Privacy Policy for Waymarka

1. Introduction

Waymarka is a travel pin map and personal flight log operated by RCLP Inc. (“Waymarka”, “we”, “us”). This policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to waymarka.app and to the Waymarka mobile apps.

2. Information We Collect

Account information. Your email address. If you sign up with email, your password is stored only in hashed form by our authentication provider. We cannot read it.

Google Sign-In. If you choose “Continue with Google”, we receive your name, email address and profile picture from your Google Account. See section 4.

Profile information you choose to add. A handle, display name, home city and short bio.

Travel content you add. Places (name, country, map location, visit dates, notes), flights (airline, flight number, date, airports, times, seat, cabin, aircraft, gate, terminal, notes), trips, and photos or captions you attach.

Boarding passes. When you scan a boarding pass barcode, it is decoded on your device. When you photograph or upload a picture of a boarding pass, the image is sent to our server and to our AI provider so the flight details can be read. We do not keep the image. We save only the flight details you approve.

Imported files and mailboxes. CSV files and Google Maps Timeline files you choose to import, and flight confirmations found in a mailbox you choose to connect. See sections 10 and 11.

Purchase information. If you buy Waymarka Pro, we record the plan, amount, currency, payment status and expiry date. Card details are entered directly into Stripe’s secure checkout and are never stored by Waymarka.

Technical information. We use essential browser storage to keep you signed in and remember your preferences. Our hosting provider records basic visit statistics such as pages viewed, referring site, device type and country.

What we do not collect. We do not track your device location, in the foreground or the background. We do not access your contacts. We do not show ads or use advertising trackers.

3. How We Use Information

We use the information above to:

• create and secure your account and sign you in
• show your map, flight log and travel statistics
• read boarding passes and suggest airports and routes for the flights you add
• run your free trial and Waymarka Pro purchase
• send service emails, such as email verification and password reset
• answer your support and data requests
• keep the service reliable and prevent misuse

We do not sell your information and we do not use it for advertising.

4. Google Sign-In and Google User Data

This section explains how Waymarka accesses, uses, stores, shares and protects Google user data.

Google user data we access. When you sign in with Google, Waymarka requests only your basic profile: your name, your email address and your profile picture. We do not receive your Google password. Google Sign-In does not give us access to your Gmail, contacts, calendar, files or any other Google data.

How we use Google user data. We use your name, email address and profile picture only to create your Waymarka account, sign you in, and show your name and picture on your profile. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train AI or machine learning models.

How we store Google user data and how long we keep it. Your name, email address and the link to your profile picture are stored in our database with your account for as long as your account is active. When you delete your account as described in section 6, they are permanently deleted.

How we share Google user data. We do not sell Google user data and we do not transfer it to third parties, except to the service providers named in section 5 that host our database and sign-in system, only as needed to provide the service, or where the law requires it. If you turn on the optional public profile in Settings, the display name on your profile is visible to anyone who opens your public profile address.

How we protect Google user data. Google user data is sent over encrypted connections (HTTPS). It is stored behind access rules so that it can be read only by your own account and by our secure server code. See section 7.

Limited Use. Waymarka’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access. You can remove Waymarka’s access at any time from your Google Account settings under third-party connections, and you can delete your Waymarka account as described in section 6.

5. Who We Share Information With

We share information only with service providers that operate on our behalf, and only what each one needs:

• Lovable and Supabase: hosting, database, sign-in, file storage and service emails.
• Stripe: payment processing for Waymarka Pro.
• Google: Google Sign-In, Google Maps (to display your map in your browser) and Google Fonts.
• AI provider (Google Gemini, reached through Lovable’s AI gateway): receives boarding pass images and flight numbers so that flight details and routes can be read or suggested.
• Photon by Komoot: receives the place name you type when you search for a place.
• adsbdb: receives a flight number to look up its route.
• logo.dev: supplies airline logos, loaded by your browser.

Public profile. Your profile is private by default. If you turn on the public profile option in Settings, your handle, display name, home city, bio, places and flights are visible to anyone at your public profile address. You can turn it off at any time.

Share cards. When you choose to share a card, the image is created for you and you decide where to post it.

Legal requirements. We may disclose information if the law requires it.

6. Retention, Google Play Account & Data Deletion

We keep your information for as long as your account is active.

In compliance with Google Play Data Safety policies, you may request permanent deletion of your account and all associated personal data at any time.

• In-App Deletion: Navigate to Settings > Delete Account. This permanently erases your profile, places, flights, trips, photos, purchase records, connected mailbox and sign-in identity.
• Web Deletion Request: If you no longer have the app installed, visit waymarka.app/delete-account or email Accounts@rclpinc.com with the subject “Data Deletion Request”. All associated data is deleted permanently within 7 days upon request.

Stripe keeps its own payment records as required by law.

7. Security

Information is sent over encrypted connections (HTTPS). Stored data is protected by access rules so that each account’s private data can be read only by that account and by our secure server code. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Cookies & Browser Storage

We use essential browser storage to keep you signed in and to remember your preferences, such as theme and map settings. These are required for the Service to work. Any non-essential cookies are set only after you accept them in our consent banner, and you may reject them or clear them from your browser at any time.

9. Accuracy of Your Data — Your Responsibility

You control and are responsible for the content of your account. Places, dates, flight numbers, and records you import from CSV files or boarding passes are stored as you or your import file provided them. Automatic airport matching, AI boarding-pass reading and route checks are best-effort aids, not verified records — you should review results and keep your own copies of anything important. Waymarka and its owners and operators are not responsible for inaccuracies in data you enter or import.

10. Connecting Your Email Account

Connecting a mailbox (such as Gmail, Outlook or Microsoft 365) is entirely optional. If you choose to connect one, you grant read-only access, which we use for one purpose only: finding airline, travel agency and booking confirmation emails so we can suggest flights for your log. We do not read unrelated mail, we never send email on your behalf, and we never use your mail for advertising, profiling or training AI models.

Email content is processed in memory while we extract flight details and is not stored by us. We keep only the flight details you approve, plus a record of which mailbox and message a suggestion came from so the same flight is not offered twice. Flight details are sent to our AI provider solely to extract those fields.

Your mailbox connection is stored encrypted and is only readable by our secure server code. You can remove access at any time from Add flights, which revokes our access and deletes the stored connection. Deleting your account deletes it too.

11. Google Maps Timeline Files

Importing a Google Maps Timeline file is optional. The file is read locally in your browser and is not uploaded or stored. Only place details you individually approve are saved to your account. Limited place details may be used to identify a place or country during review, but nothing updates your map or statistics before your approval.

12. Children

Waymarka is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.

13. Your Choices and Rights

You can view and edit your profile and travel records in the app at any time, and you can delete your account as described in section 6. Depending on where you live, you may have additional rights to access, correct or delete your personal information. To make a request, email Accounts@rclpinc.com.

14. Changes to This Policy

We may update this policy. When we do, we change the “Last updated” date on this page. If a change is significant, we will tell you in the app or by email.

15. Contact

For privacy questions and data requests, contact RCLP Inc. at Accounts@rclpinc.com.