Legal

Privacy policy

Wayli is an audio walking companion. This page explains what we collect while you plan and walk, why we need it, who else touches it and how to get it removed.

Last updated 5 October 2026 Applies to wayli.ai, app.wayli.ai and the Wayli mobile app hello@wayli.ai

1. Who we are

Wayli builds personal audio walks: a walk is assembled for you from chapters — stories about a place, written and checked by people, then narrated. This policy covers the Wayli website (wayli.ai), the web app (app.wayli.ai) and the Wayli mobile app for iOS and Android. Wayli is operated by SOSW LTD, a company registered in Israel (8 Hasharon St., Beit Dagan 5020000, Israel), which is the controller of the personal data described here. Reach us any time at hello@wayli.ai.

Company
SOSW LTD, a private company registered in Israel, company number 517053633
Registered address
8 Hasharon St., Beit Dagan 5020000, Israel

2. What we collect

We keep the list short on purpose. Everything below has a job to do.

Account details
Your email address, the display name you choose, and an internal account identifier. Accounts are handled by Amazon Cognito. If you sign in with Google or Apple we receive the email address and name that provider releases to us — never your password, and never your contacts or any other data from that account.
Location while you walk
Your device position, only after you grant the permission, and only while the app needs it. See section 3 for exactly what happens to it.
What you save and set
Saved places and lists, your walking preferences (language, units, map downloads) and which chapters you have listened to, so a walk picks up where you left it.
Product usage events
A small first-party event stream — a screen was viewed, a tour was opened, a chapter started or finished, an account was created — each with a random per-launch session identifier and a timestamp. No free text, no advertising identifiers, no third-party analytics service. You can turn this off in the app under Settings → Privacy → Share anonymous usage data.
Purchases
If you buy a plan: which plan, its price and currency, the purchase and renewal dates and its status, linked to your Wayli account so the plan works on every device you sign in on. For Paddle web orders we also receive the email address and country you gave at checkout. For orders paid with PayPal, we keep the PayPal order and capture ids (and refund id if refunded), the product, amount, currency, payment status (paid, pending, refunded, disputed or failed) and dates, linked to your Wayli account. With a PayPal payment, PayPal also sends us details of the PayPal account that paid, such as its name, email address and country, and shows them to us in our PayPal business account; we do not copy them into Wayli's own systems or logs. We never receive or store your card or bank details or your PayPal login — Apple, Paddle or PayPal handle the payment itself.
Cookies on wayli.ai
Only with your consent. The cookie banner offers three choices: Decline (no statistics or marketing cookies), Statistics only (Google Analytics 4 statistics cookies) and Accept (statistics plus Marketing, which loads the Meta Pixel). Statistics and marketing stay off until you choose. Your choice is saved in your browser under sosw_consent_v1 and records whether you allowed statistics and marketing. See section 6.
Campaign attribution on wayli.ai
If you arrive on this website from a link carrying campaign parameters (utm_*), we keep them in your browser's local storage under sosw_attr_v1 for 30 days and use them to tag our App Store and Google Play links (the ct= and referrer= parameters), so we can tell which campaign led to an install. Ad click identifiers (such as fbclid or gclid) are stored there only with your Marketing consent and are removed when you withdraw it.
Feedback you send
The category and message you write, plus the tour or chapter you were on and the app version, so we can reproduce the problem. Your account email is attached so we can reply.
Former waitlist sign-ups
If you joined our pre-launch waitlist on this site before 4 October 2026: your email address, the name you optionally gave, and which page you signed up from. Used only to tell you that Wayli has launched — nothing else. We no longer collect new sign-ups.
Technical logs
Standard server records of requests to our API and website — IP address, approximate time, the path requested, a user-agent string — kept briefly to keep the service up and to spot abuse.

3. Location, in plain terms

Location is what makes a walk work: it puts you on the map, draws the walking line to the next stop, and starts a chapter as you arrive at the place it is about.

  • We ask for the permission when you first open a walk, and the operating system lets you take it back at any time in your device settings.
  • Your position is used on your device. We do not build or keep a history of where you have been.
  • To draw a walking route, the coordinates of the stops on the route are sent to our routing provider. To draw the map, your device requests map tiles from OpenStreetMap, which — like any request on the internet — reveals your IP address and the area you are looking at to that provider.
  • Wayli does not track your location in the background for advertising, and never sells or shares it with data brokers.

4. What we never do

  • We do not sell personal data, and we do not share it for cross-context advertising — other than the Meta Pixel measurement you can opt into under "Marketing" (section 6).
  • No ad network shows ads on Wayli — not on this website, not in the web app and not in the mobile app.
  • Statistics cookies and marketing measurement on this website run only with your consent. You choose Decline, Statistics only or Accept in the consent banner shown on first visit, and can change your choice any time with the "Cookie settings" link in the footer. Google Analytics 4 is used for aggregate visit statistics, with ad-personalization signals turned off.
  • The Meta Pixel is loaded only with your Marketing consent (the Accept choice). It is off by default, nothing is requested from Meta before you opt in, and it only measures whether our own ads on Facebook and Instagram lead to visits and to clicks on our App Store and web-app buttons.
  • We do not use your personal data to train AI models, and we do not send it to AI providers.
  • We do not read microphone, photos, contacts or calendar data — Wayli never asks for them.

Chapter narration is produced ahead of time from research about the place, reviewed by people before it ships. Nothing about you is part of that process.

