Privacy Policy
Last updated: April 8, 2026
1. Data Controller
Wandertribe is published by:
Guillaume Roudaut 2 rue Anatole France, 29480 Le Relecq-Kerhuon, France Contact: roudaut.guillaume29@gmail.com
2. Data We Collect
When you use Wandertribe, we collect the following data:
Identity Data
- Full name
- Email address
- Date of birth (to verify you are 18+)
- Nationality
Profile Data
- Profile photo
- Bio / description
- Interests (passions)
- Languages spoken
- Countries visited
Location Data
- GPS coordinates (latitude and longitude) collected while the app is in the foreground
- Location is refreshed each time the app returns to the foreground (no background tracking)
- Country determined by reverse geocoding via the device's native services (iOS/Android)
- Used to show nearby people, events and groups
Communication Data
- Private messages exchanged with other users
- Posts, comments and reactions (likes)
Technical Data
- Push notification token (unique device identifier for sending notifications)
- Device language preference
- Device type (iOS or Android)
- JWT authentication tokens
3. Purposes and Legal Bases
| Processing | Purpose | Legal Basis |
|---|---|---|
| Account creation | Registration and authentication | Performance of a contract (Art. 6.1.b GDPR) |
| GPS location | Display of geolocated content | Consent (Art. 6.1.a GDPR) |
| Profile photo | Visual identification between users | Performance of a contract (Art. 6.1.b GDPR) |
| Private messages | Messaging feature | Performance of a contract (Art. 6.1.b GDPR) |
| Push notifications | Real-time alerts | Consent (Art. 6.1.a GDPR) |
| Moderation | Community safety | Legitimate interest (Art. 6.1.f GDPR) |
| Email verification | Identity confirmation and security | Performance of a contract (Art. 6.1.b GDPR) |
4. Recipients of Your Data
Your data may be shared with the following service providers for the operation of the application:
- Amazon Web Services (AWS S3, region eu-north-1 — Stockholm, EU) — storage of profile, event and group photos
- SMTP Provider — sending transactional emails (account verification, password reset)
- Google Places API — location autocomplete when creating events
- Expo (Expo Push Notification Service) — sending push notifications to your iOS and Android devices
These providers act as data processors and are bound by GDPR-compliant confidentiality commitments.
5. International Data Transfers
Some of our service providers (Amazon Web Services, Google, Expo) may be established or process data outside the European Union. These transfers are governed by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 of the GDPR.
6. Retention Periods
| Data | Retention Period |
|---|---|
| Active account | Duration of account use |
| Account data after deletion | Immediate and permanent deletion upon request |
| Private messages | Duration of the conversation |
| Session tokens (JWT) | 15 minutes (access token), 7 days (refresh token) |
| OTP codes (email verification) | 15 minutes |
| OTP codes (password reset) | 15 minutes |
| Moderation logs | 1 year |
7. Your Rights
Under GDPR, you have the following rights:
- Right of access — obtain a copy of your personal data
- Right of rectification — correct inaccurate data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to data portability — receive your data in a structured, machine-readable format. You can request a full export of your data directly from the app settings. The export is generated in JSON format and sent by email to your registered address. It includes: profile, posts, comments, sent messages, created events, created groups, friends, friend requests, saved posts and notifications.
- Right to object — object to certain processing based on legitimate interest
- Right to restriction — temporarily suspend processing
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
To exercise your rights, contact us at: roudaut.guillaume29@gmail.com
You can also delete your account directly from the app settings, which triggers the immediate and permanent deletion of all your data.
8. Data Security
We implement appropriate technical and organisational measures to protect your data:
- Passwords hashed with bcrypt (10 salt rounds)
- Short-lived JWT authentication tokens (15 minutes)
- All communications encrypted via HTTPS/TLS
- Photo access protected by signed URLs (1-hour expiry)
- Authentication tokens stored in a secure enclave on your device
9. Minors
Wandertribe is for users aged 18 and over. We verify age at registration. If we discover a minor has created an account, we will delete it immediately.
10. Complaints
If you believe your rights are not being respected, you have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL:
CNIL — 3 Place de Fontenoy, 75007 Paris, France www.cnil.fr
11. Changes to This Policy
We reserve the right to modify this policy at any time. In the event of a material change, you will be notified via the app or by email. The date of the last update is shown at the top of this page.