WAYFARER CLUB


PRIVACY POLICY


Last Updated / Effective Date: September 30, 2026



Applicable Application: Wayfarer Club (iOS, Android, and associated Web Services)



Operating Entity / Data Fiduciary: Uncharted Frontiers Private Limited



Official Portal: https://wayfarer.club/



Dedicated Deletion URL: https://wayfarer.club/delete-account



1. INTRODUCTION AND SCOPE

1.1. Commitment to Privacy: Uncharted Frontiers Private Limited ("Company", "we", "us", or "our"), a company incorporated under the Companies Act, 2013, with its registered office in Kolkata, West Bengal, India, operates the Wayfarer Club mobile application ("App") and website located at https://wayfarer.club/ ("Website") (collectively, the "Services"). We are committed to protecting your privacy, handling your personal data transparently, and securing your information.



1.2. Statutory Framework: This Privacy Policy ("Policy") governs the collection, processing, storage, disclosure, transfer, and deletion of personal data obtained from users ("User", "you", or "your") of our Services. This Policy is published in strict compliance with:



  • The Digital Personal Data Protection Act, 2023 (DPDPA) of India;


  • Section 43A of the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;


  • Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;


  • Apple App Store Review Guidelines (specifically Guideline 5.1.1 on Data Collection and Storage); and


  • Google Play Developer Program Policies (specifically the User Data Policy and Data Safety requirements).

    1.3. Binding Acceptance: By downloading, installing, registering an account with, accessing, or using the App or Services, you acknowledge that you have read, understood, and consented to the practices described in this Policy. If you do not agree with this Policy, you must not access or use the Services.


2. AGE ELIGIBILITY: STRICT 18+ REQUIREMENT

2.1. Adult Platform Only: The App is designed solely for motorcycling enthusiasts who are at least eighteen (18) years of age. We do not knowingly solicit, target, collect, or process personal data from individuals under 18 years of age.



2.2. No Minor Data Processing: In compliance with Section 9 of the Digital Personal Data Protection Act (DPDPA), 2023, the Children’s Online Privacy Protection Act (COPPA), and Google Play Families Policy, we do not engage in tracking, behavioral monitoring, or targeted advertising directed at minors.



2.3. Immediate Purging of Minor Accounts: If we discover or are notified that an individual under the age of 18 has created an account or provided personal information, we will immediately deactivate the account, permanently delete all associated personal data from our active databases, and cease processing such data without delay. Inquiries regarding minor data should be sent directly to support@wayfarer.club.



3. CATEGORIES OF DATA WE COLLECT

We collect only the minimum personal data necessary to provide, secure, and maintain the Services. The data collected falls into the following distinct categories:



A. Data Provided Directly by You

  • Account Registration & Identity Data: When you create an account using our custom authentication system, we collect your email address and an encrypted hash of your password. You may also voluntarily provide profile details such as your display name, handle, bio, riding interests, or motorcycle details.


  • User-Generated Content (UGC): Text posts, route notes, comments, in-app communications, and photographs that you voluntarily upload, publish, or transmit through context-driven features.


  • Support & Inquiries: Records of communications, crash reports, feedback, and customer support queries sent to support@wayfarer.club or ceo@wayfarer.club.


B. Ephemeral, Event-Driven Geolocation Data (Strictly Non-Continuous)

  • One-Off Location Coordinates: The App collects latitude and longitude coordinates only on a strictly event-driven, one-off basis. This occurs exclusively when you interact with specific location-dependent features (e.g., tagging a waypoint, pinning a spot, or setting a ride start point) and explicitly tap the corresponding in-app action button.


  • NO Continuous Tracking: The App does NOT track, trace, log, or harvest your real-time location continuously in the foreground, nor does it run background location tracking or breadcrumb logging when the phone is locked, asleep, or running in your pocket. Once the discrete event completes, location extraction ceases immediately.


C. Automatically Collected Technical and Device Data

When you run the App, certain diagnostics and technical metadata are collected via embedded SDKs to maintain performance and prevent crashes:



  • Device Identifiers: Device model, hardware model, operating system version (iOS/Android), unique device identifiers, language settings, and network carrier information.


  • Application Diagnostics & Usage Data: App launch times, session duration, memory usage, API latency, crash logs, and stack traces (collected via Firebase Crashlytics and Firebase Performance Monitoring).


  • Network Data: Internet Protocol (IP) address, network connection type (Wi-Fi, 4G, 5G), and general coarse geographic region derived from the IP address (country or state level).


D. In-App Purchase and Transaction Records

  • Native Store Receipts: For in-app purchases of non-renewing subscriptions, virtual non-crypto tokens, and consumable digital goods, we process transaction receipt validation data via RevenueCat. This includes purchase tokens, transaction timestamps, currency codes, product identifiers, and subscription expiration dates.


  • No Financial Card Storage: We do not collect, view, or store your primary credit card numbers, debit card details, UPI IDs, or banking credentials for native in-app purchases. All native transactions are handled securely by Apple Media Services or Google Play Billing.


  • Decoupled Web Purchases (Razorpay): For standalone transactions conducted on the Website (https://wayfarer.club/), payment processing is handled independently by Razorpay. We receive transaction status, order IDs, and basic billing contact info, but we do not store sensitive payment card credentials on our servers.


