Wandrr is made by CloraTech ("we", "us"). If you have any question about this policy or your data, email admin@cloratech.com.
Everything you create in Wandrr is yours and lives with you:
This data is stored on your device and, if iCloud is enabled, synced through Apple's CloudKit to your private iCloud database so it appears on your other devices. Apple, not CloraTech, hosts this data, and it is protected by your Apple ID. We cannot read your iCloud data. Wandrr Cloud, described below, keeps a copy of most of it on our servers too.
Wandrr Cloud keeps a copy of your trips and idea boards, with their photos and files, on our servers, so they're safe if you lose a device and reach every device you sign in on. Our database and file storage are run for us by Supabase in Ireland, in the EU.
When it's on. Wandrr Cloud works through your Wandrr account. If you signed in with Apple on Wandrr 5.2 or later, it's already on; if you signed in before that, the app asks you once to confirm your account with Apple. Settings › Account › Wandrr Cloud shows whether it's on and how far the upload has got. Signing out stops it on that device.
What it keeps. For every trip and idea board of yours, everything a shared one carries (see "Shared trips and idea boards"), plus the photos you add to a trip, its days and journal entries, a cover photo you choose from your own photos, files attached to plans, receipt images, your travel documents with their title, type, notes, dates and reminder setting, and whether you've archived or favourited each trip. Photos are reduced to at most 2048 pixels on their longest side before they're uploaded. It doesn't keep cover photos from Unsplash or the pictures on ideas, which each device fetches again; AI results such as trip ideas, your phrasebook and trip story; your Safe Landings flights; or anything from Health.
Who can see it. Only you, unless you share a trip or board: then everyone on it sees the trip and its photos and files. Your travel documents are stored apart and only you can read them, even on a shared trip.
Your devices. While Wandrr also uses iCloud, iCloud still carries your trips between your devices and Wandrr Cloud keeps a copy; a device that isn't signed in to iCloud gets your trips, photos, documents and boards from Wandrr Cloud instead.
When you share a trip or an idea board, Wandrr keeps a copy of it on our servers so that everyone you invite sees the same thing and changes reach them within seconds. Our database is run for us by Supabase and stored in Ireland, in the EU.
What the copy contains. For a trip: its name, destinations and dates, plans with their times, places, notes and booking references, flights and other transport, saved links, the text and mood of journal entries, the packing list, the budget, travellers' names and expenses, including who paid and how each is split. It also carries the trip's photos, journal photos, files attached to plans, receipt images and a cover photo picked from someone's own photos, so everyone on the trip sees them. Travel documents never go to the people you share with, and a cover photo from Unsplash isn't uploaded: each person's app fetches it again. For an idea board: its name and country, the ideas with their notes, links and places, the names and profile pictures members choose for the board, and each member's hearts and passes. For both: who is on it, each person's access (owner, can edit or view only) and who made the latest change.
Who can see it. Everyone on the trip or board. The owner invites people with a link; anyone who opens a link while it's valid joins with the access that link gives, so send links only to people you mean to invite. The owner can see everyone on it under Manage Sharing and remove anyone. People you share with also see your first name.
Keeping everyone in sync. While Wandrr is open, it keeps a connection to our database to hear about changes. When it's closed, our database asks our push service on Cloudflare to send each member's devices a silent notification so they can fetch the change; the notification says only which trip or board changed. To do this we store your devices' push tokens with your account while you're signed in. When someone else changes a shared trip or board, Wandrr may show you a notification naming them; this happens on your device.
When a share ends. When the owner stops sharing, everyone else is taken off the trip or board and keeps their own copy on their device as an ordinary one, which Wandrr Cloud then keeps as theirs; the owner's copy carries on as the owner's. (If the owner stops sharing from Wandrr 5.2, the shared copy is marked deleted, and we delete it 30 days later unless one of the owner's devices on a newer version brings it back.) Leaving a trip or board takes you off it and removes it from your device; if the owner removes you, you keep your copy as an ordinary one. Invite links stop working after 30 days and are deleted the following night.
Trips shared through iCloud. Trips you shared through iCloud before Wandrr 5.2 move to our servers once you confirm your account with Apple: the app writes an invitation into the trip's iCloud record so the people on it join automatically when they update Wandrr. Until everyone has, the owner's devices keep both copies in step. Idea boards shared through iCloud stay in iCloud for now.
