Privacy Policy

This Privacy Policy explains how Wentfar handles personal data in the Wentfar mobile app and on wentfar.com, including our support, abuse-report, and account-deletion pages. It applies to people who use those services from 5 November 2026, including during beta testing. This version clarifies public trip links, Plus subscriptions, map providers, website analytics, app diagnostics and analytics, and retention. You can request earlier versions from support@wentfar.com.

Last updated 5 November 2026: wentfar.com counts visits without cookies, and the visited countries map keeps your list on your device. See Website analytics.

Controller and contact

Sokkio OÜ (registry code 17532051), registered in the Estonian Commercial Register at Tartu maakond, Tartu linn, Tartu linn, Raua tn 20-15, 50106, Estonia, is the controller of personal data processed for Wentfar. You can contact us at support@wentfar.com.

Data we handle

We may receive data that you provide, data generated while you use Wentfar, data from other users who share a trip with you, and data from sign-in providers and your device. This can include account and profile details; friendships and invitations; trips, Trip Notes and trip feeds, comments, reactions, packing lists, achievements, and expenses; photos, video, audio, and their associated metadata; approximate and precise location and Journey Capture records; notification preferences and device tokens; diagnostics; reports and moderation records; and support, abuse-report, and account-deletion form details.

Why we use it

We use this data to provide and secure your account and the features you choose to use; make trips and shared content work; show maps and place information; deliver notifications and updates; process media; provide support; prevent fraud and abuse; enforce our Community Guidelines; and meet legal obligations that apply to us. Where applicable, we rely on performing our agreement with you, our legitimate interests in security, reliability, moderation, and understanding and improving Wentfar, your consent for genuinely optional processing, or a legal obligation. Device permissions are choices in your operating system; they are not themselves the legal basis for processing.

Sharing and service providers

A trip owner can publish a public link that anyone holding it can open without a Wentfar account. Participants may pass along an active link. Depending on the owner's feature access and confirmation, the link shows either a short destination-and-highlight preview or the eligible organised trip: places and saved dates, collections, notes, photos, voice notes, a city-level route map, and reaction and comment totals. The owner's eligible current and future uploads can appear. A participant's uploads stay out unless they choose to share their eligible current and future uploads from that trip. Participants can withdraw that choice or exclude individual files while still viewing or passing along the link. The public trip excludes private media, raw Journey Capture locations, live location, expenses, packing lists, and the identities behind reactions and comments. The same link may switch between the short and full views as the owner's feature access changes. The owner can turn sharing off or replace the link. Previously issued media links can work for up to five minutes. Downloaded or cached copies cannot be recalled.

Content and trip details are visible to the people you choose to share them with, subject to trip roles, privacy settings, and the visibility you select. We also use trusted service providers to operate Wentfar, including providers of authentication, data hosting, media processing and storage, maps and place information, app updates, push notifications, and abuse prevention. The data each provider receives depends on the feature you use. Our providers include Clerk, Convex, Cloudflare, Mux, Mapbox, Expo, Apple, Google, RevenueCat, Sentry, and PostHog. Protected forms use Cloudflare Turnstile as an abuse-prevention provider, which may receive your IP address and browser or device signals to verify that a submission is legitimate.

If you email us, we process your email address, message and related correspondence to respond. This is based on our legitimate interests in responding to correspondence, or on taking steps towards or performing a contract where your message concerns one. Our email hosting provider stores correspondence on servers in the United States.

We use Mapbox for maps in the mobile app. When you use maps, Mapbox may receive your IP address, map-use events, device and technical information, and identifiers generated by its software. With location permission, it may also receive your approximate or precise location. Mapbox uses this data to provide, bill for, secure, and improve its mapping products and services. It acts as an independent controller when it determines how data is used for its own purposes, including improvements that benefit its customers generally. Showing your position on a map does not turn on live location sharing with other Wentfar users. You can change location access in your device settings. Mapbox explains its telemetry, privacy choices, and data handling in its Product Privacy Policy.

