1. Who this applies to
You if you use the iPhone app, visit waymora.app, write to us, or buy Waymora Pro through the App Store. The public site is a landing page and research pages. The Journey, Compare, Documents, and Ask run on iPhone.
2. What we do not send to a hosted model
A Privacy Firewall classifies text by origin and schema before any hosted DeepSeek call. Unmatched typed text is not treated as public. The hosted model does not receive raw passports, names, emails, dates of birth, exact addresses, case numbers, child data, document contents, or personally attributable immigration status. If a safe public prompt cannot be built, Ask returns official Source Cards or a block message and the model is not called.
Source retrieval may send only that generic public prompt to Workers AI for embeddings. Questions that are not public questions use lexical ranking only. That path is separate from DeepSeek.
3. Data that stays on your iPhone
These records live in on-device storage unless you share them yourself:
- Journey profile: origin, destination, purpose, case type, and planned timing.
- Journey progress, appointment notes, and destination notes you type.
- Document Vault metadata and files. Vault bytes are encrypted on the device. Readiness checks log a document id, not the file.
- Share with family: the phase, stamps, and an optional “I’m safe” time. The shared update has no coordinates.
- Scam evidence you save (URLs, notes). Export is something you start.
- A random device subject identifier used only to count daily AI quota.
- Change-alert preference and similar settings.
Deleting the app removes this on-device data. We cannot read your Vault from our servers.
4. Data that reaches Waymora servers
The API runs on Cloudflare. When you use a networked feature we may process:
- Ask questions, the text you enter when Waymora drafts or customizes a destination, and starter phrase lists. That text reaches Waymora first. A rule classifier runs before any hosted DeepSeek call. A match stops the model. Allowed prompts are treated as public.
- For a searched Ask that passes the Privacy Firewall, the redacted public question (personal details already removed) may be sent to Waymora's official-host index and grounding model so the answer can cite a live government page. Passport numbers, case ids, and similar fields never leave the device on that path. If the firewall blocks the question, Ask stays on editor-verified Source Cards only.
- The device subject identifier, Pro status used for quota, model name, whether the call was blocked, token counts, and a timestamp. Usage rows do not store passport numbers or Vault files.
- Daily and monthly quota counters (Ask: 0 free / 300 Pro per UTC day; destination generation: 0 free / 600 Pro per UTC day; searched Ask from official sites: 3 free / 30 Pro per calendar month). Safety classification is not counted.
- An optional Sign in with Apple bind. It attaches an Apple user id to the existing device subject. It does not replace that subject.
- Technical request data Cloudflare needs to serve the API and the public site (IP address, user agent, timestamps, error traces).
The app can also fetch public official-portal lists, Source Cards, and cost-of-living figures. Those requests carry ordinary network metadata, not your Vault.
5. Purchases
Waymora Pro is sold through Apple In-App Purchase (StoreKit 2). RevenueCat tells the app whether Waymora Pro is active. Apple processes the payment. We receive subscription status, product identifier, renewal state, and expiration. We do not receive your full card number.
Safety tools stay usable without a subscription: emergency contacts, official portals, Official website check, and critical scam warnings.
6. What we do not collect today
- Advertising identifiers or cross-app tracking.
- Precise or coarse location.
- Contacts, photos library, microphone, or camera photo rolls.
- A required Waymora account or email login.
- Crash or analytics SDKs from a third-party product-analytics vendor.
- Payment card numbers.
If a later release adds a category, we will update this policy and the App Store privacy labels before that data is collected.
7. How we use data
- Run the Journey, Ask, quota, and official-source features you ask for.
- Recognize Waymora Pro and restore purchases.
- Stop abusive or oversized AI use.
- Keep the API and public site up, and diagnose failures.
- Respond when you write to us.
We do not use this data to advertise other products to you.
8. Who else processes data
- Apple. App Store, StoreKit, and on-device system services. Apple’s privacy rules apply to purchases and anything you share through the system share sheet.
- RevenueCat. Subscription status. See RevenueCat’s privacy policy.
- Cloudflare. Hosts waymora.app and the API (Workers, D1, KV, R2, Queues, Durable Objects, Analytics Engine, AI Gateway). See Cloudflare’s privacy policy.
- DeepSeek. Hosted generative model for Ask and destination generation after the Privacy Firewall. DeepSeek’s own policy says its services are not intended for sensitive personal data including citizenship and immigration status. That is why prohibited classes never leave as model input. See DeepSeek’s privacy policy.
We may disclose information if required by law, to protect a person from serious harm, or to defend a legal claim. We do not sell personal information and we do not share it for cross-context behavioral advertising.
9. Share with family
Share with family is a read-only progress view you create. Recipients see phase, stamps, and an optional “I’m safe” time. They do not get a map pin or street address from Waymora. If you use the iOS share sheet, Apple and the app you pick apply their own terms.
10. Public website
waymora.app is a static landing and research site. Pages may be crawled by search engines. We do not run advertising cookies. Host logs on Cloudflare may include IP address and user agent for security and delivery. Contact forms are not on the site; you write to the addresses below.
11. Retention
- On-device Journey, Vault, and Share with family data: until you delete it or delete the app.
- Daily AI quota counters: the current UTC day, then they reset.
- Server usage rows (subject id, model, privacy class, time): kept to operate quota, debug failures, and review abuse. Write to privacy@waymora.app if you want those rows deleted.
- Purchase records: retained by Apple and RevenueCat under their policies.
- Support and correction emails: kept long enough to resolve the request.
12. Security
Transport uses HTTPS. Vault files are encrypted on the device. Hosted model calls are blocked when the Privacy Firewall finds a prohibited class. No method is perfect. Do not put a live passport image into Ask. The product is built so you do not need to.
13. Your choices
- Use the free safety tools without buying Pro or calling Ask.
- Leave personal details out of Ask. The firewall will also refuse many of them.
- Revoke a Share with family link in the app.
- Restore, change, or cancel Waymora Pro in your Apple ID subscriptions.
- Delete the app to wipe on-device data.
- Email privacy@waymora.app to ask what server-side quota or usage records we hold for a device subject identifier, or to ask us to delete them.
Depending on where you live, you may also have rights to access, correct, delete, or export personal data, to object to or restrict certain processing, and to complain to a data-protection authority. Waymora does not create a required cloud account. Journey, Vault, and Share with family records stay on the phone unless you export or share them. Ask and destination text still leave the phone to Waymora first. We will not discriminate against you for exercising a privacy right.
14. Children
Waymora is built for adults planning a move. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child submitted personal data to us, write to privacy@waymora.app and we will delete what we hold.
15. International processing
Cloudflare and DeepSeek may process allowed data in countries other than yours. DeepSeek may process firewall-cleared prompts in the People's Republic of China (PRC). Purchase data is processed by Apple and RevenueCat where they operate. If you use Ask, you are asking us to send a firewall-cleared public prompt through that path.
16. Changes
If we change what we collect or who processes it, we will update this page and the effective date. Material changes will also be reflected in the App Store privacy labels when those labels require it.
