Wayfindr | Privacy Policy

Last updated: 06/10/2026

HH Ventures ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Wayfindr application and associated services (the "Service"). It also explains your rights under applicable data protection law.

This Privacy Policy should be read alongside our Terms and Conditions and End User Licence Agreement (EULA). By using the Service, you acknowledge that you have read and understood this policy.

Notice of change: the Apple Ads acquisition-attribution processing described below takes effect on 24 August 2026. This notice was published on 10 August 2026, 14 days before the change takes effect.

Updated 6 October 2026: we have rewritten this policy to describe more accurately how we already handle your data, including the walks you record, your position while you plan, and the services we use. This update does not change how we handle your data.

1. Who We Are and How to Contact Us

HH Ventures Ltd (company number 17022840, registered office: 51a Chalkshire Road, Butlers Cross, Aylesbury, England, HP17 0TR) is the data controller for personal data processed through the Wayfindr Service. Data protection enquiries: support@hhventures.co

If you have concerns about how we handle your data that we have been unable to resolve, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

2. The Legal Framework

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For every category of personal data we process, we rely on one or more of the following lawful bases:

  • Contract performance: processing is necessary to provide you with the Service you have requested.
  • Legitimate interests: processing is necessary for our legitimate business interests, where those interests are not overridden by your rights.
  • Legal obligation: processing is necessary to comply with a legal requirement.
  • Consent: you have given us explicit consent for a specific purpose, which you may withdraw at any time.

3. What Data We Collect and Why

3.1 Data You Provide Directly

  • Account registration data: your email address and chosen password. Sign-in is handled by our authentication provider, Supabase; the App sends your password to Supabase directly. If you use Sign in with Apple, we receive the email address Apple gives us (which may be a private relay address) and, the first time you sign in, your first name.
  • Your first name: Wayfindr 1.4 asks what to call you (you can choose "Not now"). We use it in the App and in the emails described in Section 5.2.
  • Profile: if you gave them in Wayfindr 1.3 or earlier, your usual activity, preferred distance and home area. When you give a home area we look up its approximate map position with a place-search service (Google Places or Mapbox) and store both.
  • Onboarding answers: in Wayfindr 1.3 and earlier, when you first set up the App we ask a short set of questions — your first name, the activity you are usually out for, how much time you normally get, the ground and pace that suit you, who tends to come with you (including whether that is a dog, children or a partner), what you would go out of your way for, what walking is mostly for you, and the area you are based in. We store your answers against your account and use them to plan routes that fit you. Wayfindr 1.4 doesn't ask these questions; it shows answers you gave earlier under Settings. To change or clear them, contact us; they are deleted with your account.
  • Conversational inputs: the natural language descriptions, follow-up messages, and refinements you type into the route planner. If you use the microphone, your speech is turned into text by Apple's speech recognition, which may run on your device or on Apple's servers; we receive only the text you send.
  • Saved walks: walks you save, with their names, distances and routes.
  • Shared walks: when you share a planned or recorded walk, we store what the link shows (see Section 6.4).
  • Remembered preferences: things you explicitly ask Wayfindr to remember (see Section 5.1).
  • Subscription information: subscriptions are bought through Apple, which processes your payment. We and our subscription provider, RevenueCat, receive the product, price, currency, dates and status of your subscription. We never receive your card details.
  • Support communications: messages you send us by email. The App's "Contact support" link opens your email app.