Opening the map on a full public trip loads Mapbox map services. Mapbox may receive the visitor's IP address, browser and request information, and the map area being viewed. Mapbox receives the website origin as a referrer, without the public sharing link's path or query. The map uses city-level trip stops rather than raw Journey Capture locations.

We use Sentry for app diagnostics. It may receive error and stack-trace information, sampled performance timings, redacted logs and breadcrumbs, app, device, operating-system and build context, pseudonymous user and session identifiers, and information you deliberately include in an optional problem report, such as a message, email address, or screenshot. Wentfar disables default personal-information collection and automatic screenshots in Sentry. Sentry is not used for advertising or cross-app tracking.

App analytics

The Wentfar app uses PostHog to understand app usage and improve Wentfar. Events can include the screens and features used, successful or failed actions, app and device information, and pseudonymous account and session references. Unlike website visitor references, app analytics can be linked to your Wentfar account. PostHog receives this data through its EU service. Optional feedback you send can include your written message and answers to the feedback questions.

The app does not record your screen or sessions. Some earlier beta builds could; PostHog keeps those recordings for up to 30 days. App analytics is not used for advertising or cross-app tracking. A website cookie choice does not change app analytics. To object to app analytics, contact support@wentfar.com.

Some providers may process personal data outside the European Economic Area. Where required, we rely on a European Commission adequacy decision or safeguards in our provider agreements, such as the European Commission's Standard Contractual Clauses. Cloudflare may process personal data in the United States under the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. We also limit the data shared and restrict access according to its purpose. You can contact us for more information about the safeguard relevant to a transfer.

If you have questions about a recipient or transfer, contact support@wentfar.com.

Wentfar has no advertisements. Wentfar Plus is an optional subscription that can unlock features including full public trip sharing. We do not use your information to sell advertising.

We use RevenueCat to manage subscription access. RevenueCat receives your Wentfar account reference when you sign in, including if you use the Free plan without purchasing Plus. If you purchase Wentfar Plus, Apple or Google handles the payment through its app store. RevenueCat also receives store purchase information, including the product, store, subscription status, and purchase, renewal, and expiry dates. We use the subscription and entitlement state when you buy, renew, or restore an eligible purchase, provide Plus features, and ask for help with purchase issues. We do not receive your card number or bank credentials. Our account-deletion process removes our subscription record and requests deletion of your RevenueCat customer record; Apple or Google may retain its own transaction records. Deleting your Wentfar account does not cancel a subscription bought through an app store. You must cancel it separately in your Apple or Google subscriptions.

Website analytics

On wentfar.com, we use PostHog, through its EU region, to see how people find and use the site. Our pages send this data to an address on wentfar.com, which passes it on to PostHog. Website session recording and advertising tracking are off.

Before you make a choice, and after you choose Reject cookie, we count visits without cookies or any other storage on your device. Each count records the page or article, the referring site's domain and the kind of source (such as a search engine, an AI assistant or social media), any approved campaign tag, a coarse device type, browser and operating system, clicks on app store links, and downloads of a visited countries map image (never the countries on it). To tell one day's visits apart, PostHog computes a hash from the date, your IP address, your browser's user agent and our domain. The hash changes every day, so visits cannot be linked across days, and PostHog does not keep your IP address or user agent with the events. Our legal basis is our legitimate interest in measuring the site's reach (Article 6(1)(f) GDPR). You can object at any time by contacting support@wentfar.com.

If you choose Accept cookie, we also set a first-party analytics cookie with random visitor and session references, so we can recognise return visits. We then also measure public-trip views and support, abuse-report and account-deletion form steps. Public-trip measurement uses an opaque trip reference; it does not send the sharing link, trip title, photos, itinerary, or your form entries to PostHog. These references are not linked to your Wentfar account. Our legal basis is your consent (Article 6(1)(a) GDPR). We remember your choice for about six months, and the cookie lasts no longer than that choice. Country-level measurement is currently disabled; enabling it would estimate country from network information rather than precise location.

