Privacy Policy

WanderCrew is operated by Fisherbird LLC ("Fisherbird", "we", "us", or "our"). This Privacy Policy explains what personal information we collect when you use WanderCrew (the "Service") — through our iOS app, Android app, web app, or marketing website — how we use it, who we share it with, how long we keep it, and the rights you have over it.

By using the Service you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

1. Who we are and how to reach us

The data controller for personal information processed through the Service is Fisherbird LLC. You can reach our privacy team at admins@wandercrewapp.com.

We have not appointed a statutory Data Protection Officer because we are not required to under GDPR Article 37, but the privacy mailbox above is monitored and we respond to rights requests within the timelines described in Section 9.

2. Information we collect

We collect personal information in three ways: you give it to us, it is generated by your use of the Service, and a small amount is generated automatically when your device connects to our servers.

For California residents, this Section together with Section 3 ("How we use personal information") and Section 5 ("Disclosure of personal information") constitutes our Notice at Collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

2.1 Information you provide

• Account information — email address, password (stored only as a hash managed by Amazon Cognito; we never see the plaintext), display name, and chosen handle.
• Profile information — optional avatar, bio, and pronouns.
• Support correspondence — messages you send us by email and any attachments you choose to include.
• Waitlist submissions — if you join the waitlist on our marketing site, your email address, any optional survey responses, and — only if you tick the optional box — your consent to receive occasional marketing emails from Fisherbird LLC about our other products. This consent is separate from the invitation email the waitlist itself sends you, and you can withdraw it at any time using the unsubscribe link in those emails or by emailing us.

2.2 Information generated by your use of the Service

• Trips — for signed-in users, trip itineraries, crew membership and trip change history.
• Crew plan subscription — if you buy the Crew plan, the plan you chose (yearly or monthly), the store you bought it in, whether it renews, when the current period ends, and whether a payment has failed. We receive this from RevenueCat (see Section 5.1). Apple or Google takes the payment; we never receive your payment card details.

2.3 Information collected automatically

• Operational metadata — IP address and basic request metadata (user-agent, timestamp, route) are processed transiently by our hosting providers for rate-limiting, abuse prevention, and to deliver the response. We do not retain raw access logs containing IP addresses for longer than 14 days.
• Local storage on your device — we store an authentication token (Amazon Cognito refresh token) in your device's secure storage (iOS Keychain, Android Keystore, or the browser's localStorage) so that you stay signed in. We do not use third-party advertising cookies or cross-site tracking pixels.
• Crash and error diagnostics — when the app hits an unexpected error or crash, a diagnostic report is sent to our error-monitoring provider so we can fix it. It contains the error message and stack trace, the app version, your device or browser type and operating-system version, and the screen or route where the error happened. We configure this provider not to collect your IP address and do not attach your account identity to these reports. See the Sentry entry in Section 5.1.

We do not knowingly collect precise geolocation data, contacts, or microphone audio. We do not collect biometric data; see Section 2.4 below for the specific way biometric unlock works on your device.

2.4 Biometric authentication

WanderCrew offers an optional biometric-unlock feature on devices that have Face ID, Touch ID, fingerprint, or another on-device biometric method enrolled with the operating system. You can turn this on or off at any time from Account in the app; it is off by default.

When the feature is enabled, biometric verification is performed entirely by your device's operating system — Apple's Local Authentication framework on iOS, and the Android BiometricPrompt API on Android. We receive only a yes/no result from the operating system, indicating whether verification succeeded.

We do not collect, receive, transmit, or store any biometric identifier or biometric information about you. Specifically, we do not have access to any fingerprint scan, facial geometry, voiceprint, retina or iris scan, hand-geometry scan, or any other unique biological pattern or characteristic. No biometric template ever leaves your device. Nothing biometric is transmitted to our servers, to Amazon Web Services, or to any third party.

The only thing the app stores in connection with this feature is a boolean preference, kept in your device's secure storage, that records whether you opted in. Disabling the feature deletes that preference; deleting the app removes it along with everything else the app stored locally.

Because no biometric identifier or biometric information ever reaches us, we do not engage in conduct regulated by the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, the Washington Biometric Privacy Act, or the biometric provisions of comprehensive state privacy laws — all biometric handling occurs in your device's secure enclave under the operating system's policies, not ours.

3. How we use personal information

We use personal information to:

• Operate, maintain, and improve the Service.
• Authenticate you and keep your account secure.
• Detect, investigate, and prevent fraudulent, abusive, or unlawful activity, and enforce our Terms of Service.
• Send transactional communications such as account verification, password reset, security alerts, policy updates, and confirmations of actions you took (for example, account deletion).
• Respond to your support requests, rights requests, and other correspondence.
• Comply with our legal obligations, including responding to lawful requests by public authorities and preserving evidence where required.

We do not use your personal information to serve third-party advertising, to build cross-site advertising profiles, or to sell it to data brokers.

