Privacy Policy
Last updated: May 16, 2026
Wanderlist (“we”, “us”, “the app”) is an iOS app for logging visited countries, cities, airports, and flights. This Privacy Policy explains what we collect, why, and how you can control it.
TL;DR
- We collect only what's needed to make Wanderlist work for you: account info, the trip data you create, and optional photos you attach.
- We don't sell your data. We don't share it with advertisers. We don't run analytics SDKs.
- You can delete your account at any time from Settings → Delete Account, which permanently removes all of your data.
What we collect
Account information
When you sign in with Apple or Google, we receive your email address and a unique identifier from the sign-in provider. We store these in our backend (Supabase) so we can authenticate you across sessions and devices.
Trip data
Everything you create inside the app — countries, cities, airports, flight segments, dates, notes, statuses, and photos — is stored in our backend (Supabase) associated with your account. This is the data the app exists to manage; without it, Wanderlist wouldn't function.
Photos
Photos you attach to trips are uploaded to a private storage bucket on our backend. They are stored in a folder scoped to your user ID; row-level security ensures only you can read them. Photos are never shared with third parties.
Location
If you grant location permission, we use your device's location only to center the map on where you currently are. Your location is never stored or transmitted anywhere.
Purchases
When you purchase a subscription or the lifetime upgrade, we receive a transaction record from Apple (product ID, original transaction ID, expiration date). We store this in our backend so we know what tier you're entitled to. We never see your payment method or any Apple ID information beyond what's needed to verify the purchase.
What we don't collect
- No advertising identifiers (IDFA)
- No third-party analytics, telemetry, or crash reporting SDKs
- No contacts, calendar, microphone, or HealthKit access
- No tracking across other apps or websites
Where your data lives
Trip data, account info, and photos are stored on Supabase, a cloud database service operating on AWS infrastructure (US region). Supabase's privacy policy is at supabase.com/privacy.
Purchases are processed by Apple through the App Store. Apple's privacy policy applies to anything that happens inside the IAP sheet.
How we use your data
We use your data solely to:
- Sign you in and keep your session active
- Sync your trips across your devices
- Display your photos, flights, and pins on your map
- Determine whether you have a free or Pro entitlement
We do not use your data for marketing, advertising, profiling, or any purpose beyond running the app you signed up for.
Sharing
We don't share, sell, rent, or trade your personal information with anyone. The only third parties that touch your data are:
- Supabase (database + auth + storage hosting)
- Apple (App Store, sign-in, IAP)
- Google (only if you choose to sign in with Google)
Each is bound by their own privacy policy and the contractual terms under which we use their services.
Your rights and controls
- Export: email us and we'll provide a JSON dump of your data within 30 days.
- Delete: in the app, go to Profile → Settings → Delete account. This triggers a server-side deletion of your account, all your trips, and all your photos. Deletion is permanent and immediate.
- Correct: edit any trip directly in the app.
- Withdraw consent: sign out and stop using the app at any time.
If you're in the EU/UK, you have additional rights under GDPR (access, rectification, erasure, portability, restriction, objection). Email us to exercise them.
Children
Wanderlist is not directed at children under 13 and we don't knowingly collect data from anyone under 13. If you believe a child has provided data, email us and we'll delete it.
Changes
We may update this policy from time to time. Material changes will be reflected in the “Last updated” date above and surfaced in the app where appropriate.
Contact
For privacy questions, deletion requests, or anything else: