Privacy Policy

1. What We Collect

We collect account information (your name, email, and avatar) through our authentication provider, Clerk. We collect the photos and videos you capture and upload into a happening, along with metadata about those captures (capture time, optional location if you enable it, device model). We collect the invite codes you create or use, and basic device metadata (app version, OS version, language) for diagnostics.

We do not collect contacts, browsing history, or advertising identifiers. We do not use third-party analytics that follow you across other apps.

2. How We Use It

We use the data we collect to operate the Service: authenticate you, store and display your captures within happenings, deliver notifications you have opted into (such as "your happening starts in 30 minutes"), and improve reliability and performance. We do not use your media to train third-party AI models and we do not sell your data.

3. Storage & Retention

Captures are stored in S3-compatible object storage (currently RustFS) using presigned upload URLs that expire within minutes. Your account data is stored in our PostgreSQL database. Happenings are retained for as long as the host keeps them active, plus a grace period after the host ends the event so attendees can download captures. You can request earlier deletion by emailing us.

4. Sharing & Third Parties

We share data with a small number of subprocessors required to run the Service: Clerk (authentication), an object-storage provider (media hosting), an email delivery provider (transactional email), and push-notification providers (Apple Push Notification service and Firebase Cloud Messaging). A current list of subprocessors is available on request.

Captures are visible to other members of the happening you joined. We do not share your data with advertising networks, data brokers, or social platforms.

5. AI Processing

The AI-edited recap feature processes captures from a happening to generate a short video. Processing happens on our infrastructure, scoped to the happening whose host initiated the recap. Generated outputs are visible only to members of that happening and to the host. We do not use your media to train any model shared with other accounts or customers.

6. Your Rights

You can access, correct, or delete your account data at any time from the app's profile settings. You can request export of your captures or removal of specific captures from a happening by contacting us at hello@waycap.app. Depending on your jurisdiction, you may also have the right to object to processing, request portability, or lodge a complaint with a data-protection authority.

7. Children's Privacy

WayCap is not directed at children under 13 (or the age of digital consent in your country). We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us and we will delete the account and associated data.

8. International Transfers

WayCap's infrastructure may process your data in countries other than your country of residence. Where required, we rely on standard contractual clauses or equivalent safeguards to protect your data in transit and at rest.

9. Security

We use industry-standard safeguards: HTTPS in transit, server-side encryption at rest in object storage, signed and short-lived upload URLs, and rate-limiting on public endpoints. No system is perfectly secure — if you discover a vulnerability, please report it to security@waycap.app.

10. Changes to this Policy

We may update this policy from time to time. If a change is material, we will notify you by email or in-app notice. The "Last updated" date at the top of this page will reflect the current version.

11. Contact

Questions about your privacy? Email hello@waycap.app.