3.2 Data Collected Automatically

  • Your position while planning: if you have allowed location access, the App sends your current position (its coordinates, accuracy and time, and the name of the town it is in, which your iPhone works out) with each message you send to the planner, so routes can start from where you are. Your position is not stored on its own, but when we build a route that starts where you are, that route, including its start point, is kept as part of a planning record (see Section 5).
  • Recorded walks: when you walk a route, the App records your GPS track (a series of positions, each with its time, elevation, accuracy and speed) to show your progress and keep you on route. When the walk ends, the walk (its name, start and end times, distance, climb, the path you walked and the full track) is uploaded to our servers and kept against your account as your walk history. This happens for every completed walk; there is currently no setting to keep a walk on your device only.
  • Device identifier and technical data: RevenueCat's software in the App sends RevenueCat an identifier for this app on your device (Apple's "identifier for vendor", not the advertising identifier), together with the App and iOS version and your App Store country. The App does not use the advertising identifier and does not ask for permission to track you.
  • Server logs: when the App talks to our servers, our hosting provider, Vercel, records technical details of each request, and our own log entries may include your account identifier. We use these to run the Service and fix problems.
  • Usage records: the onboarding milestones you reach (for example, finishing set-up, your first walk being built, saving a walk), when you save or start a walk we planned, daily and plan usage counts, the cost and outcome of each planning request, and whether you joined through someone's shared link.
  • Acquisition attribution: if Apple attributes your install to one of our Apple Ads campaigns, campaign, ad group, keyword, country, and click- or view-through attribution details. RevenueCat links this acquisition data to subscription events so we can measure campaign conversion and lifetime value. We do not use it to track you across other companies' apps or websites.
  • Offline cache data: map tiles you download for offline use come from our map provider and are stored on your device; they are not transmitted to our servers.

Apart from RevenueCat's subscription software described above, the App does not include analytics, advertising or crash-reporting software from other companies.

3.3 Data from Third-Party Sources

  • Sign in with Apple: if you use it, we receive your email address (or an Apple private relay address) and, the first time, your first name.
  • Apple and RevenueCat: the status of your subscription, and the Apple Ads attribution described in Section 3.2.
  • Map and place data services return information about places, paths and weather, not about you. What we send them is set out in Section 7. For example: Ordnance Survey (path, rights-of-way and map feature data for an area); Google Places (place names and places near a route); postcodes.io (when you give a UK postcode as a place, that postcode alone is sent, without your account identity, to look up its map position in the Office for National Statistics postcode directory); and the Met Office (if you request a route forecast, representative coordinates along the route are sent to the Met Office Weather DataHub without your account identity; your chosen departure time is used by Wayfindr to match forecast periods and is not included in the Met Office request).

4. Data Processing Summary

Account information (email address, first name, sign-in details): Account creation, service access, communications; Contract performance; Until you delete your account. After deletion we keep only a hash of your email address on our suppression list (see Section 10)

Your position while planning: Planning routes from where you are; Contract performance; Not stored on its own. A route built from where you are is kept with its start point as part of a planning record (below)

Recorded walks (the GPS track of each walk you record, with its times, distance, climb and speeds): Showing and keeping your walk history; Contract performance; Until you delete your account. Recorded walks can't yet be deleted one at a time in the App; contact us to have one deleted

Saved walks (walks you save, with their names): Keeping your saved list across devices; Contract performance; Until you delete your account. Deleting a saved walk in the App removes it from your list; on our servers it is marked as deleted rather than erased

Shared walks (what a share link shows: name, distance, climb, time and route; for a recorded walk, the path you walked): Publishing the link you created; Contract performance; Until you delete your account. Anyone with the link can see it

Planning records (what you typed when we built a route for you, the route we built including its start point, and our automated quality grading of it; some conversations that didn't produce a route are kept in the same way): Answering you, investigating bad routes and improving route quality; Contract performance / Legitimate interests; No fixed deletion date. When you delete your account they are kept without your account identifier

Forecast request data (route sample coordinates and planned departure time): Producing a route-specific weather forecast; Contract performance; Processed transiently; forecast responses may be cached for up to 15 minutes

Device identifier and technical data (RevenueCat's identifier for this app on your device, App and iOS version, App Store country; our hosting provider's request logs): Subscription management, security, running and fixing the Service; Legitimate interests / Contract performance; RevenueCat: until you delete your account. Hosting logs: for the limited period our hosting provider keeps them

Usage records (onboarding milestones, "saved" and "started" walk events, daily and plan usage counts, cost and outcome of each planning request, referral sign-ups): Running usage limits, understanding how the Service is used, choosing which emails to send; Legitimate interests / Contract performance; Usage counts, onboarding and referral records are deleted with your account. Walk events and request cost records are kept without your account identifier

Apple Ads acquisition attribution: Campaign performance, subscription conversion, and lifetime-value measurement; Legitimate interests; Held by RevenueCat with your customer record. When you delete your account we ask RevenueCat to delete that record

Subscription records (product, price, currency, dates and status): Subscription management, billing disputes; Contract performance / Legal obligation; Our subscription records are deleted with your account. The subscription notifications we received from RevenueCat are kept as our record of transactions and are not deleted automatically. Apple and RevenueCat keep their own records