Each permission is optional and only requested when you use the related feature. Wandrr works without any of them.
| Permission | Used for | Where the data goes |
|---|---|---|
| Location (while using) | Finding restaurants, cafés and other places near you for your trip. | Sent to Apple Maps to run the search. Not stored by us. |
| Photo library | Attaching memories to your journal, picking trip cover photos and choosing an idea board picture. | Stays on your device, in your iCloud and in Wandrr Cloud. Photos on a shared trip are seen by the people on it. |
| Add to photo library | Saving a copy of a travel document you photograph. | Saved to your own photo library. |
| Camera | Scanning receipts for the budget and photographing travel documents. | Receipt text is read with Apple's text recognition, then tidied up by Apple Intelligence (see "AI features" below). Receipt and document images stay on your device and in your iCloud, and are kept in Wandrr Cloud; the people on a shared trip see its receipt images, never your documents. |
| Health | Reading steps and walking distance for a trip's dates to show in the trip recap. | Read-only, on-device. Never sent to us or anyone else. |
| Calendar (full access) | Adding your itinerary to a "Wandrr" calendar. Full access is needed only so a re-sync can replace the events Wandrr added earlier. | Stays in your calendar. Wandrr does not read or change your other events. |
| Notifications | Flight changes for your own flights and flights you follow, travel day and document reminders, Live Activities, and changes to trips and boards shared with you. | Delivered by Apple Push Notification service (see "Flight alerts and Live Activities" below). |
Apart from your account, Wandrr Cloud and the trips and boards you share, described above, Wandrr does not keep your data on a server. Instead, a few narrow tasks are handled by services we operate as small proxies on Cloudflare, or by third parties, each receiving only what it needs for that task.
When you type a flight number, or when Wandrr re-checks an upcoming flight, it sends the flight number, airline and date to our flight proxy, which queries an aviation data provider for the schedule, aircraft, terminal, gate, delay and baggage belt. No account identifier, name or other personal data is included in these requests. Results are shown in the app and stored in your trip.
Some updates have to reach your Lock Screen when the app isn't open, so the app hands them to our push scheduler, which runs on Cloudflare and sends them through Apple Push Notification service:
Push tokens identify an app installation to Apple's notification service. They are not your name, email or Apple ID. These records are deleted automatically a few hours after the day's last update or the flight's landing. Safe Landings records are also cleared when you stop following a flight or your Pro subscription ends, and flights you follow are removed from the app a day after they land.
To stop other people misusing the services above, Wandrr uses Apple's App Attest. Once per installation, your device creates a key in its Secure Enclave and Apple confirms it belongs to a genuine copy of Wandrr. Our attestation service stores the key's identifier and public key. About once an hour the app proves it still holds the key, sending your RevenueCat app user identifier (a random ID, not your name or email) so the service can check whether you have Pro, and receives a short-lived token that the other services check. This identifier is used only to run the app's features and is never used for tracking or advertising. The stored key is useless outside your installation and is replaced if you reinstall.
Destination cover photos are fetched from Unsplash through our proxy using the destination name you entered. If Unsplash has no suitable photo, the app asks Wikipedia directly for a photo of the destination, so Wikipedia receives the destination name and your device's IP address. Airline logos are fetched by airline code through our proxy from Logostream or, if they don't have one, from the Aviasales logo library. None of these requests includes your name, account or other trip details.
The currency converter fetches live rates directly from Frankfurter (frankfurter.app), sending the amount and the two currency codes you chose. As with any web request, Frankfurter can see your device's IP address. No other information is sent.
When you save a web link to a trip, the app loads a preview (title, description and icon) directly from that website. Links suggested by the AI planner show the site's icon using Google's favicon service, which receives the website's domain name. These requests come from your device, so the sites involved can see its IP address, but they don't include your trip content.
Wandrr's AI features are built on Apple Intelligence, using Apple's language model rather than a third-party AI provider. These features include destination and activity ideas, itinerary suggestions, packing lists, the phrasebook, reading scanned receipts and travel documents, importing a reservation email or PDF itinerary, trip stories in your recap, journal prompts and note polishing, and spending insights. Anything the AI creates is labelled in the app. They are available only on devices that support Apple Intelligence.
Apple processes each request on your device or, for some requests, on Apple's Private Cloud Compute, which is designed so that Apple cannot see or retain your data. Either way, the request goes to Apple, not to CloraTech: we do not operate an AI service and never receive the text you send or the results you get back. Only the details needed for that request are used, such as the destination, dates and preferences you entered, or the text of a receipt or reservation email you chose to import. Your journals, photos, health data and other trips are not included. Results are shown in the app and you choose what to keep.
