Get the App

Your runs, your account

Privacy Policy

Effective

This policy explains exactly what Waybound keeps, where it lives, who helps us run it, and how to delete it.

01The short version

  • Your runs are kept in your Waybound account. The game runs on our servers so your progress is safe and follows you to a new phone. Your account starts without any sign-up; link Sign in with Apple to keep it if you reinstall.
  • No ads, and we do not sell your data. We use first-party analytics and crash reports to fix and improve Waybound. We never use your data for advertising, and we never share Apple Health data with analytics or anyone else.
  • You decide what leaves the game. A share link carries only the run or find you chose, with the start and end of your route trimmed away.
  • Deleting is simple. Delete account in Settings permanently deletes your account and everything in it from our servers.

02Who we are

Waybound is made by DesignX LLC (“we”, “us”), a company based in the United States. DesignX LLC is responsible for (the “controller” of) the personal information described in this policy. Our address is 4 S Preston St, Portsmouth, OH 45662. This policy covers the Waybound app for iPhone, its widgets and iMessage sticker pack, our servers, and this website, including the pages that open when someone shares a run or a find.

If you have a question about this policy or your data, email support@waybound.run.

03Information we keep

Waybound keeps the following in your account on our servers, and a working copy on your iPhone so the app opens quickly and works without signal.

Account
A random account id created the first time you open the app. If you link Sign in with Apple: the email address Apple gives us (which can be a private relay address you control) and, once, the name you choose to share. We never receive your Apple ID password.
Activities
For each run or walk: the GPS route (a series of locations with timestamps), distance, duration, pace, splits, elevation, best efforts, an estimated calorie count and, if you use one, heart-rate readings from your monitor. The name you give an activity, and where the run started, as a place name.
Apple Health workouts
Only if you turn on Apple Health in Settings: the running and walking workouts other apps and devices (such as Apple Watch, WHOOP or Oura) saved to Health this month, with their routes, distance, duration and energy. They are stored as activities in your account so they can move you along the map. See Apple Health.
Profile
Your display name, an optional short bio, and a body weight used to estimate calories. A profile photo, if you choose one, is stored with your account in private storage, so it follows you to a new iPhone and your friends can see it.
Setup answers
What you tell Waybound when you first open it: whether you run or walk, how many days a week you are active, your usual distance and what motivates you.
Game progress
Your monthly races, discoveries, Journal, XP, levels, goals, streaks and friends you add.
Settings
Units, display, sound and notification preferences, your maximum heart rate, and the time zone your phone reports, so daily goals and notifications follow your day.
Devices
For each phone you use: a random install id, the push token Apple issues for notifications, and the app version.
Subscriptions
If you subscribe: the product, its status and its renewal or expiry date, as Apple reports them to us. Apple handles payment; we never receive your card or billing details.

Your iPhone also keeps, only on the device: the identifier of the heart-rate monitor you paired, and a list of unlocked creatures shared with Waybound's own sticker pack and widgets.

04Permissions and how they are used

iOS asks for your permission before Waybound can use any of these. You can change your choices at any time in the iPhone Settings app.

Location
Used to show where you are on the Record tab, to measure distance and draw your route while you record a run or walk, and in the background during a recording so a run is not cut short when your screen is off. iOS shows a location indicator while this happens. Waybound does not use your location in the background when you are not recording.
Apple Health
Read-only access to workouts, workout routes and walking and running distance, used only to import running and walking workouts into the race. Waybound does not write to Apple Health.
Notifications
Used for at most one notification a day, never at night: a new race starting, its last days, a goal still open, a streak at risk, or a watch workout reaching the map. Each kind can be turned off in Settings.
Bluetooth
Used to connect to a heart-rate monitor, such as a chest strap or armband, including in the background while you record. It is not used to find your location.
Photos
Used when you choose a profile picture, and when you ask Waybound to save a share image or flyover video to your library.

While you record, the run's distance, time and pace appear on your Lock Screen and in the Dynamic Island. Waybound does not ask for access to your camera, microphone or contacts, and does not use App Tracking Transparency because it does not track you.

05Apple Health

  • Waybound reads Apple Health only after you turn it on and allow it, and only running and walking workouts from the current month.
  • Imported workouts are used only to give you credit in the game: distance on the map, discoveries and goals. They are stored in your account with your other activities.
  • We never use Apple Health data for advertising or marketing, never sell it, never use it for analytics, and never share it with third parties, except the service providers that host your account on our behalf. It is never sent to our analytics or crash-reporting providers.
  • Turn it off at any time in Waybound's Settings, or in the Health app under Sharing › Apps. Deleting your account deletes the workouts we imported.

