Wanderwalk privacy policy

Wanderwalk is an iOS walking audio-tour app for London, and a marketing website at https://wanderwalk.app. The app is available on the App Store.

Wanderwalk is operated by MT-DEVA LIMITED, a company registered in England and Wales (company number 15768175), with its registered office at 71-75 Shelton Street, London, England, WC2H 9JQ. In this policy "we", "us" and "our" mean that company. We are the data controller for the personal data described here, which means we decide what is collected and why, and we are responsible for looking after it.

This policy applies to:

• the Wanderwalk iOS app, and
• the wanderwalk.app marketing website.

If you only visit the website and never install the app, only the section on the marketing website and analytics applies to you.

Questions, or want to exercise a right? Email privacy@wanderwalk.app for anything privacy-related, or hello@wanderwalk.app for general queries.

We try to collect as little as possible, and to keep as much as we can on your own device. Here is the full picture.

Precise location (When-In-Use only). Wanderwalk uses your device's precise location to work out where you are as you walk, so it can trigger the right story at the right spot, roughly within 40 metres of a place with a story to tell. A few things matter here:

• We request location access When-In-Use only. We never ask for "Always" location.
• During an active walk, location can continue while the app is in the background or your screen is locked, so stories can still play with your phone in your pocket. iOS shows its location indicator while this is happening. Background location stops when you end the walk or after one hour of inactivity.
• This location work happens on your device. Your phone holds the map of stories and decides locally which one to play next. We do not send a stream of your movements to our servers or store a movement history.
• We do not sell your location or share precise location for advertising.

Account information. You can create an account using Sign in with Apple or Google Sign-In. When you do, we receive a basic identifier and, depending on what the provider and you choose to share, an email address and optional display name. We use these details to recognise your account across devices. With Sign in with Apple you may use Apple's private email relay, in which case we never see your real email address.

Subscription and purchase data. Wanderwalk+ is sold through Apple's In-App Purchase as a 3-Day Pass, a 7-Day Pass or an annual subscription. Existing monthly subscriptions can continue until the subscriber cancels. RevenueCat manages access for us. We receive purchase status, including whether access is active and when it renews or expires. We never see or store your card details because Apple handles payment.

Free access. Bow Street Police Museum plays in full from anywhere. Other stories have a 20-second preview. Your one-time 15-minute Wander trial starts when GPS triggers your first London story. We store the seconds used against your account so the same trial follows you across devices and survives a reinstall. We do not store a history of where you used it.

Suggested places. If you suggest a place, we receive its exact latitude and longitude, the place name you provide, any optional note and the version of the app you used. We also record our review status for the suggestion. It is linked to your user account while that account exists. If you delete your account, we remove that link but retain the anonymised suggestion as an editorial lead. Please do not put private personal data in the place name or note.

Technical and security data. When the app talks to our backend, for example to confirm your subscription, sync your account, or stream audio, our servers briefly process your device's IP address and basic request information so we can enforce fair-use rate limits, prevent fraud and abuse of our audio, and keep the service secure. The app also uses Apple's App Attest to confirm a request comes from a genuine, unmodified copy of Wanderwalk. These produce security signals, not advertising identifiers, and we do not use them to build a profile of you.

Crash and technical-fault reports. Sentry receives crash and technical fault reports by default so we can detect and fix problems that stop the app working properly. A report can include technical details about the app and device, a stack trace, the part of the app where the fault happened, recent diagnostic breadcrumbs naming app actions and, if you are signed in, your account identifier and current subscription tier. These reports do not include advertising identifiers. We do not send Sentry product-usage Logs.

Product analytics (on by default, you can turn it off). PostHog receives pseudonymous product-usage events unless you turn off Share analytics. These describe how the app is used, for example which screens you open and how long each one stays on screen while the app is open, which buttons and player controls you tap, which stories, walks and listening modes you start, whether you open Look Around or an illustrated 3D area and for how long, which settings you change, problems the app shows you, and when you open a link to another website. For a link we record only the part of the app you left from and the website's domain, never the full address. These events do not include your precise location, a movement history, what you type into search or any notes you write. PostHog adds basic device and app-version details and an approximate, city-level location it derives from your IP address. We configure PostHog to host this data in the EU. You can turn Share analytics off at any time in Wanderwalk Settings, and PostHog stops receiving events straight away. PostHog does not receive advertising identifiers, and we do not sell or use this data to profile you for adverts.

