Privacy Policy

This Privacy Policy explains how WayTogether ("WayTogether", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use the WayTogether mobile application and any related services (together, the "Service").

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection law. By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy.

Chris Moll, an individual based in the province of Utrecht, the Netherlands, operating WayTogether as a sole individual (not yet registered with the Dutch Chamber of Commerce (KVK) — this notice will be updated with a KVK registration number once WayTogether becomes a registered business) ("WayTogether", "we", "us").

You can reach us for any privacy-related question or request at support@waytogetherapp.com.

We collect the following categories of personal data, all of which you provide directly when using the Service:

• Account data: your email address, and authentication data needed to sign you in.
• Profile data: name, age, gender, nationality, a short bio, and the profile photos you upload.
• Travel DNA data: your answers to our travel-style questionnaire (pace, budget preference, social/quiet preference, chronotype, and similar preference signals), used to compute compatibility with other users.
• Trip data: destinations, travel dates or flexible periods, budget range, accommodation and travel-company preferences, and other details you provide when creating a trip.
• Interaction data: your swipes, matches, messages you send and receive, read receipts, blocks, and any reports you submit about other users.
• Device and push notification data: an Expo push token tied to your device, collected only if you grant notification permission, used solely to deliver match and message notifications to you.
• Technical and diagnostic data: crash reports, error logs, and basic device/app metadata collected automatically through our error-monitoring provider (see Section 6) to help us find and fix bugs.

We use the personal data described above for the following purposes:

• To create and administer your account and authenticate you when you sign in.
• To display your profile and trip to other users so that compatible travel buddies can find and match with each other.
• To compute Travel DNA compatibility and rank or filter potential matches accordingly.
• To enable messaging between matched users.
• To send you push notifications about new matches or messages, where you have granted permission.
• To detect, investigate, and prevent fraud, abuse, harassment, and violations of our Terms of Service, including processing reports and blocks submitted by users.
• To diagnose and fix technical problems through crash and error monitoring.
• To comply with our legal obligations and to respond to lawful requests from public authorities.

Where the GDPR applies, we rely on the following legal bases under Article 6(1) GDPR:

• Performance of a contract — processing your account, profile, Travel DNA, trip, and matching data is necessary to provide the core matching and messaging functionality you sign up for.
• Consent — sending push notifications is based on the permission you explicitly grant on your device, which you may withdraw at any time through your device settings.
• Legitimate interests — investigating reports, preventing abuse, and maintaining the security and stability of the Service, balanced against your rights and freedoms.
• Legal obligation — where we are required to retain or disclose data to comply with applicable law.

We do not sell your personal data. We share personal data only with the following categories of recipients, each acting as our data processor (sub-processor) under a data processing agreement, or as otherwise described below:

• Supabase, Inc. — hosts our database and photo storage. Data is stored in the eu-north-1 (Stockholm, Sweden) AWS region.
• Expo (650 Industries, Inc.) — operates the push notification delivery service used to send match/message notifications to your device.
• Sentry (Functional Software, Inc.) — provides crash and error monitoring; this may involve limited technical/diagnostic data being processed outside the EEA, subject to Sentry's own data protection safeguards (e.g. EU Standard Contractual Clauses).
• Other users of the Service — your profile, trip details, and any messages you send are, by the nature of the Service, visible to the users you match or interact with.
• Law enforcement or regulators, where required by law, to protect our rights, or to protect the safety of our users or the public.

Some of our sub-processors (see Section 6) may process limited data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses, to ensure your data remains protected.

We retain your personal data for as long as your account remains active. If you delete your account (via Settings → Delete Account, or by contacting us), your profile, photos, Travel DNA answers, trips, swipes, matches, and messages are deleted promptly from our production database.

Your underlying login/authentication record (your email address) is retained separately until you request its full removal by contacting support@waytogetherapp.com, so that you are able to sign back in without immediately losing continuity if account deletion was unintended.

We may retain limited data for a longer period where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to request deletion of your personal data (also available directly in-app, see Section 8).
• Right to restrict processing — to request that we limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object — to object to processing based on our legitimate interests.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal, e.g. by disabling notifications in your device settings.
• Right to lodge a complaint — with your local data protection supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens) if you believe our processing of your data infringes applicable law.

The Service is intended only for users aged 18 and older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a user under 18, we will delete it promptly. Please contact us at support@waytogetherapp.com if you believe a minor has provided us with personal data.

We apply reasonable technical and organizational measures to protect your personal data, including access controls (Row Level Security policies restricting each user's database access to their own and their matches' data) and encrypted transport (HTTPS/TLS). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

This website uses browser local storage only to remember your selected display language. We do not use tracking or advertising cookies on this website.

We may update this Privacy Policy from time to time as the Service evolves or as required by law. We will update the "last updated" date below and, where changes are material, provide additional notice (e.g. in-app).

Last updated: August 28, 2026

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us at support@waytogetherapp.com.