Your Privacy Choices
Every control Waypath gives you, what it does before you touch it, and exactly where to change it. The privacy policy explains what we hold and why. This page is about what you can decide.
The short version. Nothing you record is public until you choose to publish it. Live sharing is off until you start it and stops working the moment you finish. Contact matching is off until you turn it on. And you can delete everything, for real, from inside the app.
At a glance
| Choice | Default | Where |
|---|---|---|
| Who can see an activity | You choose when you publish | On the activity |
| Live sharing | Off | Start it yourself, per activity |
| Contact matching | Off | Find friends |
| Who can message you | Mutual friends only | Enforced by the server |
| Push notifications | Off until you allow them | iOS Settings |
| Location | Only while recording | iOS Settings |
| Health data | Off until you allow it | iOS Settings, Health |
| Delete your account | Available any time | Settings |
Who sees your activities
Each activity carries its own visibility, and there are three settings: Only me, Followers, and Everyone. You pick it when you publish and you can change it afterwards. Recording an activity and keeping it to yourself is a perfectly normal way to use Waypath.
Two reductions apply automatically to anything you do publish, and you do not have to remember them:
- Both ends are trimmed by a random 200 to 600 metres, so a published activity shows neither the doorstep you left from nor the one you came back to.
- The start time is stored rounded to the hour, so a public activity cannot be read off to work out your daily routine.
Live sharing
Live sharing is off unless you start it. While it runs, anyone holding your link can see roughly where you are. When you finish, the link stops returning a position: it does not become a record of where you went.
Two things worth knowing before you send a link to a group chat:
- Anyone you send it to can forward it. Treat it like a key.
- The position deliberately trails you by about 250 metres, so it is always slightly behind where you actually are.
You can end sharing at any time by finishing the activity or turning sharing off, and the link dies with it.
Finding people, and being found
Contact matching is off until you turn it on. When you do, contact identifiers are hashed on your device and only the hashes are sent, so we never receive your address book. The server hashes them again with a secret value of its own, the hashes you send in order to search are discarded once the search is done, and turning the feature off deletes the entry you published. You are not findable this way unless you chose to be.
Who can message you
Only people you have both accepted can start a conversation with you. Being followed by a stranger does not let them message you, and this is enforced on the server rather than hidden in the app, so it holds no matter what is doing the asking.
Direct messages are end-to-end encrypted. We store the ciphertext and hold no key, so we cannot read them. We can see that two accounts exchanged a message and when, because delivering it requires knowing that, and encryption does not hide it.
You can block anyone, and blocking stops both messages and visibility.
Contributing to the community heatmap
Adding your paths to the community heatmap is off until you turn it on, in Map layers ▸ Community or Settings ▸ Map. Displaying the layer and contributing to it are two separate switches: you can look at the map without adding anything to it.
While it is on, a finished activity sends which ~75-metre squares it passed through and in which week, as whole numbers. No coordinates, no time of day, no account — it is sent without a signed-in session — and the first and last 300 metres are dropped, so neither end of your route is in it. The only label attached rotates every Monday, so two weeks cannot be tied to the same person. A path is drawn only where at least three different people passed in the same week.
This is the one choice you cannot fully undo. Turning it off stops anything further being sent, and that is all it can do: contributions already sent carry no identifier, so we cannot find them to show you or delete them on request, and neither can anyone else. They are deleted automatically within 26 weeks. We would rather say so here than let you discover it after the fact.
Permissions iOS controls
These live in the iOS Settings app rather than in Waypath, and you can change them at any time without uninstalling anything.
- Location. Used while you are recording, to draw your route, and while live sharing is on. Not in the background otherwise.
- Health. Used to read and write workouts and heart rate. Health data stays on your device and is not sent to our servers, never used for advertising, and never sold.
- Notifications. Off until you allow them.
- Photos. Asked for only when you add a photo.
- Contacts. Asked for only if you turn on contact matching.
Getting your data out
You can export any activity as a GPX file with elevation and per-point time, which opens in essentially every other training tool. Your routes are not locked in here.
For a copy of everything else we hold about you, write to hugo@oshi-messenger.com and we will send it within one month.
Deleting your account
Settings has a Delete Account control, and it does what it says. Your profile, activities, photos, comments, messages and social connections are removed, and the files you uploaded are erased from storage as well, not merely unlinked. You can also choose to erase the history held locally on your device at the same time.
If you would rather we did it, write to hugo@oshi-messenger.com.
What we never do
- Sell or rent your data.
- Show advertising, or build a profile of you for anybody else's.
- Load third-party analytics or tracking, in the app or on this site.
- Track you across other apps and websites. There is no such code in Waypath, which is why iOS never asks you to allow it.
Your rights, and how to use them
Under the GDPR you can ask for access, correction, deletion, a portable copy, or restriction, and you can object to processing or withdraw consent. Most of it you can do yourself in the app, immediately. For anything else, write to hugo@oshi-messenger.com and we will answer within one month.
If you are unhappy with how we handled it, you can complain to your national supervisory authority. In France that is the CNIL.