Links to other websites. When you open a website from the app, for example an event or venue page in London Now, we add tags to the link (utm_source=wanderwalk, utm_medium=ios_app and the name of the part of the app you came from) so that site's own analytics can see the visit came from Wanderwalk. These tags do not identify you and contain no personal data. We do not add them to Apple, App Store, Maps, email or sign-in links, or to links that already carry their own tags. What the website does with your visit is covered by its own privacy policy.

On-device data. Your chosen interest categories, your listening history (which stories you've heard), playback preferences such as speed, and cached audio for offline play are stored on your device. If you have an account, your interests and listening history may also be saved to your account so the experience follows you to a new device. Cached audio simply lets a story keep playing once it's downloaded, even when your signal is patchy.

We do not collect contacts, photos, microphone audio or health data.

We use the data above only for the purposes described here. Specifically:

• Play the right story in the right place: your precise location, used on your phone, chooses which nearby story to play as you walk and which free-roam stories match the interests you picked.
• Recognise your account, so your interests, listening history and Wanderwalk+ access can follow you across devices.
• Wanderwalk+ access: subscription and pass status from Apple and RevenueCat lets the app open every story, all curated walks and full free roam.
• Remember your preferences, including the categories you lean into, playback speed and which stories you've already heard.
• Review places you suggest, so we can decide whether to add a story.
• Keep the service secure and prevent abuse, using IP-based rate limits and App Attest checks so our audio is not copied or misused.
• Detect and fix technical faults: Sentry's default crash and technical-fault reports help us find problems that stop the app working properly.
• Improve the app with product analytics: PostHog product-usage events help us understand which features people use and decide what to build. You can turn this off with Share analytics in Settings.

We do not sell personal data or make decisions about you using solely automated processing that produces legal or similarly significant effects.

Under UK GDPR and EU GDPR we must have a lawful basis for each use of your personal data. Ours are:

• Performance of a contract, providing the core app: triggering stories from your location, running your account, applying the free trial and opening Wanderwalk+ when you subscribe or buy a pass. Without this processing, the app simply cannot do what you installed it to do.
• Legitimate interests, detecting and fixing crashes and technical faults through Sentry, understanding how the app is used through pseudonymous PostHog product analytics so we can improve stories, walks and features (you can turn this off at any time with Share analytics in Settings, without losing access to Wanderwalk), keeping the app and our audio secure and preventing fraud and abuse, reviewing suggested places to improve our catalogue, and understanding cookieless aggregate usage of our marketing website so we can improve it. We balance these interests against your rights, do not send Sentry product-usage Logs and keep the processing minimal.
• Consent, for analytics cookies and marketing cookies on our website. We use marketing cookies to measure our OpenAI adverts on /how-it-works/, /pricing/ and /walks/, and to link visits to later app installs, trials and purchases. You give or refuse consent through the cookie banner, and you can change your choice using Cookie settings at the bottom of every page.

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you have the right to object, see Your rights below.

We keep the list of companies that touch your data short, and we only use reputable providers for the purposes described here. Here is everyone, and why:

• Apple, Sign in with Apple and In-App Purchase for Wanderwalk+. Apple handles payment; we never see your card details.
• Google (Google Sign-In), an optional way to sign in. We receive a basic identifier and, if shared, your email and display name; this is standalone Google Sign-In for authentication, not advertising.
• RevenueCat, manages subscription and pass state on our behalf so the app knows which stories to open. It processes purchase status, not payment card data.
• Sentry, receives crash and technical-fault reports by default so we can detect and fix problems under our legitimate interests. It does not receive advertising identifiers or product-usage Logs.
• PostHog, receives pseudonymous product-usage events from the app unless you turn off Share analytics. On the website, it receives page visits, App Store link clicks and audio sample starts and completions. These are cookieless unless you accept analytics cookies. If you accept both analytics and marketing cookies on /how-it-works/, /pricing/ and /walks/, it stores the first OpenAI click identifiers it sees on a person profile. This lets us link later app installs, trials and purchases to the advert. We host this data in the EU. PostHog does not receive advertising identifiers, and we do not sell this data.
• Cloudflare, our backend runs on Cloudflare Workers. Cloudflare D1 stores your account record, chosen interests, listening history, trial state, suggested places and Wanderwalk+ entitlement; Cloudflare KV serves the story catalogue; and Cloudflare R2 serves the audio your app downloads. Cloudflare also provides cookieless website analytics.
• Ahrefs, provides cookieless Web Analytics and technical site auditing so we can understand aggregate website traffic, including referring sources, and find SEO problems.
• OpenAI, provides the Measurement Pixel on /how-it-works/, /pricing/ and /walks/ so we can measure our OpenAI adverts and link them to later app installs, trials and purchases. It runs only if you accept marketing cookies. If you do, we store the first OpenAI click identifiers we see in cookies on wanderwalk.app named __oppref and __obref, and in local storage. OpenAI may also set cookies on openai.com.

