Waypeak · Privacy · Legal notice · Terms · Deutsch

Privacy policy

This policy explains how Miguel Garcia Müller (“we”) processes personal data when you use Waypeak. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

Miguel Garcia Müller, Montfortweg 7, 9470 Buchs SG, Switzerland, [email protected].

2. Data we process

• Account: username, display name, e-mail address, password (hashed only), optional profile picture, short bio, home town.
• Travel content: stays (country, place, dates, notes), photos and videos, regions, plans, collections, bucket list, documents in the travel vault.
• Social features: friendships, follows, messages, comments, likes, reports and blocks.
• Payments (only for Plus, Family, Lifetime): the plan bought, status, term, amounts, Stripe customer and subscription IDs, billing-address country and card country (details in section 18). We never receive card details.
• E-mails to us: sender, content and attachments when you write to [email protected] (section 20).
• Technical data: IP address (briefly, for abuse protection), the session cookie “ferne”, settings in your browser's local storage.

Embedded metadata (e.g. GPS location, camera model) is removed from photos when they are uploaded.

3. Purposes and legal bases

Providing the service (contract), security and abuse prevention (legitimate interest), handling reports (legal obligations / legitimate interest), password-reset e-mails (contract), handling purchases, subscriptions, free trials, refunds and reminders before a trial ends and before renewal (contract), preventing repeated trials (legitimate interest), checking the Switzerland/Liechtenstein sales area (legitimate interest and contract), keeping accounting records (legal obligation), answering your enquiries (contract / legitimate interest), notification e-mails you choose in the settings (consent, revocable at any time). Under the FADP we rely on Art. 31 FADP, under the GDPR on Art. 6(1)(a), (b), (c) and (f) GDPR.

4. Visibility

You decide who sees your content (only you, friends, public). A public profile is off by default and shows only what you choose.

5. Recipients and processors

• Hosting: the operator's own server in Switzerland.
• E-mail delivery: Brevo (Sendinblue SAS), France (confirmation, password, notification and support e-mails).
• Travelpayouts (Travel Technologies Ltd.): only when you click a partner link (see 5a), for flight price lookups without personal data (see section 15) and – only when switched on – for the partner check on the public start page.
• Optional sign-in with Google / Apple: Google Ireland Ltd. (Ireland) or Apple Distribution International Ltd. (Ireland), only if you use it.
• Connection and encryption (tunnel/reverse proxy): Cloudflare, Inc., USA. Cloudflare forwards requests to our server and processes technical connection data such as the IP address.
• E-mail forwarding for [email protected]: Cloudflare Email Routing (Cloudflare, Inc., USA), see section 20.
• Payments: Stripe Payments Europe Ltd., Dublin, Ireland, with Stripe, Inc., USA, see section 18.
• Weather data: MET Norway (Norwegian Meteorological Institute), Norway – only rounded coordinates of a destination, see section 25.
• Push notifications (only if you switch them on): your browser's push service (e.g. Google, Mozilla, Apple or Microsoft), see section 22.

5a. Partner offers (affiliate links)

In free accounts, country and stay pages may show labelled partner offers ("Ad · Partner") for flights, places to stay, tours or eSIMs. The links go through the Travelpayouts redirect service (Travel Technologies Ltd.) to the provider. Waypeak loads no third-party scripts, pixels or cookies for this. Only when you click a link do Travelpayouts and the provider receive the usual connection data (IP address, browser, time), Waypeak's partner id, the link type (e.g. "waypeak_country_flights") and the destination (country, possibly city). We do not pass on your name, e-mail address or profile. If you book, Waypeak may earn a commission; your price stays the same. Travelpayouts' and the provider's privacy policies apply on their sites. Legal basis: our legitimate interest in funding the free service (Art. 31 FADP / Art. 6(1)(f) GDPR). Waypeak Plus has no partner offers.

Partner check on the start page: Only when we switch on the partner-site check does waypeak.app load a script from Travelpayouts (emrldtp.cc) on the public start page for visitors who are not signed in, so that Travelpayouts can confirm the website as a partner site. Travelpayouts then receives technical data from your browser (including IP address, browser, page visited, time) and may use cookies or similar technologies. This script is never loaded inside the app after sign-in (account, settings, payments).

6. Transfers abroad

Your data is stored in Switzerland. Recipients abroad are: Brevo (France, EU) for sending e-mails, Cloudflare (USA) for the connection to our server and for forwarding e-mails to [email protected], Stripe (Ireland, EU; Stripe, Inc. in the USA) for payments and – only if you use that sign-in – Google or Apple (Ireland, EU; group companies in the USA). For the EU, the adequacy of data protection applies; for the USA we rely on the providers' certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework or on standard contractual clauses. For Travelpayouts see section 5a.