06Analytics and crash reports

To understand what works and to fix problems, the app sends us:

  • Product analytics (PostHog): which screens are opened and a short list of events, such as finishing onboarding, starting or finishing a run, seeing a reward, sharing, and opening a notification, with your account id, device model, iOS and app version. Routes, locations, heart rate and Apple Health data are never included. Session recording is off.
  • Crash and error reports (Sentry): what went wrong in the app, with your account id, device model, iOS and app version. Names, emails and locations are not included.

These are tied to a random account id, not your name, and are kept for up to 12 months. They are not used for advertising or to track you across other apps or websites.

07Service providers

We use these providers to run Waybound. They process information on our behalf, under contracts that limit them to doing so.

Supabase
Hosts your account, game data and activities, and runs the game's server code, in the United States. See the Supabase Privacy Policy.
PostHog
Product analytics, as described above, in the United States. See the PostHog Privacy Policy.
Sentry
Crash and error reports, as described above, in the United States. See the Sentry Privacy Policy.
Expo
Delivers notifications to Apple's push service and delivers app updates; it receives your push token or device and app version to do so. See the Expo Privacy Policy.
Superwall
Shows subscription offers in the app and passes purchases to Apple; it receives your account id, device and app details, and which offers you see or buy. See the Superwall Privacy Policy.
OpenFreeMap
Serves the map tiles the app draws its maps from. To show a map, your device requests the tiles for the area on screen, which on the Record tab and while you record is the area around your current location. OpenFreeMap receives your IP address and the tiles requested, and no account or identifier of ours. See the OpenFreeMap website.
Apple
Apple distributes the app, handles Sign in with Apple, payments and subscriptions, and delivers notifications. See Apple's Privacy Policy.
Email
If you email us, the message is stored with our email provider, which processes it on our behalf.

08When you share

Sharing is always your choice, one run or one find at a time.

  • Share links. A link to a run carries its name, the exact start date and time, distance, duration, elevation gain, your average heart rate if the run recorded one, your units, the place name shown on the activity if it has one, and a simplified route. The first and last 200 m of the route are removed so the link does not point to where you started or finished, and routes shorter than 600 m are not included at all. A link to a find carries the creature, its rarity and whether it is Fabled, when you found it, and the world and terrain it was found in. Both carry only the first word of your display name.
  • Heart rate. Heart rate is health information. If a run recorded heart rate, its average is part of that run's link, so by sharing the link you choose to make that figure visible to anyone who has it. When the link is opened, our host processes it only to draw the page, and request logs that contain it are deleted within 30 days. If you would rather not share it, share an image instead of a link. We cannot recall links already sent.
  • Precise location. A run link contains a simplified version of your route, which is precise location information. It is included only when you choose to share that run as a link, and that choice is your consent to include it.
  • Think before you share a route. Even with the ends trimmed, a route, its place name and start time can suggest where you regularly run. Take care when a run starts near your home.
  • The data is inside the link. It is encoded into the web address itself, so we cannot edit or withdraw a link after you send it. Anyone who has the link can open it.
  • Friends. If you add a friend, they can see your profile as you see it, without the edit controls: your profile photo, display name and line, crest, level, lifetime totals (distance, time, discoveries, expeditions), streak, best efforts with the day each was set, your rarest find and your Journal, and how far you are in this month's race. Your routes, individual runs, where you ran and your heart rate are never shown to friends. Remove a friend at any time from their profile.
  • Images, videos and stickers. Share images and flyover videos are made on your device and go wherever you send them through the iOS share sheet, or into your Photos library if you save them.

09This website

This website is hosted by Vercel. Like any web host, Vercel receives standard request information when you visit, including your IP address, browser type and the address requested, which for a share link includes the shared data. Nothing is saved from it beyond the host's request logs, which are used to deliver and secure the site and are kept for no more than 30 days.

The site sets no cookies and runs no analytics or advertising scripts. A shared run page loads its interactive map from OpenFreeMap (map data © OpenStreetMap contributors), terrain from the AWS Open Data terrain tiles, and the MapLibre map library from jsDelivr. Those services receive your IP address and the map area being viewed.

10Consumer health data

This section is our consumer health data privacy policy for the purposes of laws such as Washington's My Health My Data Act, Nevada's SB 370 and Connecticut's consumer health data provisions.

