01 Who is responsible
Waypost is made by an independent developer based in Spain. There is no company behind it and no third party is given your data to use for their own purposes.
For anything in this policy, write to support@sendwaypost.com.
02 What the app collects
Waypost collects only what it needs to build and send the emails you asked for. There is no advertising, no analytics, no profiling, and nothing is ever sold or shared with data brokers.
| Data | Why it is collected |
|---|---|
| Your location | The point of the app. Collected only while a route is running, and only to put your position and a map into the emails. |
| Your contacts' names and email addresses | So the emails can reach them. You type these in yourself; the app never reads your phone's address book. |
| The name and message you set | They appear at the top of every email so the person reading it knows who it is from. |
| Battery level and phone model | Shown in the email, so a contact can tell the difference between "stopped moving" and "phone about to die". |
| An anonymous account ID | Created automatically on first launch. It carries no name or email and exists only to cap how many emails one installation can send. |
Waypost has no accounts. You never register, and there is no password, username, or profile. The anonymous ID is not linked to you by name.
03 Location, specifically
Waypost asks for the Always location permission. It needs it because the whole purpose is to keep your contacts informed while the phone is locked in a pocket on a trail. With any weaker permission the updates stop the moment the screen locks.
Location is read only while a route is running. When you press stop, the app stops the location updates and deletes the route from the phone. Between routes, Waypost reads nothing.
Your position is used to write the email and to render the map image inside it. It is not used to build a profile, not compared with anyone else's location, and not passed to advertisers.
Steps
If you allow it, Waypost reads the step count your phone already keeps (Motion & Fitness on iOS, the step sensor on Android) and shows the steps of the route you are on. That number never leaves the phone: it is not sent to the server and does not appear in the emails. Saying no leaves the rest of the app working exactly the same.
04 Where your data lives
On your phone
Your contact list, your settings, and the route currently in progress are stored on the device only. Your contact list is never uploaded or kept on any server. The addresses are sent along with each individual email and are not retained afterwards.
On the server
Waypost runs on Google Firebase in the European Union (Belgium). Two things are written there:
- The map image for a sent email, holding your last position, so a contact opening the email can see it. It is deleted after 30 days, and the link is a random 128-bit address that cannot be guessed.
- A short record of each email sent — the time, the coordinates, and how many people it went to — so it is possible to answer "was the 6:15 pm alert actually sent?". It does not include the recipients' addresses.
05 Who processes it
Three services are involved, each doing one job:
| Service | What it does |
|---|---|
| Google Firebase | Runs the server, the anonymous sign-in and the database. Hosted in the EU. |
| Resend | Delivers the emails. Receives the recipient address, the message and the position, because that is what the email contains. |
| Geoapify | Draws the map image. The request is made by the Waypost server, so Geoapify never learns who the email was sent to. |
None of them is permitted to use your data for their own purposes.
06 How long it is kept
- On your phone: until you delete the contact, end the route, or uninstall the app.
- Map images: 30 days, then deleted automatically.
- Send records: kept while the app is in service. Write to us and they will be deleted.
- The emails themselves: once delivered they belong to the recipient's mailbox and are outside our control.
07 Your rights
Under the GDPR you may ask for a copy of your data, ask for it to be corrected or erased, object to how it is handled, or complain to your data protection authority. In Spain that is the Agencia Española de Protección de Datos.
Because Waypost has no accounts, the fastest way to erase everything held on the server is to email us and say so. Deleting the app removes everything held on the phone immediately.
The lawful basis is your consent, given when you grant location access and add the contacts you want notified, and the performance of the service you asked for. You can withdraw it at any time by revoking the permission in iOS Settings or deleting the app.
08 Children
Waypost is not directed at children under 13 and does not knowingly collect their data. If you believe a child has used the app and sent data, write to us and it will be deleted.
09 Changes
If this policy changes, the date at the top changes with it. Anything that materially affects what is collected will be announced in the app before it takes effect.
10 Contact
support@sendwaypost.com
Waypost · Spain