Cached map data (device-side): Offline navigation; Contract performance; Until user clears cache

Support communications: Resolving queries and complaints; Legitimate interests / Legal obligation; 3 years

Remembered preferences (explicit "remember…" requests): Personalising route planning across conversations; Consent; Until you delete them (You → Memory, or You → What Wayfindr remembers in Wayfindr 1.4; or "forget" in a chat in Wayfindr 1.3) or close your account

Onboarding answers (Wayfindr 1.3 and earlier: name, activity, time, pace, company, preferences, purpose, home area): Planning routes that fit you; Contract performance; Until you ask us to clear them, or close your account

Onboarding and trial progress record (which stages you reached and when, the identifier and description of the route we planned for you, whether a trial started, converted, was cancelled, or ended): Sending the right service and update emails at the right time, and not sending the wrong ones; Legitimate interests / Contract performance; Deleted with your account

Email sending record (which lifecycle emails were queued, sent, failed or cancelled for you, and when): Preventing duplicate or mistimed sends, and evidencing what we sent; Legitimate interests / Legal obligation; Deleted with your account

Marketing email preference (whether you opted out, when the choice was made, and where it came from): Honouring your choice; Consent / Legitimate interests (soft opt-in); Deleted with your account

Suppressed-address record (a SHA-256 hash of your email address, never the address itself; treated as pseudonymised personal data): Making sure an opt-out or deletion is honoured even if the same address signs up again; Legitimate interests; Retained indefinitely — see Section 10

5. AI and Conversational Data

  • To answer you, the messages you send and the planning context needed to answer them (for example the area you are in, the walk being discussed, and what you have asked for so far) are sent to OpenRouter and the AI model provider it routes each request to.
  • When we build a route for you, we keep what you typed in that request together with the route we built, including its start point (a "planning record"). Some conversations that don't produce a route are kept in the same way. Planning records have no fixed deletion date; when you delete your account they are kept without your account identifier.
  • We use planning records to find and fix poor routes: an automated AI grader, also run through OpenRouter, reviews them; we review them ourselves; a request may be kept as a test case for future versions of the planner; and short excerpts, without your account identity, may be copied into our private GitHub issue tracker when we investigate a recurring problem.
  • If your account is part of our test programme, your whole planning conversations are also kept so that problems can be replayed. They are deleted with your account.
  • We do not use your identifiable personal inputs to train or fine-tune AI models without your explicit, opt-in consent.
  • We do not share your conversational inputs with third parties for advertising or profiling purposes.

Deleting a saved walk in the App doesn't delete planning records. To have your planning records deleted, contact us at support@hhventures.co.

5.1 Remembered Preferences ("Memory")

If you explicitly ask Wayfindr to remember something about how you like to walk, for example "remember I hate stiles" or "from now on, no steep climbs", we store that preference or fact against your account so future conversations can use it. What we store is the memory type and the short verbatim sentence you said (up to 120 characters), which may include statements about physical comfort, such as avoiding steep climbs or not being comfortable with heights. We only save a memory when you use remembering words yourself; passing remarks shape the current conversation only and are never silently made permanent.

Remembered preferences are used solely to plan and describe routes for you. They are visible in the App under You → Memory (You → What Wayfindr remembers in Wayfindr 1.4), where you can delete any single memory or all of them at any time; in Wayfindr 1.3 you can also simply say "forget that" in a chat. To plan your walks, they are sent with your request to OpenRouter and the AI model providers it routes requests to, so that Wayfindr's reply can take them into account. We never sell them, never share them for advertising or profiling, and do not use them to train AI models. Closing your account deletes all remembered preferences with it.

5.2 Emails We Send You

We send two kinds of email, and they are treated differently.

Service emails are part of providing the Service: confirming your email address, receipts, notices about a subscription starting, renewing, failing to renew, or ending, and anything else you need to know about your account. We send these on the basis of contract performance and, where the law requires notice, legal obligation. You cannot opt out of them while you have an account, because they are how we tell you what is happening to it.