We do not sell your personal data or share it for third-party advertising.

Our website at https://wanderwalk.app tells you about the app and where to download it.

On /how-it-works/, /pricing/ and /walks/, including each walk page, we run the OpenAI Measurement Pixel only if you accept marketing cookies. We use it to measure visits from our OpenAI adverts and link them to later app installs, trials and purchases. If you accept, those pages store the first OpenAI click identifiers we see in cookies on wanderwalk.app named __oppref and __obref, and in local storage. Later app and website events reuse them. Until you accept marketing cookies, we store no OpenAI click identifiers on your device.

On those pages, PostHog uses cookies only if you accept analytics cookies. If you also accept marketing cookies, PostHog stores the first __oppref and __obref values it sees on your person profile. Later visits do not overwrite them. We can then link later app events to the original OpenAI advert click. Those events include Application Installed, trial_started and rc_initial_purchase_event. If you do not accept analytics cookies, PostHog counts the visit without cookies or a person profile. To tell visits apart, PostHog turns your IP address, browser details and the date into an anonymous code that changes every day. It then deletes your IP address and browser details. We host this PostHog data in the EU.

Cloudflare Web Analytics and Ahrefs Web Analytics stay cookieless across the site. They give a basic count of visits, pages and referring sources. The /download page also sends a cookieless PostHog pageview so we can compare download-page visits with app activation. PostHog autocapture, feature flags and session recording stay off on the website.

We also use PostHog to count when you follow an App Store link and when an audio sample starts or finishes. These actions include the page path and a broad referral category, such as Google, Bing, ChatGPT or a direct visit. Sample events also identify which sample played. Unless you accept analytics cookies, these events are cookieless and do not create person profiles. They do not include URL queries, fragments or raw referrer addresses. We do not add PostHog pageviews to those pages, apart from the existing download page measurement. The /open app handoff page does not send these PostHog events. Website actions, app installs and app activation are separate measures.

The rest of the site does not run the OpenAI pixel. We keep this use of website measurement under review and will update this policy if it changes.

We ask before we set any cookies that are not essential. When you first visit our website, a banner lets you accept or reject analytics cookies and marketing cookies. Rejecting is as easy as accepting. You can change your choice at any time using Cookie settings at the bottom of every page.

We use 3 types of cookie:

• Essential cookies remember your cookie choice and are always on. We set cc_cookie on wanderwalk.app. It lasts 6 months.
• Analytics cookies let PostHog count visits and see which pages people use. We set ph_..._posthog on wanderwalk.app. It lasts 1 year. If you reject them, we still count page visits without cookies, using an anonymous code that changes every day.
• Marketing cookies show whether people who click our OpenAI adverts go on to download and use Wanderwalk. We set __oppref and __obref on wanderwalk.app. They last 30 days. OpenAI also sets __cf_bm and _cfuvid on openai.com.

If you withdraw consent, we delete the analytics and marketing cookies we set on wanderwalk.app. We cannot delete cookies that OpenAI sets on openai.com. You can clear those in your browser settings.

We keep data only as long as we need it:

• Location for triggering stories is used in the moment on your device and is not retained by us as a history of your movements.
• Account data, including your identifier, email or display name if shared, interests, listening history, is kept while your account exists. Delete your account and we delete this data, except anything we're legally required to keep for a limited period.
• Suggested places are linked to your account while it exists. When you delete the account, we remove that link and keep the suggestion without your name, so we can decide whether to add a story.
• Subscription and pass records are retained as needed to manage your access and meet Apple's and our legal and accounting obligations.
• Security and rate-limit data, including short-lived IP-based counters, is kept only as long as needed to enforce limits and protect the service, then aged out.
• Sentry crash and technical-fault reports are kept only for as long as they are useful for detecting, investigating and fixing faults, then aged out in line with our Sentry retention settings.
• Optional PostHog product-analytics data is kept only for as long as it is useful for understanding and improving the app, then aged out in line with our PostHog retention settings.
• On-device data, including preferences, cached audio and local history, stays on your device until you clear it, delete the app or it's evicted from the cache. Deleting the app removes this local data from your device.