  • What it is. Heart-rate readings from a monitor you pair and figures derived from them (average heart rate, heart-rate zones, estimated calories), and workouts you import from Apple Health.
  • Why we collect it. To record your runs, show your heart-rate zones, and give imported workouts credit in the game.
  • Where it lives. In your Waybound account on our servers (Supabase, United States) and on your iPhone.
  • Who receives it. Only Supabase, which hosts it for us, and, for heart rate in a share link you send, our website host Vercel. We do not sell it, use it for advertising, or send it to analytics or crash reporting.
  • Your choices. Delete any activity in the app, turn off Apple Health in Settings, or delete your account to delete all of it. To ask what we hold, email support@waybound.run. If we decline your request, you may appeal as described in Your rights.

11How information is used

We use your information to run Waybound for you: recording and showing your activities, moving you along the race, choosing discoveries, tracking goals, streaks and progress, keeping your account and subscription, sending the notifications you allow, and making the things you choose to share. We use analytics and crash reports to fix problems and improve the game.

We do not use your information for advertising, we do not track you across other companies' apps or websites, and we do not sell or share personal information, or use sensitive personal information to infer characteristics about you, as those terms are defined under California law. Waybound makes no automated decisions about you that have legal or similarly significant effects; the game's server decides rewards by its published rules.

We may disclose information if the law requires it, to protect the rights, safety or security of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.

12If you contact us

If you email us, we receive your email address and whatever you include in your message. We use it only to reply and to help you, and we delete the conversation when it is no longer needed for that, normally within 24 months of our last reply.

13Retention and deletion

We keep your account and game data for as long as you have an account. You can delete a single activity from its detail screen, or delete everything:

  1. Open Waybound and go to the Profile tab.
  2. Tap the settings button in the top corner.
  3. Scroll to the bottom, tap Delete account and confirm.

This permanently deletes your account and everything in it from our servers, including activities, imported workouts, progress, your profile photo, friends, devices and settings. Backups of our database are overwritten within 30 days. Analytics and crash reports tied to your account id expire within 12 months, or sooner if you ask. Subscription records Apple sends us are kept as long as the law requires for tax and accounting. Deleting the app alone does not delete your account, so use Delete account first. An account that was never linked to Sign in with Apple can't be signed back into once the app is deleted; we delete such guest accounts after 12 months without any activity. There is more help on the Delete your data page.

Deleting your account does not cancel a subscription; manage or cancel it in your iPhone's Settings › Apple ID › Subscriptions.

14Your rights

Depending on where you live, you may have rights to access, correct, delete or port your personal information, to object to or restrict processing, and to complain to a data protection authority. You can see, change and delete most of your data directly in the app. For anything else, email support@waybound.run and we will respond within 30 days.

If you live in a US state with a consumer privacy law and we decline a request, you may appeal by replying to our answer with the word “Appeal”. We will respond within 45 days. If you disagree with the outcome, you may contact your state attorney general.

Where the EU or UK GDPR applies, DesignX LLC is the controller. We process your account, activities and game data to provide the service you asked for (contract, GDPR Article 6(1)(b)); analytics, crash reports, security logs and support email on the basis of our legitimate interests in running and improving Waybound (Article 6(1)(f)); and heart rate, Apple Health workouts and notifications on the basis of your consent (Articles 9(2)(a) and 6(1)(a)), which you can withdraw at any time in Settings without affecting what was done before.

Your route and other run details in a share link are processed on the basis of your consent, given when you choose to share a link.

15Children

Waybound is not directed to children under 13, or under the age of digital consent where they live (up to 16 in some countries of the European Economic Area), and we do not knowingly collect personal information from them. If you believe a child is using Waybound, contact us and we will delete their account.

16Security

Data travels between the app and our servers over encrypted connections and is encrypted at rest by our hosting provider. Each account can read and change only its own data, enforced by the database itself, and rewards are decided on our servers, not in the app. On your iPhone, the working copy is protected by your passcode and iOS data protection. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

17International transfers

DesignX LLC and our providers are based in the United States, where your information is stored. Where information is transferred out of the EEA or UK, we and our providers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

18Changes to this policy

If Waybound changes in a way that affects your privacy, we will update this policy and the date at the top before that version of the app is released, and for significant changes we will say so in the app and on this website.

19Contact

DesignX LLC
4 S Preston St, Portsmouth, OH 45662
Email: support@waybound.run