7. Retention and deletion

Data is kept as long as your account exists. You can delete your account yourself at any time in the settings; this removes all content, photos, documents and messages. Backups are overwritten on a rotating basis: daily backups after 14 days, weekly ones after 8 weeks. Our server logs requests without the visitors' IP address; for abuse protection it is only kept briefly in memory. Exception for payments: we keep records of purchases, payments and refunds as accounting records for 10 years (Art. 958f Swiss Code of Obligations), even if you delete your account; they are then no longer used for other purposes. Stripe keeps its own records according to its legal obligations. Exception for the free trial: we keep the check value of your e-mail address and your Stripe customer number (section 18) for at most 3 years after your account is deleted, so that the trial cannot be used more than once; after that they are deleted automatically.

8. Your rights

Access, rectification, erasure, restriction, objection and data portability. You can download an export of all your data (ZIP with JSON and photos) yourself in the settings. Requests to: [email protected]. You may lodge a complaint with the Swiss FDPIC or an EU supervisory authority.

9. Cookies

Waypeak itself only sets a strictly necessary session cookie and stores settings locally in your browser. There is no third-party tracking or analytics. Partner offers are plain links (see 5a); cookies from Travelpayouts or providers only arise on their sites after a click, or on the public start page only while the partner check is switched on. Fonts are served from our own server.

10. Usage statistics without third parties, and plans

To run and improve Waypeak we count accounts and active accounts. We use no third-party analytics, cookies or scripts for this; all numbers are produced on our own server in Switzerland and are visible only to the operator.

• Active days: for signed-in use we store one entry per account and day ("account X was active on day Y"), no time, pages, device or IP address. Entries are deleted after 35 days and immediately when you delete your account.
• Feature counters: for some features (e.g. share image, PDF, import, support) we only count daily totals, without any link to your account.
• Overview figures: numbers of entries per feature, storage use and feedback status are counted from existing data; no new personal data is created.
• Plan: each account has a plan ("free", "plus" or "family") that controls which features are available. If you buy a plan, we also store the details in section 18; Stripe handles the payment itself.

Legal basis: our legitimate interest in secure and stable operation (Art. 31 FADP / Art. 6(1)(f) GDPR).

11. PDF photo book

When you create a PDF of a trip or a year, our own server in Switzerland builds it from your own stays, notes and photos, without third-party services. The file is delivered straight to you and not stored; temporary files are deleted right away. Your home town is never printed: stays in your home town show neither place nor map point, stays in your home country only an approximate point.

12. Import from photos and Google location history

You can have trips suggested from your photos and from an export of your Google location history (Takeout or the phone's Timeline export). This runs only on our own server in Switzerland, without third-party services.

• Photos: your browser sends only the start of each file with its header data (EXIF: date taken and GPS location), at most 256 KB per photo. The pictures themselves are neither uploaded nor stored.
• Location history: the file is uploaded in parts to a protected temporary folder, analysed and deleted right after, also on cancel or error, and in any case after 30 minutes at the latest or when the server restarts. It never goes into the database or any backup.
• Result: we only show summarised suggestions (country, nearest town, from–to). Only what you confirm in the review step is saved, like a manually entered stay (place snapped to the nearest town). Single location points, routes or times are never stored. Your home town is never proposed.

13. Family and family map

With Waypeak Family one person can create a family of up to 5 people with a shared family map, without third-party services.

• Joining only with consent: invitations go by username or invitation link. Nobody becomes a member without clicking "Accept". An invitation link lasts 7 days and can be turned off at any time; we store only a hash of the link, not the link itself.
• You decide what you share: "countries and places", "only countries" (the default when joining) or "nothing". You can change this at any time; it applies only to the family map, not to friends or your profile.
• Never shared: private stays, your home town and your home country. Places in your home country are shown only roughly (rounded to about 10 km). Notes, photos, expenses or transport details are not shared.
• Stored: the family (name, founder, creation date) and per member role, status (invited/active), your sharing choice and the invitation and joining dates. The map view is computed on each request and not stored.
• Leaving, removal, blocking, account deletion: you can leave at any time; the founder can remove members or dissolve the family. Your data disappears from the family map immediately; your own trips stay. Blocked people do not see each other on the family map. If you delete your account, you are removed from the family; if you own it, it is dissolved.
• Access and plan: the data export includes your family, your sharing choice and the members' usernames. While the founder's family plan is active, all members get the Plus features. Only the founder's account pays (section 18); members do not see the founder's payment details and vice versa.

14. Priority support and Labs

With Waypeak Plus or Family you can send a support request in the settings. We store topic, subject, your message, your username, your plan, time and status and, if you choose, technical details (app version, view, language, screen size, browser). The request stays in our inbox in Waypeak until we delete it or you delete your account. A notice with the content of the request goes via our e-mail provider Brevo (Sendinblue SAS, France) to [email protected]. Your e-mail address is included only if you choose "reply by e-mail" and your address is confirmed; we then reply to that address. To prevent abuse, at most 4 requests per hour and 10 per day per account are possible.