5. Why we are allowed to

For people in the EEA, the UK and other places with similar rules, our legal bases under the GDPR are:

  • Performance of a contract — your account, your saved walks, your preferences, the audio we deliver and the plan you buy. Without these we cannot give you the service you asked for.
  • Consent — location access, the usage events toggle, and the Statistics and Marketing choices on this website (Google Analytics 4, the Meta Pixel and stored ad click identifiers). All are opt-in and can be withdrawn at any time without losing the rest of Wayli.
  • Legitimate interests — keeping the service secure and available, replying to your feedback, understanding in aggregate which parts of a walk work, and the campaign parameters from the link you arrived on, kept for 30 days to attribute app-store links.
  • Legal obligation — where the law requires us to keep or disclose something, including purchase records that we, Paddle, PayPal and Apple keep for tax and accounting.

6. Who processes data for us

We keep the list of companies that touch your data as short as we can. Today it is:

  • Amazon Web Services — hosting, databases, accounts and sign-in (Cognito), and audio delivery.
  • Google — sign-in (only if you choose to sign in with Google) and, separately, Google Analytics 4 for aggregate visit statistics on wayli.ai (processed in the EU/US under Google's own terms). Statistics cookies are set and statistics are stored only with your Statistics consent; before you choose, Google Analytics runs in Consent Mode with storage denied, so it sets no cookies. GA4 is configured with ad-personalization signals off; choosing Accept also grants Google Consent Mode ad_storage, ad_user_data and ad_personalization.
  • Apple — only if you choose to sign in with them, and only for that sign-in.
  • OpenStreetMap — map tiles rendered in the app and on the web.
  • Project OSRM — walking directions between the stops on a route.
  • Apple App Store and Google Play — distribution of the mobile app, on their own terms and privacy policies.
  • Apple (App Store in-app purchases) — when you buy a plan in the iPhone app, Apple processes the payment. We receive a record of the purchase, never your card details.
  • Paddle.com — our online reseller and merchant of record for purchases through Paddle checkout on the web. Paddle collects the payment, your billing address or country and tax data as an independent controller under its own privacy notice. We receive an order record: product, price, status, email address and country.
  • PayPal — processes the payment when you choose to pay with PayPal on the web; for these orders SOSW LTD is the seller. PayPal receives the order (product, amount and a Wayli order reference) and handles your PayPal account and funding details as an independent controller under its own privacy statement. We keep the order, capture and refund ids, the product, amount, currency and payment status; as the seller, we are also shown details of the paying PayPal account, such as its name, email address and country.
  • RevenueCat, Inc. — keeps track of purchases and subscriptions for us. It stores your Wayli account identifier and the purchase records from Apple and Paddle so the app knows which plan you have.
  • Meta Platforms Ireland Ltd. (Meta Pixel) — runs on the wayli.ai website only, and only if you opt in to Marketing (the Accept choice in the cookie banner; off by default — nothing is requested from Meta before that). It measures whether our ads on Facebook and Instagram lead to visits and to clicks on our App Store and web-app buttons, sending these events: PageView, ViewContent (city pages) and StoreClick (clicks on our App Store and web-app buttons). It sets the first-party _fbp cookie (plus _fbc when you arrive from a Meta ad). Withdrawing consent via "Cookie settings" in the footer stops it and deletes the _fbp and _fbc cookies. It is not used in the mobile app.

Our content and voice production tools sit outside this list on purpose: they work on stories about places, never on your personal data.

7. Where data is stored

Wayli runs on Amazon Web Services in the United States (Oregon, us-west-2), with content delivered through a global CDN. If you are in the EEA or the UK, your data is therefore transferred outside your region; we rely on the European Commission's Standard Contractual Clauses and the safeguards our providers offer for those transfers.

RevenueCat (United States), Paddle and PayPal also process purchase data outside the EEA and the UK. They do so under their own safeguards — such as the Standard Contractual Clauses, Binding Corporate Rules or an adequacy decision, as applicable.

8. How long we keep it

  • Account data — while your account exists, then deleted within 30 days of your deletion request.
  • Saved places, preferences and listening progress — with your account, and removed with it.
  • Usage events — up to 24 months, then removed or aggregated beyond recovery.
  • Purchase records — as long as your account needs them, and afterwards for as long as tax and accounting law requires.
  • Feedback — up to 24 months, so we can follow up on the fix.
  • Former waitlist sign-ups — until we have told you that Wayli has launched, or until you unsubscribe.
  • Technical logs — typically 30 to 90 days.
  • Campaign attribution (sosw_attr_v1 in your browser) — 30 days; ad click identifiers are removed as soon as you withdraw Marketing consent.

9. Your rights

Wherever you live, you can ask us to show you the personal data we hold, correct it, delete it, hand it to you in a portable form, restrict or object to a particular use, or withdraw a consent you gave. Write to hello@wayli.ai and we will answer within 30 days. We will not charge you and we will not make the app worse for asking.

If you are in the EEA or the UK you also have the right to complain to your local data protection authority. We would rather you told us first — most things are fixable in a day.

10. Deleting your account

Send a deletion request from your account email address to hello@wayli.ai. We remove your account, your saved places and lists, your preferences and your listening history within 30 days. Anonymous usage counts that can no longer be linked to you may remain in aggregate statistics, and we keep anything the law requires us to keep for as long as it requires.

11. Children

Wayli is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has created an account, tell us and we will delete it.

12. Security

Data is encrypted in transit (HTTPS everywhere) and at rest in our storage. Access to production data is limited to the people who need it, credentials are held in a managed secrets store, and sign-in is handled by Amazon Cognito rather than by us storing passwords. No service can promise perfect security; if a breach affects your data we will tell you and the relevant authority as the law requires.

13. Changes to this policy

When we change something material we update the date at the top of this page and, if the change affects how we use data you already gave us, we tell you in the app or by email before it takes effect.

14. Contact

Questions, requests or corrections: hello@wayli.ai, or by post to SOSW LTD, 8 Hasharon St., Beit Dagan 5020000, Israel. Help with the app lives on the support page. Our terms of service cover the rest of the relationship.