WanderWalk privacy policy

WanderWalk is an iOS walking audio-tour app for London, and a marketing website at https://wanderwalk.app. The app is available on the App Store.

WanderWalk is operated by MT-DEVA LIMITED, a company registered in England and Wales (company number 15768175), with its registered office at 71-75 Shelton Street, London, England, WC2H 9JQ. In this policy "we", "us" and "our" mean that company. We are the data controller for the personal data described here, which means we decide what is collected and why, and we are responsible for looking after it.

This policy applies to:

• the WanderWalk iOS app, and
• the wanderwalk.app marketing website.

If you only visit the website and never install the app, only the section on the marketing website and analytics applies to you.

Questions, or want to exercise a right? Email privacy@wanderwalk.app for anything privacy-related, or hello@wanderwalk.app for general queries.

We try to collect as little as possible, and to keep as much as we can on your own device. Here is the full picture.

Precise location (When-In-Use only). WanderWalk uses your device's precise location to work out where you are as you walk, so it can trigger the right story at the right spot, roughly within 40 metres of a place with a story to tell. A few things matter here:

• We request location access When-In-Use only. We never ask for "Always" or background-always location, and the app does not track you when you're not using it.
• This location work happens on your device. Your phone holds the map of stories and decides, locally, which one to play next. Deciding what plays in your ear does not require sending a stream of your movements to a server, and we do not store a history of your movements.
• We do not sell your location and we do not share precise location for advertising. Ever.

Account information. You can create an account using Sign in with Apple or Google Sign-In. When you do, we receive a basic identifier and, depending on what the provider and you choose to share, an email address used to recognise your account across devices. With Sign in with Apple you may use Apple's private email relay, in which case we never see your real email address.

Subscription and purchase data. WanderWalk+ is sold through Apple's In-App Purchase (a monthly or annual subscription, or a one-time 7-Day Pass) and managed for us by RevenueCat. We receive subscription status, for example whether your access is active and when it renews or expires, so the app can unlock everything for you. We never see or store your card details; Apple handles payment. If you enable optional TikTok ad measurement, TikTok also receives StoreKit purchase or subscription events for advertising measurement.

Technical and security data. When the app talks to our backend, for example to confirm your subscription, sync your account, or stream audio, our servers briefly process your device's IP address and basic request information so we can enforce fair-use rate limits, prevent fraud and abuse of our audio, and keep the service secure. The app also uses Apple's App Attest to confirm a request comes from a genuine, unmodified copy of WanderWalk. These produce security signals, not advertising identifiers, and we do not use them to build a profile of you.

Crash, diagnostic and product-analytics data (consent-gated). To find and fix bugs and to understand which features land so we can improve the app, the app can send:

• crash and diagnostic data to Sentry, and
• pseudonymous product-usage events (for example, that a walk was started or a paywall was viewed) to PostHog, which we configure to host data in the EU.

This is:

• consent-gated, there is a toggle in the app, and you decide whether it's on,
• free of advertising identifiers and never used to profile you for ads or sold, and
• aimed only at keeping the app stable and making it better.

On-device data. Your chosen interest categories, your listening history (which stories you've heard), playback preferences such as speed, and cached audio for offline play are stored on your device. If you have an account, your interests and listening history may also be saved to your account so the experience follows you to a new device. Cached audio simply lets a story keep playing once it's downloaded, even when your signal is patchy.

We do not collect contacts, photos, microphone audio or health data. The optional TikTok measurement section below explains the limited advertising identifiers and app events shared only after consent.

We use the data above only for the purposes described here. Specifically:

• Play the right story in the right place, your precise location, used on-device, decides which nearby story to trigger as you walk, and ranks free-roam stories to the interests you've picked.
• Recognise your account, so your interests, listening history and WanderWalk+ access follow you across devices.
• Unlock WanderWalk+, subscription and pass status from Apple and RevenueCat tells the app to unlock every story, all curated walks, and full free roam.
• Remember your preferences, the categories you lean into, playback speed, and which stories you've already heard.
• Keep the service secure and prevent abuse, using IP-based rate limits and App Attest checks so our audio is not scraped or abused.
• Keep the app stable and improve it, crash, diagnostic and pseudonymous product-usage data (only if you've consented) helps us fix problems and decide what to build.
• Measure whether TikTok adverts lead to installs and useful app activity, only if you separately enable TikTok measurement and grant Apple's tracking permission.

We do not sell personal data or make decisions about you using solely automated processing that produces legal or similarly significant effects.