Labs unlocks features we are still working on (currently keyboard shortcuts and a compact trip list). We only store whether Labs is on and which features you picked. This is included in the data export and deleted with your account.

15. Flight prices and price alerts

When the feature is switched on, Waypeak shows the cheapest month and price for flights from your home airport (default Zurich, ZRH) to your bucket-list countries.

• Where prices come from: the data API of Travelpayouts / Aviasales. Our server only asks for routes (departure airport, destination airport, currency). No data about you is sent, neither name, e-mail address nor IP address; the request comes from our server, not from your device. Prices are cached for 24 hours per route and are indicative.
• What we store: your chosen home airport, currency, chosen destination airports per country, your language (for e-mails) and when you last looked at flight prices (after 21 days without a visit we stop querying your routes).
• Price alerts: country, your price limit, whether you also want an e-mail, and triggered alerts (route, price, month, time). E-mails only if you choose this and your address is confirmed, via Brevo (Sendinblue SAS, France), at most 3 per day.
• Partner links: "View flights" is a link labelled "Partner" via Travelpayouts (tp.media) to Aviasales, see 5a.
• All of this is included in the data export and deleted with your account. You can delete an alert at any time in the bucket list.

16. Inviting friends

You can invite friends with your personal invite link or code. Once the invited person confirms their email address and adds their first trip or place, you both get 1 month of Waypeak Plus as credit.

• What we store: your code, who was invited with which code, the status (pending, rewarded, rejected, reversed), timestamps and the Plus credit granted.
• Abuse protection: to detect self-invites we compare keyed hashes of the network (IP address) and of a random device ID from the browser, as well as the email domain. The IP address itself is not stored for this. Hashes collected at sign-in are deleted after 30 days; those attached to an invite are kept as long as the invite exists.
• Cookie: when you open an invite link we set a strictly necessary cookie (wp_inv) with the code for 7 days, so the invite survives a sign-up with Google or Apple.
• The inviting person sees your display name and the status of the invite. Everything is included in the data export and deleted with the account; if an account is deleted within 14 days, the reward is reversed.

17. Waitlist and home page

• Waitlist: if you sign up on the home page, we store your email address, the language, the time and a keyed hash of the IP address (against abuse) and send you a confirmation email (double opt-in). Without confirmation the entry is deleted after 7 days. After confirming, we will email you once when Waypeak opens to everyone. You can unsubscribe any time with the link in the email; the entry is then deleted. Emails are sent through our email provider (see section 5).
• Language: if you choose a language on the home page, we remember it in a strictly necessary cookie (wp_lang, 1 year) so the page appears in your language.
• Gift link: if you open a gift link without being signed in, we set a strictly necessary cookie (wp_g66, 7 days) with the gift code so you can redeem the gift after signing in or signing up (section 21). It is deleted when you redeem.
• The home page loads no scripts, fonts or images from third parties.

18. Paying with Stripe

You can buy Plus, Family and Plus Lifetime only on waypeak.app. Payments are handled by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, which works together with Stripe, Inc. in the USA.

• What you enter at Stripe: card details, name, e-mail address and billing address. Stripe processes these on its own pages (Stripe Checkout or customer portal). We never receive the card number or security code.
• What we store: the Stripe customer and subscription IDs, the plan bought, status, start and end of the period, whether you cancelled, amounts and times of payments and any refunds, and the result of the sales-area check (see below).
• Free trial once per account: the 7-day free trial for Plus monthly and yearly is available only once. For this we note that your account, your Stripe customer number and your e-mail address have already had a trial or subscription – the e-mail address only as a non-reversible check value (HMAC-SHA256 with a secret server key), not in clear text. Before a new trial we also ask Stripe whether your customer number already had a subscription. The check value and customer number are kept for at most 3 years after an account is deleted (legitimate interest in preventing misuse of the trial, Art. 6(1)(f) GDPR).
• Sales-area check: we currently sell paid plans only to people resident in Switzerland or Liechtenstein. After the purchase we therefore read the country of your billing address and, if available, the issuing country of your card from Stripe and store both with the decision (accepted, or rejected and refunded). We do not store the rest of the address. The plan page also shows a notice if your connection comes from another country; for this we use the country code Cloudflare supplies with each request and do not store it.
• Stripe as an independent controller: Stripe processes data under its own responsibility for fraud prevention, its legal obligations (e.g. anti-money laundering) and improving its services. See the Stripe privacy policy.
• Transfer to the USA: Stripe, Inc. is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework; standard contractual clauses also apply.
• Legal basis: contract (Art. 6(1)(b) GDPR), legal obligation to keep records (c) and our legitimate interest in respecting the sales area (f). For retention see section 7.

