Privacy policy

About this policy

Wandeer is operated by independent developer Xiang Fei. This policy explains how we handle information when you use the Wandeer app and this website, why we use it, and how you can manage or delete it. For support and privacy requests, contact help@wandeer.world.

We do not sell personal information, use advertising identifiers or track you across apps. We do not read your device contacts, step count or motion history. Some public content can be browsed without signing in.

Information we handle

• Account and profile: Sign in with Apple provides an account identifier and the name you choose to share on first authorization. We do not request email access or receive your Apple password. You can choose a nickname and avatar. Device credentials use Keychain; the server stores session digests and encrypted credentials needed to revoke Apple authorization.
• Location and exploration: Maps, nearby landmarks, visits and submissions use your current location. Visits associate your account with a landmark and time; submitted places retain their location. We do not store continuous GPS tracks. Places or cities you make public may reveal where you have been.
• Photos: Photos you submit, avatars and crop results. Landmark submissions use the camera; avatars can use the system photo picker or camera. We do not read your entire photo library. The server normalizes images and removes original EXIF/GPS metadata. QR camera previews stay on your device and are not uploaded as video.
• Journals and interactions: Private page layouts, material references, public page snapshots, saved lists, friendships, blocks, likes, reports, routes, achievements, claims and app-use days. Friendships come from in-app actions, not your device address book.
• Vouchers and purchases: Apple product and transaction identifiers, transaction status, grants, balances, redemptions and material entitlements. Apple handles payment; we do not receive bank card details.
• Support and diagnostics: Your email address, message and attachments when you contact support, and operational request times, random request identifiers, endpoint categories, status and duration. Business diagnostic logs omit login tokens, request bodies and raw precise-location queries.

Purposes and visibility

We use this information to provide sign-in, exploration, synchronization, journal editing, purchases and rewards, friend interactions and support, and to address abuse and content reports.

Your complete private journal is visible only to you. A page you publish becomes a public snapshot displayed with your current avatar and nickname. Later changes to the private page do not change that snapshot. You can withdraw public pages, report content or block users. Likes show a total, not a list of people. Images exported through system sharing are passed to your chosen app or recipient; we cannot recall external copies or screenshots.

Operators manually review submitted landmarks and additional photos before publication. Reported pages, nicknames, avatars, relevant images and descriptions are available only to the operators who need them to review and act on a report. Reporting a page first hides it from the reporter; removal for everyone is a separate decision.

The current interface does not display nearby visit activity. Existing compatibility endpoints may still return nearby or friend visits from the last 24 hours to authorized older clients; friendship may allow access across regions.

Service providers and storage

• Apple: Provides Sign in with Apple, MapKit and in-app purchases. Apple handles data needed for these services under its privacy policy.
• Tencent Cloud: Provides server hosting and COS media storage. Accounts and business records are stored on a server in South Korea; images and materials are stored in Shanghai, China. Providers may handle IP addresses, requests and media necessary to deliver these services. See Tencent Cloud’s privacy policy.
• Email services: If you contact support, the sending and receiving email services process your message. Do not send passwords, verification codes, complete payment credentials or unrelated sensitive information.

Processing may involve storage or transmission outside your country or region. We share information only as necessary to provide these services, meet applicable legal obligations or protect users and service security, and require processors to uphold corresponding data-protection obligations. We do not share information for independent advertising purposes.

Retention and deletion

Accounts, private journals, exploration records and claimed entitlements generally remain with your account until you delete the relevant content or account. Withdrawn public pages stop being displayed, but snapshots or records may remain for auditing, reports or preventing duplicate operations.

• Ordinary login sessions last up to 30 days. Short-lived location credentials last 60 seconds and capture contexts 15 minutes. Expiry is not immediate physical erasure of every related record; background cleanup runs in batches.
• Media and avatars without a valid content or report reference generally become eligible for cleanup after at least 24 hours. Previously issued image links may remain valid for up to five minutes.
• Ordinary idempotency records remain for seven days, Apple identity-notification deduplication records for 30 days, and business audits and some synchronization receipts for 90 days. Receipts needed for the latest journal revision or current route remain protected.
• Detailed evidence and action snapshots for resolved moderation cases are cleaned in batches after 90 days; brief moderation history is cleaned after 365 days. Unresolved cases remain until resolution and the applicable retention period.
• To prevent duplicate transaction credit, Apple transaction identifiers and necessary settlement records remain without the account association after account deletion.
• Support email is used to handle your request and necessary follow-up. You can ask us to delete messages or attachments that are no longer needed.

Backups are stored separately. Daily, weekly and monthly recovery points, pinned pre-release backups and manually held copies are reviewed and removed according to recovery needs. Deleting live data does not immediately erase every backup. Backups are restricted to recovery and security checks; received deletion requests must be addressed during restoration so deleted accounts or content are not restored or republished. Contact us about related deletion requests.

Your choices and rights

• Use Me → Settings → Manage account to edit your profile, export your data or delete your account. Account deletion requires a recent Apple sign-in.
• Deleting your account removes private content, relationships, exploration records, entitlements and media references, withdraws your pages and queues Apple authorization revocation. Approved public landmarks remain without an account association.
• Manage location and camera permissions in system settings. Withholding a permission may prevent its related features but does not block unrelated features.
• Delete private pages, withdraw pages from My shares, and use reports and blocks to manage interactions. The system photo picker provides only the photos you select.
• To request access, correction, deletion or other applicable data rights, email help@wandeer.world. We may need reasonable identity verification, but will not ask for your Apple password or SMS verification code.

Local caching and security

Your device caches official materials, opened routes, landmarks and images, and some public page structures and thumbnails for continuity on weak or unavailable networks. Private files are separated by account and use system file protection; deleting an account clears its local directory. Signing out is not account deletion. Public caches have size and age limits.

We use HTTPS, restricted media access, short-lived signed image links and account authorization checks. We work to protect information, but no system can guarantee absolute security.

Children

Wandeer is not designed specifically for children. Users below the local age for independently consenting to data processing should use it with a guardian’s guidance and permission. If a guardian believes a child provided personal information without required permission, please contact us.

Website and policy changes

These privacy and support pages use no analytics scripts, advertising, tracking cookies or third-party fonts. The server still processes connection information necessary to complete HTTPS requests.

We update this page and its date when features or processing change. Material changes in use or sharing will be communicated through the app or another suitable channel, with permission obtained where required. This policy does not replace system permissions, and opening a page is not consent to every data use.