4. Legal bases for processing (UK and EEA users)

If you are in the United Kingdom, the European Economic Area, or Switzerland, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Performance of a contract (Article 6(1)(b)) — to provide the core Service to you under our Terms of Service. We cannot operate your account without processing the data described in Section 2.1 and Section 2.2.
• Legitimate interests (Article 6(1)(f)) — to keep the Service secure, prevent abuse, debug operational problems, and protect our rights. Where we rely on legitimate interests, we have weighed those against your privacy interests; you can object at any time (see Section 9).
• Consent (Article 6(1)(a)) — where required by law for cookies and similar technologies that are not strictly necessary, and for any optional marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation (Article 6(1)(c)) — when we must process data to comply with a legal requirement, such as responding to a valid court order.

We do not engage in solely automated decision-making with legal or similarly significant effects on you (Article 22).

5. Disclosure of personal information

We disclose personal information only in the following circumstances:

5.1 Service providers (sub-processors)

We use a small number of vendors to operate the Service. They process personal information on our behalf under written agreements that bind them to confidentiality and security obligations.

We will publish an up-to-date list of material sub-processors at wandercrewapp.com/subprocessors before any general public launch and will give at least 30 days' notice of changes that materially affect the categories of data processed.

• Amazon Web Services, Inc. — application hosting, database (DynamoDB), object storage (S3), authentication (Cognito), email delivery (Simple Email Service), and serverless compute (Lambda). Processing region: us-east-2 (Ohio, United States).
• 650 Industries, Inc. (d/b/a Expo) — push-notification delivery. When we send you a notification (such as an invitation to a trip), we pass a device push token and the notification's contents to Expo's push service, which relays it to Apple (APNs) or Google (FCM).
• Cloudflare, Inc. — Cloudflare Turnstile, an anti-bot challenge used on our waitlist form.
• Functional Software, Inc. (d/b/a Sentry) — application error and crash monitoring for our web and mobile apps. When the app encounters an error, a diagnostic report (error message, stack trace, app version, device/browser type, and the URL of the screen where it happened) is sent to Sentry so we can fix it. We configure Sentry not to collect your IP address and do not attach your account identity to these reports.
• RevenueCat, Inc. — subscription management for the Crew plan in our iOS and Android apps. If the Crew plan is offered to you in our apps, RevenueCat receives your WanderCrew account identifier, your store country, basic device and app details (such as app version and operating system) and your IP address, and, if you buy the Crew plan, your purchase and subscription records from Apple or Google (such as the plan, price, and renewal dates), and tells us whether your plan is active. We do not send RevenueCat your trips, and it never receives your payment card details.

5.2 Publicly visible content

Some information you provide is, by design, visible to others:

• Your handle, display name, avatar, and bio are visible to anyone who views your profile.

5.3 Legal disclosures

We may disclose personal information if we believe in good faith that disclosure is necessary to (a) comply with a subpoena, court order, or other valid legal process; (b) protect the safety of any person; (c) investigate, prevent, or respond to suspected fraud, security, or technical issues; or (d) enforce our Terms of Service.

5.4 Business transfers

If Fisherbird is acquired, merges with another entity, or sells substantially all of its assets, your information may be transferred as part of the transaction. We will notify you (by email and an in-app notice) before your information becomes subject to a different privacy policy.

We do not sell personal information for monetary or other valuable consideration, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

6. International data transfers

We are based in the United States and our servers are located in the United States (AWS us-east-2). If you access the Service from outside the United States, your personal information will be transferred to, stored, and processed in the United States. The sub-processors listed in Section 5.1 (including our error-monitoring provider, Sentry) are likewise located in the United States.

For transfers from the United Kingdom, the European Economic Area, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for transfers from the UK, the UK International Data Transfer Addendum to those clauses. Where required, we conduct transfer impact assessments and apply supplementary safeguards (encryption in transit and at rest, restricted access, no government data-sharing programs that we are aware of). You can request a copy of the relevant safeguards by emailing the privacy contact in Section 1.

7. Retention

We keep personal information only for as long as we need it for the purposes described in this Policy or as required by law.

• Account data — kept until you delete your account.
• Crew plan subscription status — kept with your account until you delete it. Apple, Google and RevenueCat keep their own purchase records under their own policies.
• Database point-in-time recovery backups — 35 days on a rolling basis.
• Access logs containing IP addresses — no more than 14 days.
• Crash and error diagnostic reports — retained by our error-monitoring provider for up to 90 days, then automatically deleted.
• Support correspondence — up to two years from the date of the last message, then deleted.
• Waitlist submissions — until you ask us to remove them, or for two years from submission if the public launch has not occurred by then.
• Publicly posted content on a deleted account — the user identifier is replaced with deleted_user so the content is no longer linked to you.