Under UK GDPR and EU GDPR we must have a lawful basis for each use of your personal data. Ours are:

• Performance of a contract, providing the core app: triggering stories from your location, running your account, and unlocking WanderWalk+ when you subscribe or buy a pass. Without this processing, the app simply cannot do what you installed it to do.
• Consent, for sending crash, diagnostic and product-analytics data to Sentry and PostHog, and separately for sending advertising-measurement data to TikTok. Both uses are behind app controls. TikTok measurement also requires Apple's App Tracking Transparency permission. You can withdraw either consent without losing access to WanderWalk.
• Legitimate interests, keeping the app and our audio secure and preventing fraud and abuse (including briefly processing IP addresses and running device-attestation checks), and understanding aggregate, non-personal usage of our marketing website so we can improve it. We balance these interests against your rights and keep the processing minimal.

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you have the right to object, see Your rights below.

We keep the list of companies that touch your data short, and we only use reputable providers for the purposes described here. Here is everyone, and why:

• Apple, Sign in with Apple, and In-App Purchase for WanderWalk+. Apple handles payment; we never see your card details.
• Google (Google Sign-In), an optional way to sign in. We receive a basic identifier and, if shared, your email; this is standalone Google Sign-In for authentication, not advertising.
• RevenueCat, manages subscription and pass state on our behalf so the app knows what to unlock. It processes purchase status, not payment card data.
• Sentry, receives crash and diagnostic data, only when you've consented, so we can fix bugs. No advertising identifiers.
• PostHog, receives consent-gated, pseudonymous product-usage events, hosted in the EU, so we can understand and improve the app. No advertising identifiers, and we do not sell this data.
• TikTok, receives limited app-event, purchase, device and network data for advertising attribution and measurement only after separate consent and Apple's tracking permission.
• Cloudflare, our backend runs on Cloudflare Workers. Cloudflare D1 (a managed database) stores your account record, chosen interests, listening history and WanderWalk+ entitlement; Cloudflare KV serves the story catalogue; and Cloudflare R2 serves the audio your app downloads. Cloudflare also provides cookieless website analytics.
• Ahrefs, provides cookieless Web Analytics and technical site auditing so we can understand aggregate website traffic, including referring sources, and find SEO problems.
• Neon, a managed Postgres database used in our content pipeline to build the story catalogue. It holds story data, not your account data.

We do not sell your personal data. TikTok measurement is the only third-party advertising measurement in WanderWalk, and it is off unless you explicitly enable it.

Our website at https://wanderwalk.app tells you about the app and where to download it.

For a basic, privacy-respecting sense of how many people visit, which pages they read and which sources referred them, the site uses Cloudflare Web Analytics and Ahrefs Web Analytics. Both are cookieless. They do not fingerprint you, track you across other sites or build an advertising profile about you.

Because the site sets no tracking cookies and these analytics are used only for aggregate website measurement, it does not need a cookie banner, and you will not see one. That's deliberate.

Some versions of WanderWalk include the TikTok App Events SDK to measure whether TikTok adverts lead to installs and useful app activity. It is off by default. We initialise it only if you keep Share analytics on, explicitly switch on Measure TikTok ads, and grant Apple App Tracking Transparency permission. Refusing does not affect the rest of the app.

When enabled, TikTok automatically receives an install, app launch, day-two return, and StoreKit purchase or subscription event. WanderWalk also sends payload-free events when you complete onboarding, start a route or play a story. These events can include app and device details, a device identifier including Apple's advertising identifier after permission, an IP address from which TikTok may infer coarse location, and StoreKit product and transaction information.

The adapter never sends your precise location, name, email address, POI or route identifiers, story names or story details. Enhanced data postback is disabled, so TikTok does not receive screen structure, button labels or page text through that feature. TikTok is the only SDK configured to write SKAdNetwork conversion values.

Turn Measure TikTok ads off at any time to stop new events. The SDK may retain events already queued on your device and send them if you turn measurement on again; TikTok does not provide an app-side method for us to delete that queue. You can also deny tracking in iOS Settings. TikTok handles data it has received under the TikTok Business Products Data Terms at https://ads.tiktok.com/i18n/official/policy/business-products-data-terms and TikTok's privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en. TikTok controls its own retention under those terms and its privacy controls.

