Trust & data practices

What we never collect

• No accounts, no names. Visitors use a pass without signing up for anything. Identity is a random device identifier that says nothing about who you are.
• No location history. When a visitor checks in, their coordinates are used once, on the server, to confirm they're near the stop — then discarded. The stored record is: which place, when, verified yes/no. Where the person was standing is never written to our database. (We removed all historical coordinates in June 2026 and the code no longer stores them.)
• No payment data from visitors. Visitors never pay us anything. Our own SaaS billing runs through Stripe; card numbers never touch our systems.
• No advertising trackers, no data sales. Nothing is sold, shared for advertising, or fed to data brokers. Ever.

The one moment we ask for anything: claiming a reward

Browsing is anonymous. Checking in is anonymous. The only time WayPoints asks for an email address is when a visitor has earned a reward and wants the redemption code — and the exchange is stated plainly before they type anything.

• Who gets the address: WayPoints (to deliver the code) and the one named business honoring the reward. Nobody else.
• Sponsor cities and organizations get counts, never addresses. A public body holding tourist email lists invites records-request exposure nobody wants — so the reporting they receive is aggregate: passes, check-ins, redemptions.
• Marketing is a separate, unticked box. Receiving your code never signs you up for anything. If a visitor also opts into hearing from the business, that consent is recorded with the exact wording version they saw.
• Claiming requires being 16 or older.

How long we keep things

Retention windows are written policy, enforced by an automated monthly job whose runs are logged:

Deletion, on demand

Any visitor can delete everything about themselves, immediately, from inside the app — check-ins, saved trips, rewards, claims, share links, all of it. It's a genuine erasure in the GDPR Article 17 sense, not a deactivation. No form, no waiting period, no human in the loop. You can also email hello@mywaypoints.app and we'll do it for you.

Where data lives, and how it's protected

• Database: managed PostgreSQL on Render, hosted in Ohio, USA. Per Render's published documentation, databases are encrypted at rest with AES-256 — including all backups — and external connections are TLS-encrypted.
• Backups: platform point-in-time recovery, plus weekly encrypted backups to storage under our own control — and every single backup run verifies itself by downloading the copy back, decrypting it, and confirming it's restorable. Data is encrypted on our side before it ever leaves for storage. Most recent full application-level restore test: July 26, 2026 (the app booted against the restored copy and served correctly).
• Accessibility: the visitor app scores 100 on automated WCAG accessibility audits across every page (Lighthouse, measured on production July 2026); a manual assistive-technology audit is scheduled ahead of the first city launch.

Who else touches the data (subprocessors)

What we don't have

We hold no SOC 2 attestation — that's an enterprise audit that costs more than a small-town pilot, and we'd rather say so than imply otherwise. What we offer instead is this page: an architecture that barely collects anything, documented honestly, with the receipts available on request. If a procurement process requires a formal attestation, talk to us and we'll scope it against the deal.