Privacy Policy

Last updated: 27 September 2026

Waypal is an app that helps solo travellers find and join plans with other travellers nearby. It is operated by JR Consulting Co., a sole proprietorship registered in India ("we", "us"). This policy explains what we collect, why, and the choices you have. Questions: support@hookstep.in.

The short version. We collect what is needed to show you plans nearby and let you chat. Your exact location is never shown to other people. We don't sell your data and don't show ads. You can delete your account from inside the app at any time.

1. What we collect

Data	Why	Who can see it
Email address	To sign you in with a one-time code and contact you about your account.	Only us.
Name, profile photo, bio, home country, languages, interests	Your public profile, so other travellers know who they are meeting.	Other Waypal users.
Date of birth	To confirm you are 18 or older. Other users see your age, not your birth date.	Only us (age is shown to users).
Gender	To offer women-only plans. It is not shown on your profile.	Only us.
Location (precise, while the app is open)	To show plans and travellers near you and to name the city you're in.	Other users see only a distance rounded to 0.5 km and your city. We never collect location in the background.
Plans you post or join, trips you add	The core of the service: showing plans and trip overlaps.	Other users. Women-only plans are shown only to women.
Messages and photos you send in chats	To deliver them to the chat's members.	Members of that chat. We access them only to investigate reports.
Reports and blocks	To keep the community safe.	Only us. The person you report or block is not told.
Subscription purchase records	To give you Waypal Plus. Google processes payments; we never see your card details.	Only us and Google.
Device push token	To send notifications you've allowed (new messages, someone joined your plan).	Only us.
Technical logs (IP address, app version, errors)	Security, abuse prevention and fixing bugs.	Only us.

We do not collect contacts, call logs, SMS, microphone audio or your camera roll beyond the photos you choose to upload.

2. Legal bases (EEA/UK users)

We process your data to perform our contract with you (running your account and the features you use), on the basis of your consent (location and notifications, which you can switch off in your phone settings), and for our legitimate interests in keeping Waypal safe and working (moderation, security logs, fraud prevention). We keep purchase records where the law requires it.

3. Who we share data with

We don't sell or rent personal data, and we don't use advertising trackers. We use these service providers, only for the purposes listed:

Contabo — server hosting (data stored in Singapore).
Cloudflare — image storage (R2) and network protection.
Resend — sending sign-in code emails.
Google — Google Play billing and, if you allow notifications, Firebase Cloud Messaging.
OpenAI — generating plan ideas. We send only the city name and the kind of plan you asked for, never your name or profile.
OpenStreetMap services (Nominatim, Photon, OpenFreeMap) — turning coordinates into a city name, place search, and map tiles. These receive coordinates or search text, not your identity.

We may disclose data if the law requires it, or to protect someone's safety when we believe in good faith that there is a serious risk of harm.

4. International transfers

Our servers are in Singapore and some providers process data in the United States and elsewhere. Where the law requires, transfers rely on the provider's standard contractual clauses or an equivalent safeguard.

5. How long we keep data

Your account: until you delete it.
When you delete your account: your profile, photos, location, trips and plan memberships are erased immediately. Your messages are replaced with "[deleted]". Plans you hosted are cancelled.
Kept after deletion: reports you made or that were made about you (for up to 2 years, so repeat abuse can be stopped), and subscription purchase records (as required by tax law, up to 8 years). These are not linked to a visible profile.
Sign-in codes: expire after 10 minutes. Technical logs: up to 30 days.

6. Your rights and choices

Access, correct, or delete: edit your profile in the app, or delete your account under Profile → Delete account. See how to delete your account.
Location and notifications: switch them off at any time in your phone's settings. Waypal still works with a city you choose.
Copy of your data or objection: email support@hookstep.in. We reply within 30 days.
If you are in the EEA or UK, you can complain to your local data protection authority. In India, you may contact us as the data fiduciary under the Digital Personal Data Protection Act, 2023.

7. Age limit

Waypal is only for people aged 18 and over. We don't knowingly collect data from anyone younger. If we learn an account belongs to someone under 18, we delete it. See our child safety standards.

8. Security

Data is encrypted in transit (HTTPS). Sign-in uses one-time codes, not passwords, and sessions can be revoked by logging out. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

9. Changes

If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.

10. Contact

JR Consulting Co. · support@hookstep.in