Update emails are our own marketing: route ideas, reminders while you are getting started, and news about the App. We rely on the "soft opt-in" under the Privacy and Electronic Communications Regulations — you gave us your address in the course of setting up the Service, the emails are about our own similar products, and you are given a clear way to decline both at sign-up and in every message. When you sign up (in Wayfindr 1.3, during onboarding) we show you a pre-ticked line saying we will email you your route and the odd tip, with a plain instruction to untick it for essentials only. Whatever you choose is recorded against your account, along with when the choice was made, so we can show what you agreed to. If we have no record of a choice for you, we treat you as opted out and send you no update emails at all.

To decide which emails to send and to fill them in, we use your first name, the walk we planned for you (its name, distance and time), the onboarding milestones you have reached, your subscription status and, for one reminder, whether you have recorded a walk since a trial began.

Every update email carries an unsubscribe link, and supports one-click unsubscribe in mail apps that offer it. Unsubscribing takes effect immediately and permanently: we record the opt-out against your account, and we also store a hash of your email address (see Section 10) so the opt-out is still honoured if the same address is used to create a new account later. We keep a record of which lifecycle emails were sent to you and when, so that we do not send them twice or send them at the wrong moment.

Resend (resend.com) is our email delivery provider and acts as a data processor under a data processing agreement. To deliver a message it necessarily receives your email address and the content of that message.

We do not sell your address, share it with other companies for their own marketing, or use it to advertise to you elsewhere.

6. Location Data

6.1 Route Generation

When you plan with location access allowed, your current position is sent with each message so routes can start where you are, and it is used to search for paths, places and start points nearby. It is not stored on its own. When we build a route that starts where you are, the route and its start point are kept in a planning record (Section 5). If you gave a home area in Wayfindr 1.3 or earlier, its approximate position is stored with your profile and used when planning.

6.2 Recording a Walk

During a walk, your position is used on your iPhone to show where you are, keep you on route, and update the Lock Screen and Apple Watch. The App also records the walk's GPS track. When the walk ends, the walk and its full GPS track are uploaded to our servers and kept against your account until you delete your account. This happens for every completed walk; there is currently no setting to keep a walk on your device only. Recorded walks can't yet be deleted one at a time in the App; contact us at support@hhventures.co to have one deleted.

6.3 Location Permissions

The App asks for location access while you use it, to plan from where you are and show you on the map. "Always" access lets the App keep recording a walk while your phone is locked; the App only tracks your location during an active walk. You can change your location permissions at any time in your device settings; restricting access will limit planning from where you are and walk recording.

6.4 Sharing a Walk

If you share a walk, we create a link that anyone who has it can open, in the App or on our website, without signing in. The link shows the walk's name, distance, climb, time and route. For a recorded walk, that route is the path you actually walked. Shared links are kept until you delete your account.

7. Sharing Your Data

We do not sell your personal data. We may share it only in the following circumstances:

  • Service providers that process data for us:
    • Supabase: our database and sign-in provider. It stores your account and everything kept against it (profile, saved and recorded walks, shared links, planning records, remembered preferences, usage and email records).
    • Vercel: hosts our website and servers. Every request from the App passes through it, and it keeps request logs.
    • OpenRouter and the AI model providers it routes requests to: your messages and the planning context needed to answer them, remembered preferences as described in Section 5.1, and planning records when our automated grader reviews them.
    • RevenueCat: your account identifier, the identifier for this app on your device, your purchases and subscription status, App Store country and App version, and the Apple Ads attribution described in Section 3.2.
    • Resend: your email address, your first name and the content of each email we send you.
  • Map, place and routing services, which receive what they need to answer a request and not your account identity:
    • Thunderforest: the App downloads the outdoor map, including maps saved for offline use, directly from Thunderforest, which receives your device's IP address and the map area being viewed.
    • Mapbox: the App downloads the street and satellite maps directly from Mapbox, which receives your device's IP address and the map area being viewed. Our servers also send Mapbox place names to look up, coordinates for routes, drive times and elevation, and, depending on our configuration, route calculations.
    • Google Places: place names and search text from your messages, and coordinates or map areas around a planned route, to find places and points of interest.
    • Route calculation: the coordinates of a route's start, finish and waypoints, sent to our own routing server (a GraphHopper instance we run).
    • OpenStreetMap (Overpass API) and Ordnance Survey: map areas and coordinates, to find paths, rights of way, features and places.
    • postcodes.io and the Met Office, as described in Section 3.3.
  • Apple: payments and subscriptions; Sign in with Apple; speech recognition if you dictate; turning your position into a town name on your iPhone; and Apple Ads attribution.
  • GitHub (a private repository): short excerpts of planning requests, without your account identity, when we investigate a recurring problem (Section 5).
  • Legal requirements: where required by law, court order, or regulatory authority.
  • Business transfers: in the event of a merger or acquisition, with prior notification to you.
  • With your consent: for any other purpose, with your explicit consent which you may withdraw at any time.

