Privacy Policy

1. Who we are

Wakabuddy is run by Trivet Labs ("we", "us"). Trivet Labs is the data controller for the personal data described here. You can reach us at hello@wakabuddy.com.

2. What we collect

We only collect what we need to run the app:

• Account details: your email address, which you use to sign in with a one-time code, and the name you choose. If you add them, your first and last name, birthday (day and month only), nationality, profile photo and phone number.
• Safety and payment details you choose to add: an emergency contact (name, relationship and phone number) and the bank details you want your crew to pay you with (bank name, account number and account name). We never take payments or move money.
• Trip content: trips, stops, dates, route legs, plans, checklists, notes, journal entries, expenses, receipts, contributions, settlements, exchange rates, photos and the crew you travel with. For photos we read the date they were taken so we can file them under the right day.
• Location: only when you tap check-in and allow location access, we read your device location once and save it with that check-in. We never track your location in the background.
• Device and usage details: your push notification token, device and app language, notification settings, when you last signed in, and technical data such as IP address, device type and app or browser version in our server logs.
• Share page visitors and followers: when someone views a trip share page, leaves a note or follows a trip, we process the name they type, the note, the email address they give to follow, and their IP address and browser details to stop abuse.
• Messages you send us, such as support emails and account deletion requests.

We do not use advertising or analytics SDKs, and we do not collect contacts from your phone.

3. How we use it

• To create your account, send your sign-in codes and keep you signed in.
• To run the features you use: plan trips, share them with your crew, split and settle costs, store photos and receipts, and work offline and sync later.
• To send the notifications and emails you asked for, such as trip reminders, money updates and check-in emails to people who follow your trip. You can turn notifications off in the app or in your device settings.
• To draft a trip plan when you use "Plan with AI". We send the trip details you type to our AI provider to produce the draft.
• To keep the service secure, prevent abuse and spam, fix bugs and answer support requests.
• To meet our legal obligations and enforce our Terms of Service.

4. Who can see your information

• Your crew: people in a trip with you can see your name, profile photo and what you add to that trip. They can also see your emergency contact and bank details if you add them, so they can reach someone in an emergency or pay you back.
• Share pages: a trip organizer can create a share link. Anyone with that link, and the access code if one is set, can see the parts of the trip the organizer chose to show. The organizer can switch sections off or turn the link off at any time.
• Followers: if you allow it, people who follow your trip get an email when you check in, showing the place and time.
• We do not sell or rent your personal data to anyone.

5. Service providers

We use a small number of providers who process data for us under contract and only to run the service:

• Hosting and database providers that store the app's data.
• Cloudinary, to store and deliver photos, receipts and profile photos.
• An email delivery provider, to send sign-in codes and other emails.
• Expo, Apple and Google push services, to deliver notifications to your phone.
• Anthropic or Google (Gemini), only when you use "Plan with AI". They receive the trip details you type.
• Routing services (OSRM or OpenRouteService), which receive the coordinates of trip stops to work out road distances. They do not receive your name or email.
• OpenFreeMap, which serves the map tiles your device loads. Like any website, it sees your IP address when your device requests tiles.

We may also share information if the law requires it, to protect people's safety, or as part of a merger or sale of our business, in which case this policy will still apply to your data.

6. Legal bases

Where data protection law such as the Nigeria Data Protection Act 2023 or the GDPR applies, we rely on: the contract with you, to provide the app; your consent, for location at check-in, push notifications and follow emails, which you can withdraw at any time; our legitimate interests, to keep the service secure and improve it; and legal obligations, where the law requires us to keep or share data.

7. International transfers

Our providers may store or process data outside your country, including in the European Union and the United States. When that happens we rely on safeguards the law recognises, such as standard contractual clauses.

8. How long we keep data

• Account and trip data: for as long as your account is open.
• When you delete your account: we delete or anonymise your data within 30 days, and clear it from backups within a further 30 days.
• Shared money records: expenses and settlements you were part of stay for the rest of the crew so their balances still add up, but your name is replaced with "Deleted user".
• Sign-in codes expire after a few minutes. Server logs are kept for up to 90 days.
• We keep a record of deletion requests, and data we must keep by law, for as long as the law requires.

9. Your rights and choices

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent. You can edit most details yourself in the app.

• Delete your account: use the form at https://wakabuddy-web.vercel.app/delete-account or email hello@wakabuddy.com from the address on your account.
• Turn off location, camera, photos and notifications at any time in your device settings.
• To use any other right, email hello@wakabuddy.com. We reply within 30 days.
• You can also complain to your data protection authority, such as the Nigeria Data Protection Commission or the authority in your country.

10. Security

Data travels over encrypted connections. Sign-in uses one-time codes sent to your email, and your session is stored in your device's secure storage. Photos and receipts are served through links that only work for people allowed to see them. No system is perfectly secure, so please tell us at once if you think your account has been misused.

11. Children

Wakabuddy is not meant for children under 13, or under the age of digital consent where you live. We do not knowingly collect data from them. If you think a child has given us data, write to hello@wakabuddy.com and we will delete it.

12. Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant we will also tell you in the app or by email before it takes effect.

13. Contact us

Trivet Labs, operator of Wakabuddy. Email: hello@wakabuddy.com.