Privacy Policy

Last updated: October 26, 2026

In short: WAU has no accounts, no analytics, and no ads. Your tracks, explored fog, saved places, photos and statistics stay on your device. Nothing leaves your phone unless you deliberately send it: a place you publish with “Make Public”, a comment or report you write on a public place, the map area on screen at the moment you ask us for public places, or what you share in a team — which is end-to-end encrypted, so we cannot read it. Each is handled anonymously, with nothing kept alongside it that links it back to you.

1. Who We Are

WAU — When Adventure Unfolds is developed and operated by Rw-Estilo OÜ, a company registered in Estonia. If you have questions about this policy, contact us at appz @ getwau .app.

2. What Data WAU Uses

WAU is a location-based exploration app that uses your device's GPS to track areas you've visited and display them on a map. The app processes the following data:

Location data (GPS coordinates): Used to show your position on the map, record exploration tracks, and reveal areas you've visited. This includes foreground and optional background location access.
Device motion data: Used to detect movement and optimize location tracking.
Exploration statistics: Distance traveled, areas explored, session duration — all calculated and stored locally.
Photos you attach to saved places: Taken with the camera or chosen from your photo library. They are stored in the app's own storage on your device and are not uploaded, unless you publish that place (see section 5).
Expense records: If you use Split Expenses, the group members, amounts and currencies you enter are stored locally — and, if you share them in a team, end-to-end encrypted (see section 6).

3. Health & Fitness Data

WAU derives health and fitness-related data from your location and motion sensors. This data is classified as Health Data under Google Play's data safety policies. Specifically, the app accesses and processes:

Physical activity / fitness data: Movement speed, distance traveled, session duration, and movement patterns are calculated from GPS coordinates to provide exploration statistics and optimize tracking.
Location-based activity tracking: The app continuously records GPS coordinates during active exploration sessions (foreground and optional background) to build a map of areas you have visited.

Important: All health and fitness data is processed and stored entirely on your device. It is never transmitted to our servers or any third party. You have full control over this data — you can view it within the app and delete it at any time by removing individual track sessions or uninstalling the app.

4. Where Your Data Is Stored

On-device by default. All GPS tracks, exploration cells, session data, saved places, place photos, expenses and statistics are stored in a local SQLite database and the app's private file storage on your device. None of it is sent to our servers, except for the opt-in transmissions described in sections 5, 6 and 7.

5. Public Places (“Make Public”)

WAU includes an optional community feature. You can browse places shared by other users, and you can share your own.

Loading public places. When you tap the cloud button on the map, the app sends the map area you are currently viewing (a bounding box) to our server so it can return the public places inside it. Public places are never fetched in the background — only when you ask. Your own tracks, fog and saved places are not sent as part of this request.

Publishing a place. If you open one of your saved places and tap “Make Public”, the following is transmitted to and stored on our servers: the place's name, coordinates, category, description and any photos you attached to it. A human moderator reviews the submission before it becomes visible to others.

Published anonymously. A published place is stored on its own. We do not store your name, email, device identifier, IP-derived identity, or any link between the published place and the rest of your map. Nobody — including us — can tell which user submitted a given public place.

Sharing is one-way. An approved public place cannot be made private again from the app. If you want one removed, use the report option on the place's detail sheet or email us — a moderator reviews and actions removal requests.

Comments and reports. If you comment on or report a public place, the text you write is sent to and stored on our servers, and is likewise not linked to your identity.

6. Teams and Friends

Teams are private groups of people you choose. A team can share places (with their photos and comments), expenses, notes, checklists, polls and meetups. Nothing is shared until you share a team or join one.

End-to-end encrypted. What a team shares is encrypted on your phone before it is sent, with keys that exist only on the members' phones. Our server stores and passes on this encrypted data but cannot read it — not the places, photos, names, amounts or messages. An invite link or QR code carries the key to its one team; keep it among the people you mean to invite.

No accounts, nothing that links your teams. In each team your phone takes part under a separate random identity, so what our server stores cannot tell that two teams have a member in common. Your friends list lives only on your phone. Adding a friend exchanges keys inside the QR code or link; invitations to a friend then travel through an encrypted mailbox only the two of you can address.

What our server can see is what any relay sees: that encrypted data arrives for a team, how much and when, and the IP address a request comes from, which is not stored with team data. Requests are accepted only from a genuine WAU app (checked with Apple's App Attest or Google Play Integrity), without identifying you.

Leaving and deleting. Leaving a team removes it from your phone. A team's creator can delete it for everyone, which removes it from our server. A team nobody has used for 12 months is purged from our server. Backups you export do not contain team keys or sync secrets.

7. Notifications

Team notifications are off unless you turn them on — WAU asks once, after you first share or join a team, and the switch is in Settings → Team notifications.