Cookie settings in the footer lets you reject the cookie or withdraw your consent at any time. Withdrawal clears the analytics cookie and returns to counting without cookies; it does not delete events already received. Contact support@wentfar.com for privacy rights, including deletion where applicable. Your website choice does not grant permission for analytics or recording in the mobile app.

The visited countries map keeps the countries you tick only in your browser’s storage on your device, and never sends them to us. A share link you create carries them in the link itself, so anyone you send it to can see them. Clearing the map or your browser data removes them.

Permissions and location

Camera, photo-library, microphone, notification, and location permissions are optional and are requested when you use a feature that needs them. You can change them in your device settings; denying a permission can limit the related feature.

Journey Capture records location during a trip you choose to capture, including while Wentfar is closed or not in use if you allow background location. We use these records to suggest places you visited. Capture records and suggestions are private to you; a suggested place becomes part of your trip story only when you add it, and follows that trip’s visibility settings. You can stop capture in the app. Turning on Journey Capture does not turn on Location Sharing.

Location Sharing is a separate, optional feature. You choose who can see your location and the level of precision to share. New location updates are sent while Wentfar is open; Journey Capture does not continue those sharing updates in the background. You can stop sharing in the app.

Retention and account deletion

We keep active account and trip data while your account remains active or until it is removed by you or an authorised trip member. Temporary upload and media-processing records expire or enter cleanup within 1 to 24 hours. Invite links expire after 7 or 30 days, depending on the type. Raw Journey Capture locations that have not become trip content are cleaned up after 30 days. Transactional email content is kept for up to 30 days, and delivery metadata for up to 180 days. Informational operation events and debug/informational audit records are kept for 30 days; warning, error, and administrator audit events are kept for 90 days. Closed safety reports are minimized after 90 days.

When you delete an account, we start the deletion process for the account and associated data. Necessary security and moderation records can enter a hold of up to 90 days. After that hold and completion of the deletion workflow, we remove the deletion-request record and the original-account link from retained shared financial history. Specific legal holds can delay this cleanup until their expiry. Shared expense history needed by other trip members and provider backups or logs may remain longer. Access to retained records is restricted. Contact us for the status of your request and the reason and period for any data that remains. Deleting the app or withdrawing analytics does not by itself remove data already held by service providers.

You can start deletion in the app or through our verified-email account-deletion page. If you own a trip with other participants, the review flow lets you remove participants in Wentfar or choose to delete the trip for everyone. Other participants’ independent content and any necessary shared financial context may not be removed with your account. We will explain any retention that applies to a particular request.

Retention of diagnostics and analytics also depends on the provider. We have not yet verified an automatically enforced event-retention period for production website analytics. For provider-held data, contact support so we can assess access or deletion separately from the app's account-deletion process.

Security

We use technical and organisational measures intended to protect personal data, including authentication and access controls. No method of transmission, storage, or deletion is completely secure, and we do not claim that every copy of data on every device is encrypted or can be remotely erased.

Age

Wentfar is for people aged 13 and over and is not directed to children under 13. If optional processing requires consent, additional age or location-specific requirements may apply. If you believe a child has provided us information contrary to this Policy, contact us at support@wentfar.com.

Your privacy choices and rights

Depending on where you live and the processing involved, you may ask for access, correction, deletion, portability, restriction, or objection, or withdraw consent for optional processing. We verify requests proportionately to protect you and other people. Where applicable, we provide requested data securely through support. Read how to make a request on Privacy Choices.

Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, +372 627 4135, or with the data-protection supervisory authority in the EEA country of your habitual residence, place of work, or the place of the alleged infringement.

Changes to this Policy

We will post the current version and effective date here. If a change is material, we will provide additional notice in the app or by another appropriate channel. Notice of a Policy change is separate from any consent required for optional processing.