Privacy

Your walks stay yours. Wayfill records where you walk so it can color in your streets, and that happens on your iPhone.

Your location and walks

GPS tracks are stored on your iPhone. They never go to Wayfill or to anyone else, except in these ways, all of them yours to choose:

iCloud. Walks are backed up to your own private iCloud, where Wayfill can't read them.
Sharing. A GPX file or a share card leaves your iPhone only if you share it.
A wrong-street report, if you attach a walk. See below. It's off unless you turn it on for that report.

Apple Health

If you choose to import from Apple Health, Wayfill reads your walks, runs and hikes with their routes. They're kept with your other walks, as above. Wayfill never writes to Apple Health, and doesn't use Health data for advertising.

City maps

Street maps are downloaded from Wayfill's server, hosted by Cloudflare, as you need them, including for places near you during a walk. Like any web request, that shows Cloudflare your IP address and which city's map was fetched. Wayfill doesn't keep that or tie it to you.

Leaderboards, if you join

Leaderboards are off until you join. Joining sends a nickname, a random id made for this purpose, and your street counts for each city you've walked in: streets done, this month's streets and percentage walked. It also sends how many streets you finished each day, across all your cities, for the last 35 days. Never your location or your walks.

If you add friends, they can see your nickname, your street counts for a city and overall, and how many streets you finished over a week or a month. So can anyone who adds you with your code, until you stop that code. Leaving deletes all of it from the server, including your friends.

So a modified app can't climb a board, joining also asks your iPhone's App Attest for a key that proves this is the real app. Wayfill's server stores the public half of that key with your random id, and checks it each time your counts are sent. It isn't tied to you or your Apple account, and it goes when you leave the leaderboard.

Crash reports

If the app crashes, a report goes to Sentry so it can be fixed: what went wrong in the code and the kind of device. No location, no name and no account.

Walk health counts, if you turn them on

A walk that records nothing doesn't crash, so crash reports can't catch it. If you say yes when asked after your first walk, or turn on Send walk health counts in Settings, Wayfill sends counts once a day. It's off until you do. You can turn it off at any time, and anything not yet sent is forgotten.

Each day's counts go to Wayfill's server, hosted by Cloudflare, and are added into totals:

how many walks ended by you stopping them, by driving, by standing still, by the 20-minute limit, after a phone restart, or with nothing recorded
rough walk lengths, rough numbers of GPS points and rough time not recorded, each in broad ranges
your location permission (While Using, Always, precise or not)
how many times a few steps in the app happened: a first walk, a first street, a third walk, seeing your Health history fill in, starting a route, opening the share card, joining a leaderboard, seeing the Pro screen and from where, buying or restoring Pro, and being asked for a rating
along with the date, the app build, the iOS version, the iPhone generation and your App Store country

Never where you walked, street or city names, exact times, your nickname, your leaderboard id, or any id for you or your iPhone. The server refuses any report holding anything else. Totals are deleted after about 400 days. In Settings, What's waiting to send shows exactly what would go.

Like any web request, sending shows Cloudflare your IP address. Wayfill keeps only a one-way hash of it, for up to about two hours, to limit how often anyone can send, and it isn't stored with the counts.

Purchases

Apple handles purchases. Wayfill only learns whether Pro is active on your device.

Emails you send

A wrong-street report opens in your own mail app, so you can read it first. It holds the street, the city and the map version, and your email address comes with any email you send.

A walk attached to a wrong-street report, if you choose

A report can show why a street didn't count if it comes with the walk. This is the one time a route goes to Wayfill, and it only happens if you turn it on for that report, choose the walk, and tap Send route. The screen shows the route on a map first.

The route goes to Wayfill's server, hosted by Cloudflare, with the street, the city, the map version and the problem you chose. On your iPhone first, Wayfill cuts the first and last 200 m of the route and anything within 200 m of where it started or ended, leaves out poor GPS points, and shifts the times so the date and time of day don't go. Those ends often sit at home, so this makes your home harder to find. It doesn't make it impossible: someone who knows the area could still guess, from where the route stops or from places you walk often.

Sending it shows Cloudflare your IP address. To limit how many routes one connection can send in a day, Wayfill keeps a one-way hash of it for about a day, separate from the route. It's stored with no name or id. Your email carries its reference, so Wayfill can tell it's yours. Only Wayfill can read it, to find out what went wrong with the street, and it isn't shared with anyone. It's deleted automatically after 90 days. To have it deleted sooner, email [email protected] with the reference, or tell us the street and the day you sent it if you don't have the reference.

What Wayfill doesn't do

No ads, no tracking across apps, no selling data, no accounts.

Removing your data

Deleting the app removes everything on your iPhone. Your iCloud backup can be removed in iPhone Settings under your name, then iCloud. To leave leaderboards, tap Leave the leaderboard. Walk health counts that have already been sent are totals with nothing to tie them to you, so they can't be picked out. An attached route can be deleted on request, as above.