Privacy

Last updated 3 October 2026. This is for Waybook at mywaybook.app.

Waybook is a shared trip notebook. You and the people you invite keep days, stays, bookings, and notes in one place. This page is what we actually do, not a store listing.

Google sign-in

If you tap Continue with Google, Google sends us your email, name, and profile photo. We use those to create your account and show who is on a trip. We do not read your Gmail, Drive, Calendar, or other Google products. We do not sell that information.

Email and password

If you create an account with email and password, we store the email and a hashed password, then send a letter to that inbox. Until you tap Confirm email, that address cannot open the notebook. Prefer Google sign-in if you can.

What’s in the notebook

You (and anyone you invite) may add places, times, notes, confirmation codes, photos, packing lists, and expenses. That content lives in our database so the people on that trip can see it. People who are not on the trip cannot.

A session cookie keeps you signed in. Mapping and weather services receive place names and pins so we can show maps, photos, walk and drive times, and a forecast. Suggestions, import, voice notes, and receipt reading send xAI what they need: trip details you already saved, files or text you paste, a voice recording to turn into words, or a receipt photo to read. For each of those requests we keep a short usage record (which feature, which trip, how much it used) for 180 days; not what was sent or answered.

So the app opens at once, your browser keeps a copy of what it last showed you (your trips, packing lists, expenses and notes; not photos, receipts, invite links, booking codes, ticket numbers or forwarded letters) for up to a week. Signing out removes it. The app also tells our server how long its screens take to show: the screen, the time, and nothing about you or your trips.

Letters you forward

If you forward a booking to confirm@mywaybook.app, we accept it only from the address on your account, and we check the letter’s sender signatures (DKIM and DMARC). If we can’t verify it, we keep the text only, not its attachments, and it waits in Inbox until you say it’s yours. While a plan is paused, new letters aren’t accepted. Nothing is added to a trip until you tap Add to trip, we never auto-add cards.

Invites by email

If you invite someone by email, we send them one letter with a link to the trip, your name and the trip’s name. Replies go to your email address, so they’ll see it. We keep their address with the invite so the Share sheet can say who it went to, and remove it once the invite is used or cancelled, or within a day of it expiring (after 7 days). We don’t add them to any list or write to them again.

Payments

Subscribing opens Stripe Checkout, so Stripe receives your email address and card then. We keep your Stripe customer and subscription ids, the plan’s status and dates, and a record of the renewal terms shown when you subscribed.

Who we share with

• People you invite onto a trip, for that trip only.
• The services that run Waybook for us, only for what each does: Vercel (hosting), Neon (database), Google (sign-in, maps, places, weather, walk and drive times, and the site’s fonts), xAI (reading confirmations and suggestions), Resend (sending and receiving email), and Stripe (payments).
• Public map and photo services receive place and destination names only: OpenStreetMap (Nominatim), Photon, Wikipedia, Wikidata and Wikimedia Commons, Openverse, and Unsplash (some cover photos load from it in your browser). Wikimedia Commons also receives a destination’s map coordinates to find cover photos near it. OpenStreetMap’s map tiles load in your browser and receive the part of the map you’re looking at. Icon services (Google, DuckDuckGo, Aviasales, Kiwi.com) receive a website address or an airline code to show a small logo.
• No ads. We don’t sell your information.

We use Vercel Web Analytics (cookieless, aggregate page views of non-identifying paths). Invite codes, trip ids, and reset or cancel tokens are left out.

How long we keep it

Account and trip data stay until you delete the account, or we delete a trip at the owner’s request. Leaving a trip removes your access. What you already added stays for the people still on it. A memory on a trip that remains stays as the words on the card. Deleting your account removes notebooks you own. Notebooks someone invited you onto stay; you leave them. It also cancels your subscription and deletes your Stripe customer; if Stripe can’t be reached, we finish that by hand. Stripe keeps its record of past invoices and payments.

When a limit stops something you asked for (for example, too many searches in a few minutes, or too many invites to one address), we count it: which limit, which day, and a scrambled form of the account or email address it applied to, which can’t be turned back into either. We keep those counts for 60 days, to know when a limit needs raising.

A forwarded letter’s text and attachments are deleted from Waybook once you add it to a trip or discard it, and the rest of its record 30 days after it arrived. A letter you haven’t added or discarded stays until you do, or until you delete your account. For a letter we couldn’t accept, we keep the sender’s address and the reason for 30 days. Resend, which receives the mail, keeps its own copy under its own rules. Each trip owner has 300 MB for files, photos, and letters.

Your data rights (California residents)

If you live in California, you can ask for a copy of the personal data Waybook holds about you, and ask us to delete it.

• To delete it: use Account → Delete account in the app, or email support@mywaybook.app.
• To get a copy: email support@mywaybook.app from the address on your account, with the subject “Data access request”.

We answer within 45 days.

Children

Waybook is not for children under 13.

Questions

Write to support@mywaybook.app. That address is read by the people who run Waybook.