What stays on your phone, and what doesn’t.
Last updated: 14 November 2026
This policy covers the Wander iPhone app. It is written to be read. If anything here is unclear, write to tomsvanags84@icloud.com and we will fix the wording.
The short version. There is no account and no sign-in. Your outings, stops, notes, photos, bring list and profile stay on your iPhone and are deleted with the app. What does leave the device is limited to a random device identifier and the technical details needed to deliver notifications and measure installs, described in full below.
1. What we process
a. Your outings — on the device only
Outing titles, start times, stops and their durations, notes, your bring list, templates, history and the line you write after an outing, your name and an optional profile picture, and your settings. The app stores all of this on your iPhone. We do not receive it, we cannot read it, and deleting the app deletes it.
b. Photos and the camera
If you add a photo to a stop or to a finished outing, the app asks iOS for access to the camera or lets you pick one picture from your library. The photo is saved in the app’s own storage on your iPhone. It is never uploaded, and the app does not scan or read the rest of your library.
c. Sharing an outing
When you choose to share an outing, the app creates a small file with the plan — title, stops, durations and bring list. Photos are left out. You decide where that file goes through the iOS share sheet; it does not pass through us.
d. Reminders
The reminder before an outing starts is scheduled by iOS on your phone. No part of it reaches us, and you can turn it off at any time.
e. A random device identifier
On first launch the app generates a random identifier — a
device_id — that is not derived from you, your Apple ID or your
hardware. It is stored in the iOS Keychain so the app recognises the same
installation after an update. It is sent to our backend so notifications can be
delivered to this device. It is not shared with advertisers.
f. Push notifications
iOS issues the app a push token. That token, the device identifier above, the app’s bundle identifier, version and build, your iOS version, your language and region setting, and Apple’s identifier for this vendor (IDFV) are sent to our notification backend so it can send you a message and tell whether one was tapped. Whether an arriving notification is shown is up to you: iOS asks for permission, and you can change it in Settings.
g. Install measurement — AppsFlyer
The app may use AppsFlyer to measure which campaign an install came from. AppsFlyer receives an AppsFlyer install ID, device and OS information, coarse network and locale data, and — only if you allow tracking when iOS asks — Apple’s advertising identifier (IDFA). If you decline, no IDFA is collected. AppsFlyer acts as our processor; see AppsFlyer’s privacy policy.
h. Web content
The app can display web pages operated by us or by our partners. Those pages are governed by their own privacy policies.
i. What we never collect
- No location. Wander has no maps and no GPS. It never asks where you are.
- No contacts, calendar, microphone or health data.
- No account, no password, no email address — unless you write to us, in which case we have the email you wrote from.
2. App Tracking Transparency
iOS asks once whether the app may track you across other companies’ apps and websites. Your answer is respected either way, and you can change it at any time in iOS Settings → Privacy & Security → Tracking. Declining does not limit any feature of the planner.
3. Why we process it
- To run the app — your outings, stored locally.
- To deliver notifications — the push token and device identifier.
- To measure installs — so we know which marketing works.
- To fix crashes and faults — Apple’s own crash reporting, if you have opted into sharing it with developers in iOS Settings.
Where the GDPR applies, our legal basis is legitimate interest for running and improving the app, and consent for tracking (ATT) and for showing notifications — both of which you grant explicitly and can withdraw.
4. Sharing
We do not sell your data, and we do not share it with anyone beyond the processors named here — AppsFlyer for install measurement, Apple for push delivery and the App Store, and our own hosting. We may disclose information if the law requires it.
5. Retention
- On your device: until you delete the app.
- Device identifier and push token: for as long as the installation is active, and no more than 24 months after its last use.
- Measurement data: per AppsFlyer’s retention policy.
- Support email: up to 12 months after the conversation ends.
6. Your choices
- Turn notifications off in iOS Settings.
- Change your tracking answer in iOS Settings → Privacy & Security → Tracking.
- Revoke camera or photo access in iOS Settings → Wander.
- Delete the app — every local record and photo goes with it.
- Write to us to ask what we hold, to correct it, or to have it deleted. We answer within 30 days.
7. Children
Wander is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with information, write to us and we will delete it.
8. Security
Everything the app sends travels over HTTPS. The device identifier is held in the iOS Keychain rather than in ordinary app storage. There is deliberately very little here to lose.
9. International transfers
Our processors may handle data outside your country, including in the United States, under standard contractual clauses or an equivalent mechanism.
10. Changes
If this policy changes, the date at the top changes with it and the new version appears on this page.