Legal

Privacy policy

Wayli is an audio walking companion. This page explains what we collect while you plan and walk, why we need it, who else touches it and how to get it removed.

Last updated 13 August 2026 Applies to wayli.ai, app.wayli.ai and the Wayli mobile app hello@wayli.ai

1. Who we are

Wayli builds personal audio walks: a walk is assembled for you from chapters — stories about a place, written and checked by people, then narrated. This policy covers the Wayli website (wayli.ai), the web app (app.wayli.ai) and the Wayli mobile app for iOS and Android. We are the controller of the personal data described here. Reach us any time at hello@wayli.ai.

2. What we collect

We keep the list short on purpose. Everything below has a job to do.

Account details
Your email address, the display name you choose, and an internal account identifier. Accounts are handled by Amazon Cognito. If you sign in with Google or Apple we receive the email address and name that provider releases to us — never your password, and never your contacts or any other data from that account.
Location while you walk
Your device position, only after you grant the permission, and only while the app needs it. See section 3 for exactly what happens to it.
What you save and set
Saved places and lists, your walking preferences (language, units, map downloads) and which chapters you have listened to, so a walk picks up where you left it.
Product usage events
A small first-party event stream — a screen was viewed, a tour was opened, a chapter started or finished, an account was created — each with a random per-launch session identifier and a timestamp. No free text, no advertising identifiers, no third-party analytics service. You can turn this off in the app under Settings → Privacy → Share anonymous usage data.
Feedback you send
The category and message you write, plus the tour or chapter you were on and the app version, so we can reproduce the problem. Your account email is attached so we can reply.
Early-access sign-ups
If you join the waitlist on this site: your email address, the name you optionally give, and which page you signed up from. Used to tell you when Wayli opens up — nothing else.
Technical logs
Standard server records of requests to our API and website — IP address, approximate time, the path requested, a user-agent string — kept briefly to keep the service up and to spot abuse.

3. Location, in plain terms

Location is what makes a walk work: it puts you on the map, draws the walking line to the next stop, and starts a chapter as you arrive at the place it is about.

  • We ask for the permission when you first open a walk, and the operating system lets you take it back at any time in your device settings.
  • Your position is used on your device. We do not build or keep a history of where you have been.
  • To draw a walking route, the coordinates of the stops on the route are sent to our routing provider. To draw the map, your device requests map tiles from OpenStreetMap, which — like any request on the internet — reveals your IP address and the area you are looking at to that provider.
  • Wayli does not track your location in the background for advertising, and never sells or shares it with data brokers.

4. What we never do

  • We do not sell personal data, and we do not share it for cross-context advertising.
  • We run no ad networks, no third-party trackers and no cookie-based profiling on this website.
  • We do not use your personal data to train AI models, and we do not send it to AI providers.
  • We do not read microphone, photos, contacts or calendar data — Wayli never asks for them.

Chapter narration is produced ahead of time from research about the place, reviewed by people before it ships. Nothing about you is part of that process.

5. Why we are allowed to

For people in the EEA, the UK and other places with similar rules, our legal bases under the GDPR are:

  • Performance of a contract — your account, your saved walks, your preferences and the audio we deliver. Without these we cannot give you the service you asked for.
  • Consent — location access, and the usage events toggle. Both are opt-in and both can be withdrawn without losing the rest of the app.
  • Legitimate interests — keeping the service secure and available, replying to your feedback, and understanding in aggregate which parts of a walk work.
  • Legal obligation — where the law requires us to keep or disclose something.

6. Who processes data for us

We keep the list of companies that touch your data as short as we can. Today it is:

  • Amazon Web Services — hosting, databases, accounts and sign-in (Cognito), and audio delivery.
  • Google and Apple — only if you choose to sign in with them, and only for that sign-in.
  • OpenStreetMap — map tiles rendered in the app and on the web.
  • Project OSRM — walking directions between the stops on a route.
  • Apple App Store and Google Play — distribution of the mobile app, on their own terms and privacy policies.

Our content and voice production tools sit outside this list on purpose: they work on stories about places, never on your personal data.

7. Where data is stored

Wayli runs on Amazon Web Services in the United States (Oregon, us-west-2), with content delivered through a global CDN. If you are in the EEA or the UK, your data is therefore transferred outside your region; we rely on the European Commission's Standard Contractual Clauses and the safeguards our providers offer for those transfers.

8. How long we keep it

  • Account data — while your account exists, then deleted within 30 days of your deletion request.
  • Saved places, preferences and listening progress — with your account, and removed with it.
  • Usage events — up to 24 months, then removed or aggregated beyond recovery.
  • Feedback — up to 24 months, so we can follow up on the fix.
  • Early-access sign-ups — until launch or until you unsubscribe.
  • Technical logs — typically 30 to 90 days.

9. Your rights

Wherever you live, you can ask us to show you the personal data we hold, correct it, delete it, hand it to you in a portable form, restrict or object to a particular use, or withdraw a consent you gave. Write to hello@wayli.ai and we will answer within 30 days. We will not charge you and we will not make the app worse for asking.

If you are in the EEA or the UK you also have the right to complain to your local data protection authority. We would rather you told us first — most things are fixable in a day.

10. Deleting your account

Send a deletion request from your account email address to hello@wayli.ai. We remove your account, your saved places and lists, your preferences and your listening history within 30 days. Anonymous usage counts that can no longer be linked to you may remain in aggregate statistics, and we keep anything the law requires us to keep for as long as it requires.

11. Children

Wayli is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has created an account, tell us and we will delete it.

12. Security

Data is encrypted in transit (HTTPS everywhere) and at rest in our storage. Access to production data is limited to the people who need it, credentials are held in a managed secrets store, and sign-in is handled by Amazon Cognito rather than by us storing passwords. No service can promise perfect security; if a breach affects your data we will tell you and the relevant authority as the law requires.

13. Changes to this policy

When we change something material we update the date at the top of this page and, if the change affects how we use data you already gave us, we tell you in the app or by email before it takes effect.

14. Contact

Questions, requests or corrections: hello@wayli.ai. Our terms of service cover the rest of the relationship.