace of your data at any time, right in the app: Profile → “Delete my account.” Deletion is immediate, complete, and permanent.
- Export a full copy of your data any time, right in the app: Profile → “Export my data.” Prefer email? Write to us and we’ll send it.
Contact
Questions or requests: privacy@wandelo.app