8. Cookies and Tracking Technologies

The Wayfindr mobile app does not use browser cookies. Apart from RevenueCat's subscription software, which handles the Apple Ads attribution described in Section 3.2, it does not include analytics, advertising or crash-reporting software from other companies. It keeps your sign-in session and settings on your device. It does not use the advertising identifier and does not track you across other companies' apps or websites.

Our website uses cookies only to keep you signed in where it offers sign-in, and for security. It counts page views with Vercel Web Analytics, which does not use cookies. When someone opens a shared walk link on our website, we record the visit with a salted hash of the visitor's IP address and their browser's user-agent string, so we can count how shared links are used.

9. International Data Transfers

Several of our service providers are based in, or process data in, the United States, including OpenRouter and the AI model providers it uses, RevenueCat, Resend, Vercel, Mapbox and Google. Where data is transferred outside the UK, we use appropriate safeguards including the UK International Data Transfer Agreement (IDTA) or adequacy regulations. Contact us for further detail.

10. Data Retention

We retain personal data as set out in the table in Section 4.

You can delete your account at any time in the App. When you do, your account and everything stored against it are deleted straight away: your profile and onboarding answers, saved and recorded walks (including their GPS tracks), shared links, remembered preferences, usage counts, your onboarding and trial progress record, your email preference, and the record of emails we sent you. We also ask RevenueCat to delete your customer record. Deleting your account does not cancel a subscription billed through Apple; cancel it in your Apple ID subscriptions.

Some records are kept after your account is deleted:

  • Planning records and their quality grading, "saved" and "started" walk events, and request cost records are kept without your account identifier. The text you typed and route start points are kept.
  • The subscription notifications we received from RevenueCat are kept as our record of transactions.
  • Copies in our hosting provider's logs and in our database provider's backups expire on those services' own schedules.

We also keep one record deliberately. When you unsubscribe from update emails, or when you delete your account, we store a cryptographic hash (SHA-256) of your email address on a suppression list rather than the address itself. We keep it so that if the same address is ever used again we can tell that it must not receive marketing. We rely on legitimate interests for this — specifically, our interest and yours in an opt-out that actually holds — and we retain it indefinitely, because deleting it would quietly undo the choice you made.

To be accurate about what that hash is: it is not anonymous data. Nobody can read your address out of the hash directly, but anyone holding both the hash and a guess at your address could confirm a match. We therefore treat these hashes as pseudonymised personal data, keep them under the same access controls as the rest of your data, and use them for one purpose only — checking an address against the suppression list before a marketing email is sent. They are never used to profile you, enrich a record, or match you across services.

11. Your Rights

Under UK GDPR, you have the right to:

  • Access: request a copy of your personal data.
  • Rectification: ask us to correct inaccurate data.
  • Erasure: ask us to delete your data, subject to legal exceptions.
  • Restriction: ask us to limit processing in certain circumstances.
  • Portability: receive your data in a structured, machine-readable format.
  • Object: object to processing based on legitimate interests.
  • Automated decisions: not to be subject to solely automated decisions that produce significant effects. All Wayfindr route outputs are advisory and can be overridden by you.

To exercise any of these rights, contact us at support@hhventures.co. We will respond within one calendar month and may ask you to verify your identity.

12. Children's Privacy

Wayfindr is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us at support@hhventures.co and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures including TLS encryption in transit, encryption at rest, strict access controls, and regular security assessments. In the event of a breach likely to affect your rights, we will notify the ICO within 72 hours and affected users without undue delay.

14. Changes to This Policy

We will notify you of material changes to this policy at least 14 days before they take effect.

15. Complaints

For complaints, contact us first at support@hhventures.co. If unresolved, you can complain to the ICO at ico.org.uk, by phone on 0303 123 1113, or by post to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.