A push token. To receive notifications, your phone gets a push token from Apple (iPhone) or Google's Firebase Cloud Messaging (Android). On Android, Firebase creates its installation identifier only when you turn team notifications on. No Firebase analytics are included.
Sealed per team, stored nowhere by us. Your phone encrypts its token separately for each team so that only our server can open it, and puts it inside that team's end-to-end encrypted data. Our server opens it only at the moment another member's phone asks it to notify you, sends the notification, and keeps nothing — no token, no list of whom it notified. What we store cannot link your teams.
The content is end-to-end encrypted. The text of a notification is encrypted by the member who made the change and opened only on your phone. Apple and Google see that a notification was delivered to your device, when, and its size — never what it says. By default a banner says only "New activity in your teams"; Settings → Notification text lets it say who changed what.
Turning them off withdraws your token from every team, so nobody can notify you. Teams still update when you open WAU.

8. What We Do NOT Collect

WAU does not collect, transmit, or have access to:

Your name, email, or any personal identity information
Your location history — recorded tracks and explored fog never leave your device
Analytics, usage metrics, or behavioral data
Advertising IDs — WAU never reads the Android advertising ID or the iOS IDFA, and there are no ads to target with them
Any device identifier of our own — we neither generate nor store one. The Mapbox Maps SDK assigns your installation an identifier for map licensing (section 11), and if you turn on team notifications your phone uses a push token from Apple or Google (section 7)
Cookies or tracking technologies
Your contacts, microphone, photo library at large, or any other sensor data — the camera and photo picker are used only for photos you explicitly attach to a place

9. No Accounts Required

WAU does not require you to create an account, sign in, or provide any personal information to use the app. There are no user profiles, no logins, and no cloud synchronization of your map — moving your data to a new phone is done with a backup file you export yourself. Your friends list stays on your phone. The community features in section 5 and the teams in section 6 work without an account precisely because nothing is attributed to a user.

10. No Third-Party Analytics or Advertising

WAU contains:

No advertising SDKs: no ads of any kind
No analytics SDKs: no Firebase Analytics, Google Analytics, or similar
No crash reporting services that transmit data externally
No social media SDKs or tracking pixels

The third-party SDKs that transmit anything are the Mapbox Maps SDK, which draws the map (its optional usage telemetry is switched off; what remains is described in section 11), and — on Android, only once you turn on team notifications — Firebase Cloud Messaging, which delivers them (section 7).

11. Map Tiles

WAU uses the Mapbox Maps SDK to display the basemap, including the satellite layer. When you view an area for the first time, your device downloads map tiles directly from Mapbox's servers. That connection may expose your IP address and the approximate area you are viewing to Mapbox, and is governed by Mapbox's privacy policy. This is inherent to how all map applications work, and the tile requests do not carry your recorded tracks. Tiles are cached on your device for offline use.

Mapbox assigns your installation an identifier. Independently of anything WAU does, the Mapbox SDK generates a random identifier for the app installation, stores it on your device, and sends it to Mapbox when the map starts. Mapbox uses it to count monthly active users for licensing. It is not linked to you, to a WAU account (there are none), or to anything in your map — but it is a device identifier transmitted to a third party, and Google Play's Data safety section requires us to declare it as such. We do not receive it and cannot read it. WAU turns Mapbox's optional usage telemetry off at startup; this licensing identifier is not something the SDK lets an app disable. Apart from the push token you allow by turning on team notifications (section 7), it is the only device identifier WAU transmits; the two are why the app's Data safety label lists "Device or other IDs".

12. Tips and support

Supporting WAU is entirely optional. Tips in the app are processed by Apple (App Store) or Google (Google Play), and support payments made from this website are processed by Stripe. Payment details are handled by those providers under their own privacy policies and are never seen or stored by us. A tip unlocks nothing, does not create an account and is not linked to your exploration data.

13. Deep Links

WAU supports sharing location links. When someone opens one, it directs them to the app with the coordinates the link carries. No user data is collected through this mechanism.

14. Permissions Explained

Location (foreground): Required to show your position and record exploration while the app is open.
Location (background): Optional. Allows WAU to continue recording your exploration when the app is in the background (e.g., while cycling or driving with the screen off).
Motion sensors: Used to detect movement and optimize GPS tracking for battery efficiency.
Camera: Optional. Used to scan QR codes shared by friends and to take photos of your saved places. WAU does not record video or audio.
Photo library: Optional. Used only when you pick an existing photo to attach to a saved place. WAU does not read or index your library.
Notifications: Optional. Used only for team notifications, which you turn on yourself (section 7).

You can revoke any permission at any time through your device's Settings. Revoking location access will prevent the app from recording new exploration data but will not delete existing data.

15. Data Deletion

Data on your device:

To delete everything: Uninstall the app. This removes the local database, place photos and all stored exploration data.
To delete specific data: Use the app's built-in track, place and photo management to remove individual items.

Places you published: Because public places are stored anonymously, we cannot look up "your" submissions. To have one removed, use the report option on that place's detail sheet in the app, or email us with enough detail to identify the place. A moderator reviews and actions removal requests. Removed places are tombstoned so they do not reappear.

16. Children's Privacy

WAU does not knowingly collect personal information from anyone, including children under 13. The app requires no account and collects no identity data. Public place submissions are reviewed by a moderator before publication.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the app after changes constitutes acceptance of the updated policy.

18. Contact

If you have any questions or concerns about this Privacy Policy, please contact us:

Email: appz @ getwau .app
Company: Rw-Estilo OÜ, Tallinn, Estonia
Website: https://getwau.app