We keep data only as long as we need it:

• Location for triggering stories, used in the moment on your device and not retained as a history of your movements by us.
• Account data (identifier, email if shared, interests, listening history), kept while your account exists. Delete your account and we delete this data, except anything we're legally required to keep for a limited period.
• Subscription and pass records, retained as needed to manage your access and meet Apple's and our legal and accounting obligations.
• Security and rate-limit data (including short-lived IP-based counters), kept only as long as needed to enforce limits and protect the service, then aged out.
• Crash, diagnostic and product-analytics data, retained by Sentry and PostHog only for as long as it's useful, then aged out in line with their retention settings, in pseudonymous form.
• TikTok measurement data, retained by TikTok under its published terms and privacy controls. Turning measurement off stops new events but does not erase data TikTok has already received.
• On-device data (preferences, cached audio, local history), stays on your device until you clear it, delete the app, or it's evicted from the cache. Deleting the app removes this local data from your device.

Some of our providers (for example Apple, Google, RevenueCat, Sentry, PostHog, TikTok, Cloudflare and Ahrefs) operate globally, so your data may be processed outside the UK or the European Economic Area.

Where that happens, we rely on appropriate safeguards recognised under UK and EU GDPR, such as the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, or transfers to countries with an adequacy decision, so your data gets a comparable level of protection wherever it's handled.

Under UK and EU GDPR you have rights over your personal data, including the right to:

• access a copy of the personal data we hold about you;
• rectify data that's inaccurate or incomplete;
• erase your data ("the right to be forgotten");
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability, receive your data in a portable format;
• withdraw consent at any time where we rely on it.

You can withdraw analytics consent in WanderWalk Settings. You can separately turn off Measure TikTok ads there and deny tracking in iOS Settings. This does not affect the rest of WanderWalk.

Deleting your account is built in. You can erase your account and its data yourself, at any time, right in the app: open Settings, choose Delete Account, and confirm. This permanently removes your account record, chosen interests and listening history from our servers. You can also email privacy@wanderwalk.app and we'll do it for you.

To exercise any other right, email privacy@wanderwalk.app. We'll respond within the timeframes the law requires (normally one month). Using these rights is free, and we will not penalise you for it. If you're in the United States, see the section on US and California privacy rights below.

If you think we've mishandled your data, you can complain to a supervisory authority. In the UK that's the Information Commissioner's Office (ico.org.uk); in the EU it's your local data protection authority. We'd appreciate the chance to put things right first, so do get in touch.

If you live in the United States, and in particular in California, you have specific privacy rights. This section explains them and how they apply to WanderWalk.

The personal information we handle about you falls into these categories: identifiers (such as an account identifier and, if you share it, your email); commercial information (your WanderWalk+ purchase status); internet or app activity (pseudonymous product-usage events, if you've consented); and geolocation, which is processed on your device to trigger stories and is not collected into a movement history by us. Optional TikTok measurement can add a device identifier, app activity, purchase events and IP-derived coarse location, as described above.

We do not sell your personal information. If TikTok advertising measurement is "sharing" under California law, it happens only after you explicitly enable it and grant Apple's tracking permission. We do not use or disclose your precise geolocation or any other sensitive personal information for advertising.

Your rights include the right to know and access the personal information we hold, the right to delete it, the right to correct it, the right to opt out of sale or sharing, and the right not to be discriminated against for exercising any of these rights. Turn off Measure TikTok ads to opt out of new advertising-measurement events.

To exercise these rights, delete your account in the app (Settings, then Delete Account) or email privacy@wanderwalk.app. We will verify your request through your account and will not charge you or treat you differently for asking. You may use an authorised agent where the law allows.

WanderWalk is not directed at children under 13, and we do not knowingly collect personal data from them.

If you believe a child under 13 has provided us with personal data, please contact privacy@wanderwalk.app and we'll delete it.

We take sensible steps to protect your data. Payments and subscriptions run through Apple's secure In-App Purchase system, so we never handle your card details. Connections between the app, our backend and our providers are encrypted in transit. We keep as much as we can on your device, and we limit access to account data to what's needed to run the service.

No system is perfectly secure, but we design WanderWalk to collect little, share less, and guard what it does hold. If a breach affecting your personal data ever occurs, we will act promptly and notify you and the relevant authorities where the law requires it.

As the app grows, more stories, more cities, new features, we may update this policy. When we make a material change, we'll update the effective date below and, where appropriate, let you know in the app or on the website. We will not reduce your rights under this policy without your consent where the law requires it.

The current effective date is 27 July 2026. We'd encourage you to check back from time to time.

For privacy questions or to exercise any of your rights:

• Privacy and data requests: privacy@wanderwalk.app
• General enquiries: hello@wanderwalk.app
• Postal: MT-DEVA LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ

We read these, and we'd rather hear from you than have you wondering.