For more on how Apple handles this data, see Apple's Apple Intelligence and Private Cloud Compute documentation.
Wandrr Pro is an in-app subscription purchased through the App Store. Subscription status is managed by RevenueCat, which receives an app user identifier and purchase receipt information from Apple. When you sign in with Apple, we receive the identifier Apple provides and, only if you choose to share them, your first name and email address (which may be an Apple private relay address). The app also sends that first name and email to RevenueCat and attaches them to your subscription record, so we can find your subscription if you contact us for support. We use this to personalise the app, to link your Pro subscription to you and to let you delete your account. We do not use it for marketing, and we never receive your Apple password. RevenueCat acts as our data processor under its Data Processing Agreement; see its privacy policy.
Signing in also creates your Wandrr account on our servers, run by Supabase. It holds the identifier Apple provides, the email address in Apple's sign-in token (which may be a private relay address), your first name if you shared it and, while you're signed in, your devices' push tokens. Your first name is shown to the people you share trips and boards with. Supabase acts as our data processor under its Data Processing Addendum; see its privacy policy.
wandrr.app is hosted on Cloudflare, which processes standard request information such as your IP address to serve and protect the site. The site sets no cookies and uses no analytics or advertising. Fonts are loaded from Google Fonts, which means your browser requests them from Google.
If you send feedback from Settings, it is sent as an email from your own mail app to admin@cloratech.com. You choose what to include.
In the app, go to Settings → Delete Account. This removes your trips, idea boards, journals, photos, documents and other data from your device, your iCloud database and our servers: your Wandrr account, the trips and boards you own (for everyone on them) with their photos and files, your travel documents, your place on trips and boards others share with you, your votes and your devices' push tokens. Photos and anything else you added to a trip someone else owns stay with that trip, as part of it, and are then held as the trip owner's. It also instructs RevenueCat to delete your subscription customer record and revokes Wandrr's Sign in with Apple access. The request is authenticated with your Sign in with Apple token, so only you can delete your account. Temporary Live Activity and Safe Landings records expire on their own as described above; if you want them removed sooner, email us. Deleting your account does not cancel an active App Store subscription; manage that in your Apple ID settings.
You can also delete individual trips, journal entries, photos, receipts and documents at any time from inside the app; they're deleted from Wandrr Cloud too, as "Data retention" describes.
Data on your device and in your iCloud is kept for as long as you keep it. Your Wandrr account is kept until you delete it. Trips, boards, photos and documents in Wandrr Cloud are kept until you delete them. A deleted trip or board is removed from our servers 30 days later, so your other devices and the people on it hear that it's gone, and its photos and files are deleted with it. A photo or file you take off a trip is deleted from our servers within about 10 days. A travel document you delete is deleted from our servers as soon as your device is online, and the note that it was deleted is kept for 30 days so your other devices remove it too. Invite links are deleted once they expire; push tokens are deleted when you sign out, when Apple reports them invalid, or when you delete your account. Our database host keeps backups for up to 7 days, so deleted data leaves the backups within that time; photos and files aren't part of those backups and are gone as soon as they're deleted. Our flight, photo and logo proxies do not log personal data and hold request data only as long as needed to return a response. Push scheduler records are deleted automatically within hours of the last update or landing. App Attest keys are kept while your installation uses them. Subscription records, including the name and email attached to them, are kept by RevenueCat for as long as you have an account and are deleted when you delete your account as described above.
Wandrr is not directed at children under 13 and we do not knowingly collect personal data from them.
Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. Most of these you can exercise directly in the app because the data is in your control. For anything else, email admin@cloratech.com and we will respond within 30 days.
CloraTech is the controller of the personal data described in this policy. We rely on performing our contract with you to run your account, sharing and the other features you use, and on our legitimate interest in keeping the service secure and preventing misuse, for example with App Attest. Where a trip or board includes details about people who don't use Wandrr themselves, such as your travel companions' names, who paid for an expense or the names you give to flights you follow, we rely on our legitimate interest in helping you plan trips with the people you travel with.
Our service providers (Supabase, Cloudflare, RevenueCat and Apple) may process data outside the UK and the EU. Where they do, the transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in their data processing agreements.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.
If we change how Wandrr handles data, we will update this page and the date at the top. Material changes will also be noted in the app's release notes.