Privacy policy

Who is responsible

Anastasiia Ovchenko, a private person living in Portugal, runs wendle as a free, non-commercial personal project and is the controller of your personal data under the GDPR. For anything about your data, write to hello@wendle.app.

What wendle stores

• Your account, from Google sign-in: your Google account ID, your email address and the name the app shows (your first name in Google). Also your role in the family, your colour on the map, your language, when you joined, whether the operator has closed your access and whether you’ve been through the “How it works” tour. There are no passwords.
• Walks: GPS points with their times and what is worked out from them — distance, duration, the time zone, a simplified line and the heatmap cells — plus the sport, the name of the uploaded file and the device name from it, and the dogs on the walk. A walk can name the people of your family who walked it with you: they see it as theirs, and it is in their copy of their data.
• For each walk, wendle stores only a minimal GPX file of the track: the time and coordinates of each point and the activity type. The uploaded file itself is not kept (only its checksum, so a re-upload is recognised), so heart rate, cadence, elevation and the watch’s serial number are discarded at upload; older backups that may still contain original files are deleted within 30 days.
• Pins and categories: a pin’s category, note and position, who set it and when; and the family’s categories, each with a name, a colour and an icon, which belong to the family rather than to whoever made them.
• Dogs: name, colour and whether they’re deleted — a deleted dog stays on its walks.
• Your family: its name, who is in it and with which role, and the invites — who created and who used each one, and until when it was valid.
• Access records, including sessions and invite links, are stored as hashes rather than readable secrets.

Why, and on what legal basis

• To run wendle for you and your family: your account, walks, pins, dogs and stats. Legal basis: performance of a contract — the terms of use you accept when you sign in (GDPR Art. 6(1)(b)).
• To keep wendle secure, prevent abuse and keep backups. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).

Who sees your data

Everyone in your family sees the family’s walks, pins, dogs and stats, and each other’s names; the family’s admin also sees the members’ email addresses. That is what wendle is for: a map the whole family shares. Whoever opens an invite link you made sees your name, your email address and the family’s name, so they can tell who invites them.

Nobody outside your family sees them. Apart from the family, only the operator, who runs the service, and the hosting provider, which stores the data, have access to it. To handle abuse, and only for that, the operator’s tool lists the families with their members’ names and email addresses.

Nothing is sold. There are no ads, no analytics and no tracking.

Where it is kept

Railway (Railway Corporation) runs the app and its PostgreSQL database in its EU West region (Amsterdam, the Netherlands).

Every night the database is backed up to a Railway storage bucket in Amsterdam, the Netherlands. Each backup is kept for up to 30 days and then deleted.

Railway Corporation is a US company, so its staff or subprocessors may access the data from outside the EU. Such transfers happen under Railway’s data processing terms: its Data Processing Addendum covers transfers out of the EU under the EU–US Data Privacy Framework or the EU Standard Contractual Clauses, and Railway states that it has self-certified under that framework. You can read the addendum, which includes these clauses, at railway.com/legal/dpa.

Other services

• OpenFreeMap serves the map: its tiles, fonts and icons, which your browser loads directly. It sees your IP address and which part of the map you look at.
• Google runs the sign-in, on its own pages and under its own privacy policy. It gives wendle your account ID, name and email address; the other profile details it sends, such as your profile picture, aren’t kept.
• Cloudflare runs the DNS of wendle’s domain and forwards email sent to hello@wendle.app to the operator’s personal mailbox. Cloudflare, Inc. is a US company and handles that email under its Data Processing Addendum, which is part of its terms for every customer and includes the EU Standard Contractual Clauses: cloudflare.com/cloudflare-customer-dpa. For the website it is DNS only: the site’s traffic doesn’t pass through Cloudflare.
• Railway, which hosts wendle, processes your IP address to deliver the site to you.

Cookies and browser storage

wendle sets only the cookies it needs to sign you in and to work. There are no analytics or advertising cookies, so there is no cookie banner.

• wm_session — keeps you signed in; 30 days, renewed as you use the app
• wm_oauth — a Google sign-in in progress, with the invite you’re accepting, if any; 10 minutes
• wm_next — the page to open after signing in; 10 minutes
• wm_lang — the language you chose; 400 days
• wm_flash — a one-time notice after an action; 1 minute

Your browser’s storage keeps a few conveniences on your device, such as the last map view, the step of the “How it works” tour and files shared to wendle from another app until the upload page picks them up.

Server logs

For each request the app logs the method, the path, the status, the size and how long it took, without IP addresses or query strings. Some events are logged with your user ID — sign-ins (with your email address), uploads, deleted walks, accounts and families, downloads of your data, changes to families, invites and access, and what the operator opens and does in their tool — and so are the names of files that couldn’t be imported and, rarely, the coordinates of a walk’s start, when no time zone is known for that place. Railway’s own request logs also record your IP address and browser for each request. Railway keeps all these logs for 7 days.

How long it is kept

As long as your account exists. What you delete — a walk, a pin, a family or your account — is deleted at once, but can stay in a backup for up to 30 days. After an account is deleted, a keyed fingerprint of its Google account ID is kept for 24 hours to prevent abuse of sign-ups; it can’t be turned back into the ID (legitimate interests, GDPR Art. 6(1)(f)). Sessions end 30 days after your last visit.

Your rights

You can ask to see your data, to correct or erase it, to restrict how it is used and to get a copy in a portable format. Write to hello@wendle.app; you’ll get an answer within one month.

While signed in, you can also download a copy of your data yourself at any time: open the avatar menu, then “Account and data”, and choose “Download my data”. You get a zip archive with your account details and, from every family you belong to, your walks with their tracks as GPX files and the pins you set. Walks and pins you added in a family you’ve left, or that has since removed you, stay with that family and aren’t in the archive; to get them, write to hello@wendle.app.

You can delete your account yourself, too: open the avatar menu, then “Account and data”, and choose “Delete my account”. Your account is deleted, along with its access records and, in every family you belong to and in those you’ve left or that removed you, your walks with their tracks and the pins you set; a family whose only member you are goes with everything in it. You can also leave a family, keeping what you added there for the family or deleting it. For 24 hours after the deletion, the same Google account can’t sign up again: only a keyed fingerprint of its ID is kept for that time. The nightly backups keep a copy for up to 30 days.

Where wendle relies on legitimate interests (security, abuse prevention and backups), you have the right to object to that use at any time, on grounds relating to your particular situation: write to hello@wendle.app.

You can also complain to the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), or to the authority where you live.

You need a Google account to use wendle: without the account ID, email address and name that sign-in provides, it can’t create your account. Everything else — walks, pins and dogs — is up to you.

Age

wendle is for people aged 16 and over.