Wanderpath

Privacy Policy

Last updated: 2026-10-26

This Privacy Policy explains how Wanderpath (“we”, “us”) collects, uses, and protects personal data when you visit wanderpath.co or use our services. Wanderpath is operated as a sole proprietorship by Vitalii Shevliakov, registered at Deventerstraat 184, 7321CG Apeldoorn, the Netherlands (KvK 42011587). For any privacy-related question you can reach us at support@wanderpath.co.

1. What data we collect

  • Account data — email address, display name, and (optionally) an avatar image, collected when you sign up. If you sign in with Google, we receive your email address, name and profile picture from Google; we never receive your Google password.
  • Purchase data — items purchased, amount, currency, transaction identifier. Card details are handled directly by Stripe; we never see or store them.
  • Usage data — pages visited, actions taken, approximate location derived from IP, device and browser fingerprint, collected through analytics and error-tracking tools (in your browser only after you consent to them, see section 4).
  • Communications — any messages you send us by email or support form.
  • Reviews and submitted content — text, ratings, and any media you upload while reviewing a route or contacting us.

2. Why we use your data

  • To provide the service you signed up for (create an account, sell and deliver route content).
  • To process payments and prevent fraud (lawful basis: performance of a contract, legitimate interest).
  • To send transactional emails — purchase confirmations, refunds, password resets.
  • To measure how the product is used and to fix bugs (lawful basis: legitimate interest).
  • To comply with our legal obligations (accounting, tax, consumer protection).

3. Third-party processors

We share the minimum amount of data necessary with the following service providers. They act as processors on our behalf and are bound by their own privacy policies and Data Processing Agreements.

  • Supabase — database, authentication, file storage. Region: EU (Frankfurt).
  • Stripe — payments, billing, payouts. Region: Ireland (EU) with sub-processing in the US.
  • Resend — transactional email delivery.
  • Vercel — hosting and CDN for the site. Our server functions currently run in the United States (Washington, D.C. region), so requests you make to the site are processed there. If you accept analytics, Vercel Web Analytics and Speed Insights also collect anonymous page-view and performance data (without cookies).
  • PostHog — product analytics (page views, button clicks, conversion funnels). We use the EU cloud, and analytics start only after you accept them in the cookie banner.
  • Sentry — error tracking. Captures stack traces and may include browser metadata. In your browser it runs only after you accept error tracking; session replay is off. Errors raised on our servers are also reported, with personal data fields removed before sending.
  • MapTiler, Thunderforest, Esri (ArcGIS) — map tiles and place search. When a map is shown, your IP address and the map area you view are sent to these providers to render the tiles; place names typed into the route editor go to MapTiler (and, for some searches, Wikipedia).
  • Unsplash — photo hosting for cover images. Loads images from their CDN.
  • Anthropic, Google (Gemini and Places API) — used by our content-generation pipeline. Public POI queries only; no user-identifying data is sent.
  • DeepL, OpenAI — automatic translation of published route content (titles, descriptions, tips) and, for OpenAI, checking of waypoint coordinates. They receive route text only, not account data.
  • Google (Sign in with Google) — optional sign-in method. Google tells us your email, name and profile picture when you choose it; Google's own privacy policy applies to its side of the sign-in.

Some of these providers are based in or use sub-processors in the United States. Where that is the case we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses as the legal basis for the transfer.

4. Cookies and similar technologies

Wanderpath uses a small number of cookies and similar technologies. We do not use advertising cookies and we do not sell your data to third parties.

  • Strictly necessary — Supabase authentication cookies (to keep you signed in), theme and sidebar preferences, locale selection. These cannot be disabled.
  • Analytics — PostHog uses a first-party cookie to attach events to a session ID. Vercel Web Analytics and Speed Insights set no cookies. All of them start only after you accept analytics in the cookie banner.
  • Error tracking — Sentry may attach a session ID to crash reports. In your browser only after you accept error tracking.

Your cookie choice is stored in your browser. You can withdraw your consent at any time by clearing this site's data in your browser settings or by emailing us. Clearing necessary cookies will sign you out.

5. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability and to withdraw consent at any time. To exercise any of these rights, please email support@wanderpath.co from the address linked to your account. We aim to respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

6. Data retention

Account and purchase data is kept for as long as your account is active and for up to seven years after that for accounting purposes (the retention period required under Dutch law). Analytics events are retained for up to 24 months. Error logs are retained for up to 90 days.

7. Children

Wanderpath is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we will delete it.

8. Changes to this policy

We may update this Privacy Policy occasionally. When we do, we will revise the “Last updated” date above. Material changes will be communicated to registered users by email.

9. Contact

Vitalii Shevliakov · Deventerstraat 184, 7321CG Apeldoorn, the Netherlands · KvK 42011587 · support@wanderpath.co