8. Security

We protect personal information with technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2 or higher) for all traffic between your device and our servers, and between our servers and our service providers.
• Encryption at rest for the database and object storage.
• Strict access controls. Only a small number of administrators have production access, gated by multi-factor authentication.
• Separation of password hashing (Cognito) from application logic.
• Continuous monitoring, automated patching of dependencies, and a dependency-scanning pipeline in continuous integration.

No service can guarantee perfect security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in line with Articles 33 and 34 of the GDPR.

9. Your rights

Subject to applicable law, you have the following rights over the personal information we hold about you.

9.1 Rights available to everyone

• Access — request a copy of the personal information we hold about you.
• Rectification — correct inaccurate information. Most fields are editable directly in the app.
• Erasure — delete your account and the personal information associated with it. You can start the process in the app at Account → Data → Delete account. Some information may be retained in backups for up to 35 days, in access logs for up to 14 days, and as pseudonymized public content as described in Section 7.
• Portability — receive a copy of your data in a structured, machine-readable format. Email the privacy contact and we will provide an export within 30 days.
• Objection — object to processing based on our legitimate interests.
• Restriction — ask us to restrict processing while we consider an objection or rectification request.
• Withdraw consent — where we rely on consent, withdraw it at any time.

9.2 California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights above and the additional right to know the categories of personal information we collect, the categories of sources, the business purposes for which we collect or share it, and the categories of third parties with which we share it (all described in this Policy).

We do not sell personal information and we do not share personal information for cross-context behavioral advertising. Because we do not sell or share in that sense, we are not required to offer a "Do Not Sell or Share My Personal Information" link, and we have no financial incentive program to offer.

Sensitive personal information. The only category of "sensitive personal information" as defined by Cal. Civ. Code § 1798.140(ae) that we collect is your account log-in credentials (your email address together with your hashed password). We use this category only for the purposes that the CCPA exempts from the right to limit — namely, performing the services you reasonably expect, verifying or maintaining the quality or safety of the Service, and detecting, preventing, or responding to security incidents (Cal. Civ. Code § 1798.121(a) and the corresponding regulations). We do not use sensitive personal information to infer characteristics about you. Because we use it solely for those exempt purposes, the right to limit the use of sensitive personal information does not apply.

You may exercise your rights by emailing the privacy contact in Section 1. You may use an authorized agent to make a request; we will verify the agent's authority and your identity before responding. We will not discriminate against you for exercising your rights.

9.3 Other jurisdictions

If you live in Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, or another US state with a comprehensive privacy law, you have substantially the same rights described above, exercised in the same way.

If you live in Canada, Australia, New Zealand, the United Kingdom, the European Economic Area, or Switzerland, the rights described in Section 9.1 apply to you under the law of your jurisdiction.

9.4 How to exercise your rights, and our timelines

Email admins@wandercrewapp.com. We will respond within 30 days for GDPR/UK GDPR requests and within 45 days for CCPA requests, with one extension where the request is complex. We may need to verify your identity before acting.

9.5 Right to complain

If you believe we have not handled your personal information properly, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with your local data protection supervisory authority — for example, the UK Information Commissioner's Office or your country's national data protection authority in the EEA.

10. Children

WanderCrew is not directed at children under 13, and we do not knowingly collect personal information from children under 13 — within the meaning of the US Children's Online Privacy Protection Act or otherwise. Where local law sets a higher minimum age for using the Service (see Section 1 of our Terms of Service), we do not knowingly collect personal information from children under that higher age. If you become aware that a child below an applicable minimum age has provided personal information to us, please contact the privacy address and we will delete the information promptly.

11. Cookies and similar technologies

The web app uses localStorage to store an authentication token and a small number of UI preferences, and a session-scoped CSRF token cookie where required. These are strictly necessary to operate the Service and do not require consent under the EU ePrivacy Directive. The marketing site uses Cloudflare Turnstile, which sets a short-lived first-party cookie strictly necessary to perform the anti-bot challenge.

We do not use analytics, advertising, or social-media-tracking cookies.

Opt-out preference signals (Global Privacy Control)

A growing number of US state privacy laws require businesses to honor universal opt-out preference signals — most commonly the Global Privacy Control (GPC) browser signal — as a valid request to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Because we do not sell personal information and do not share personal information for cross-context behavioral advertising in the first place, a GPC signal does not change how we process your data. If we ever begin practices that would qualify as "sale" or "sharing" under those laws, we will treat a GPC signal from your browser as a valid opt-out without requiring any further action from you, and we will update this Policy first.

We do not respond to legacy "Do Not Track" signals because there is no industry consensus on what they require, but our practices already meet the common intent: we do not engage in cross-site tracking.

12. Third-party links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy notices before providing them with any personal information.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will:

• Update the Effective date at the top of this document;
• Increment the version identifier; and
• Notify you by email and in-app notice at least 30 days before the changes take effect.

Continued use of the Service after the new effective date constitutes acceptance of the updated Policy. If you do not agree, you may delete your account before the new date.

14. Contact

For any question, request, or concern about this Policy or our handling of personal information, contact:

admins@wandercrewapp.com