Some of our providers, including Apple, Google, RevenueCat, Sentry, PostHog, Cloudflare, Ahrefs and OpenAI, operate globally, so your data may be processed outside the UK or the European Economic Area.

Where that happens, we rely on appropriate safeguards recognised under UK and EU GDPR, such as the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, or transfers to countries with an adequacy decision, so your data gets a comparable level of protection wherever it's handled. You can ask for a copy of the transfer safeguards that apply to your data by emailing privacy@wanderwalk.app.

Under UK and EU GDPR you have rights over your personal data, including the right to:

• access a copy of the personal data we hold about you;
• rectify data that's inaccurate or incomplete;
• erase your data ("the right to be forgotten");
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format (data portability);
• withdraw consent at any time where we rely on it.

You can object to product analytics at any time by turning off Settings > Share analytics. This stops new PostHog product-usage events and does not affect the rest of Wanderwalk. Sentry's crash and technical-fault reports and PostHog product analytics rely on our legitimate interests rather than consent. You have the right to object to that processing by emailing privacy@wanderwalk.app; we will consider your circumstances and respond as the law requires.

Deleting your account is built in. You can do it at any time in the app: open Settings, choose Delete Account and confirm. This permanently removes your account record, chosen interests, listening history from our servers. If you submitted a suggested place, we remove its link to your account and retain the suggestion anonymously as an editorial lead. You can also email privacy@wanderwalk.app and we'll handle the request for you.

To exercise any other right, email privacy@wanderwalk.app. We'll respond within the timeframes the law requires, normally one month. Using these rights is free, and we will not penalise you for it. If you're in the United States, see the section on US and California privacy rights below.

If you think we've mishandled your data, you can complain to a supervisory authority. In the UK that's the Information Commissioner's Office (ico.org.uk); in the EU it's your local data protection authority. We'd appreciate the chance to put things right first, so do get in touch.

If you live in the United States, and in particular in California, you have specific privacy rights. This section explains them and how they apply to Wanderwalk.

The personal information we handle about you falls into these categories: identifiers, such as an account identifier, email and display name if shared; commercial information, such as your Wanderwalk+ purchase status; internet or app activity, such as default crash and technical-fault reports, product-usage events; user-provided content in suggested places; and geolocation. Precise location is normally processed only on your device to trigger stories and is not collected into a movement history. If you suggest a place, we receive the single precise coordinate you choose to submit.

We do not sell or share your personal information for cross-context behavioural advertising. We do not use or disclose your precise geolocation or any other sensitive personal information for advertising.

Your rights include the right to know and access the personal information we hold, the right to delete it, the right to correct it, the right to opt out of sale or sharing, and the right not to be discriminated against for exercising any of these rights.

To exercise these rights, delete your account in the app (Settings, then Delete Account) or email privacy@wanderwalk.app. We will verify your request through your account and will not charge you or treat you differently for asking. You may use an authorised agent where the law allows.

Wanderwalk is not directed at children under 13, and we do not knowingly collect personal data from them.

If you believe a child under 13 has provided us with personal data, please contact privacy@wanderwalk.app and we'll delete it.

We take sensible steps to protect your data. Payments and subscriptions run through Apple's secure In-App Purchase system, so we never handle your card details. Connections between the app and the companies that provide the service are encrypted in transit. We keep as much as we can on your device, and we limit access to account data to what's needed to run the service.

No system is perfectly secure, but we design Wanderwalk to collect little, share less, and guard what it does hold. If a breach affecting your personal data ever occurs, we will act promptly and notify you and the relevant authorities where the law requires it.

As the app grows, more stories, more cities, new features, we may update this policy. When we make a material change, we'll update the effective date below and, where appropriate, let you know in the app or on the website. We will not reduce your rights under this policy without your consent where the law requires it.

Effective date: 26 September 2026. We'd encourage you to check back from time to time.

For privacy questions or to exercise any of your rights:

• Privacy and data requests: privacy@wanderwalk.app
• General enquiries: hello@wanderwalk.app
• Postal: MT-DEVA LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ

We read these, and we'd rather hear from you than have you wondering.