19. Reminders before the trial ends and before renewal, contract e-mails

While your free trial runs, we send you an e-mail 2 days before it ends with the end date, the price afterwards and how to cancel; it is not sent if you have already cancelled. If you have a yearly subscription (Plus yearly or Family), we send you an e-mail 7 days before renewal with the date, the amount and a link to cancel. For this we use your e-mail address, your language, the plan and the renewal date, and we note that the reminder was sent for this period or trial. This e-mail is part of the contract and is sent even if you have switched off notifications; it is not sent if you have cancelled. It is sent via Brevo (Sendinblue SAS, France). You only receive notification e-mails (e.g. price alerts) if you switch them on in the settings, and you can switch them off there at any time.

20. Contacting us by e-mail

E-mails to [email protected] are forwarded to the operator's mailbox via Cloudflare Email Routing (Cloudflare, Inc., USA). In addition, a copy (sender, subject, text) may be stored in the protected inbox in Waypeak that only the operator can see. We use your details only to handle your enquiry and delete them once it is resolved and no retention obligation applies (e.g. for refunds or withdrawals). We reply via Brevo (Sendinblue SAS, France) or directly from the operator's mailbox.

21. Gifting Plus

If you buy Plus as a gift, we store the gift code only as a one-way hash (it is shown only right after the purchase and in the gift link), plus type and amount, the Stripe payment ID, purchase and expiry date, your display name and – if you provide them – the recipient's name, your message, their e-mail address and the delivery day. We use the e-mail address only to send the gift card on the chosen day via Brevo (Sendinblue SAS, France), and delete it 30 days after sending or as soon as the gift is redeemed, refunded or expired. Please only enter the address if the person agrees. When the code is redeemed, both sides see who redeemed or gave the gift; we store which account redeemed the code and when. Section 18 applies to the payment. Legal basis: contract (Art. 6(1)(b) GDPR); retention of payment data see section 7.

22. Push notifications

If you switch on push notifications for a device in the notification settings, your browser asks for permission and creates a push address with its vendor's push service (e.g. Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). We store this address with its keys, browser and device type (e.g. “Chrome · Android”), the time it was added and of the last delivery, and your choice of which kinds of messages you want to receive. The messages (e.g. “Anna commented on your post”) are end-to-end encrypted; the push service only sees the encrypted data, the push address and the time. You can switch push off per device or for all devices at any time; we delete the address when you log out, delete your account or the push service reports it as invalid. Push services may process data outside Switzerland and the EEA (e.g. in the USA). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

23. Summit collection

When you tick off a summit, we store the summit, the date and – if you add them – a note and a photo. An entry is visible to everyone allowed to see your profile (section 4) unless you mark it as private; the photo is only delivered with the same check. You decide whether your summits appear in your friends' feed. The summit data (name, elevation, location) comes from Wikidata (CC0) and is stored on our server; searching does not send any data to third parties. Legal basis: contract (Art. 6(1)(b) GDPR). The entries are included in “Download my data” and are deleted with the account.

24. Digital postcards

When you create a postcard, we store the chosen or uploaded photo (cropped, metadata removed), your message, place, country, date, layout, your display name and a copy of your profile picture on the card, as well as the creation time, expiry date and whether you withdrew the link. The card can be seen by anyone you give its long, unguessable link (/c/…) to; the page shows only the card (not your map, profile or e-mail address) and is not indexed by search engines. If you also send it to a friend on Waypeak, that person gets a notification and the card in their “Received” list. Signed-in people who open the link can keep the card. To prevent abuse we count cards per account and per IP address and check the image automatically for prohibited content (on our server, nothing is passed on). You can withdraw the link or delete the card at any time; your cards are deleted with your account. Legal basis: contract (Art. 6(1)(b) GDPR).

25. Weather, sun times and calendar subscription

Weather: For the weather preview at a destination our server queries the weather service MET Norway (Norwegian Meteorological Institute, Norway). Only the coordinates of the place, rounded to about 1 km, are sent – not your name, your account or your IP address; answers are cached so that not every request is passed on. Norway is part of the EEA. Sun times are calculated by your browser itself; no data is sent. Calendar subscription (Plus): If you switch it on, we create a secret link (/cal/….ics) through which your stays and planned trips can be read as a calendar – private stays only if you explicitly switch that on. Anyone who knows the link can read the calendar; only enter it in your own calendar app. Your calendar provider (e.g. Google, Apple or Microsoft) then fetches the link regularly and processes the entries under its own privacy policy. You can renew the link at any time (the old one stops working at once) or switch it off. Legal basis: contract (Art. 6(1)(b) GDPR).

Last updated: 24 October 2026