4. MOBILE DEVICE PERMISSIONS

To deliver specific features, the App requests access to certain native device permissions. Each permission requires your explicit, runtime authorization:



PermissionTechnical Requirement & In-App PurposeAccess TypeCameraAllows you to capture real-time photographs directly within the App for your profile avatar or context-driven community posts.Runtime Prompt / Only while activePhoto Library / StorageEnables you to browse, select, and upload pre-existing photos or images from your device storage to the App.Runtime Prompt / Selected media onlyGeolocation (GPS / Coarse & Fine)Required strictly to capture a single, discrete coordinate pin when you explicitly trigger a location-based feature.Event-Driven Only / No continuous or background trackingPush NotificationsUsed to deliver important account notices, security updates, transactional messages, and community interaction alerts.Opt-in via system prompt

Permission Revocation: You can grant or revoke these permissions at any time via your device’s system settings (Settings > Wayfarer Club on iOS, or Settings > Apps > Wayfarer Club > Permissions on Android). Revoking a permission may disable the specific feature dependent on that hardware capability.



5. PURPOSES AND LEGAL BASES FOR PROCESSING

Under the DPDPA 2023 and applicable privacy standards, we process your personal data under explicit, lawful grounds:



Processing PurposeCategories of Data UsedLawful Basis (DPDPA / International Standards)Account Creation & AuthenticationEmail address, hashed password, display nameContractual Necessity (Providing requested Services)Delivering Gated Community FeaturesUser-Generated Content, media, contextual textContractual Necessity & Explicit User ConsentExecuting One-Off Location FeaturesSingle-event GPS coordinatesExplicit, Event-Driven User ConsentManaging Subscriptions & TokensRevenueCat transaction identifiers, expiration statusContractual Necessity & Legal ComplianceBug Fixing & Performance OptimizationCrash logs, device metrics, stack traces (Firebase)Legitimate Use (Maintaining service stability & security)Transactional CommunicationsEmail, SMS, WhatsApp (via Zoho CPaaS)Contractual Necessity & Legitimate UseSecurity, Fraud & Crime PreventionIP address, login logs, device metadataCompliance with Legal Obligations & Intermediary Rules

6. THIRD-PARTY DISCLOSURES AND EMBEDDED SDKS

We do not sell, rent, commercialize, or trade your personal data. We disclose your data only to verified third-party technical infrastructure providers ("Data Processors") strictly necessary to deliver the Services. Each partner operates under contractual confidentiality and data security obligations:



Third-Party Provider / SDKRole / FunctionData Shared / ProcessedProvider Privacy DocumentationXano Inc.Cloud backend, primary database hosting, and custom authentication management.User accounts, profiles, UGC, timestamps, encrypted credentials.Xano Privacy PolicyGoogle Firebase (Google LLC)App analytics, crash reporting (Crashlytics), performance telemetry, and Push Notifications (FCM).Device IDs, IP address, OS version, crash logs, diagnostic events.Firebase Privacy & SecurityGoogle Maps API (Google LLC)Map visualization, point-of-interest display, and spatial context.Transient coordinate requests, IP address.Google Privacy PolicyRevenueCat, Inc.In-app purchase verification, store receipt validation, and subscription status tracking.App User ID, transaction receipts, product SKU, purchase timestamp.RevenueCat Privacy PolicyZoho Corporation (Zoho CPaaS)Delivering transactional notifications, verification emails, SMS, and WhatsApp alerts.User email address, registered mobile number, message payloads.Zoho Privacy PolicyRazorpay Software Pvt. Ltd.Payment gateway processing for standalone web purchases (decoupled from native app).Web transaction amounts, order IDs, billing contact info.Razorpay Privacy Policy

Statutory Disclosures: We may disclose personal data to law enforcement, judicial bodies, or regulatory authorities where required by applicable law, court order, or formal summons (such as Section 91 of the Code of Criminal Procedure, 1973 / corresponding Bharatiya Nagarik Suraksha Sanhita, 2023), or to investigate suspected illegal acts, rash riding, street racing, fraud, or threats to physical safety.



7. CROSS-APP TRACKING AND ADVERTISING TRANSPARENCY

7.1. No Data Brokerage or Sale: We do not sell your personal data, nor do we disclose it to data brokers or advertising exchanges.



7.2. No Cross-App Tracking: The App does NOT track you across third-party websites, applications, or offline properties for targeted behavioral advertising.



7.3. Apple App Tracking Transparency (ATT): Because the App does not engage in cross-app tracking, does not utilize the Apple Identifier for Advertisers (IDFA) for behavioral advertising, and does not share tracking profiles with third-party ad networks, an iOS App Tracking Transparency (ATT) prompt is not requested.



8. DATA STORAGE, SECURITY, AND INTERNATIONAL TRANSFERS

8.1. Security Standards: We implement robust technical, administrative, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, accidental loss, or destruction. These include:



  • Encrypted data transmission using Transport Layer Security (TLS 1.2/1.3 / HTTPS);


  • Robust cryptographic hashing (e.g., Argon2 or bcrypt) for user passwords;


  • Access controls, network firewalls, and least-privilege administrative access to our Xano backend; and


  • Continuous server monitoring and vulnerability patch management.

    8.2. Cross-Border Transfers: Your personal data is stored and processed on secure cloud servers operated by our trusted infrastructure providers (such as Xano and Google Cloud/Firebase). These servers may be located in India, the United States, or other jurisdictions. Whenever cross-border data transfers occur, we ensure compliance with Section 16 of India’s DPDPA 2023 and implement standard contractual safeguards to maintain equivalent protection across all destinations.


9. DATA RETENTION POLICY

9.1. Active Account Duration: We retain your personal data for as long as your account remains active and registered on the App.



9.2. Deletion Upon Request: When you delete your account (via in-app controls, web portal, or email request), your personal identifiers, profile data, UGC, and custom credentials are permanently deleted or irreversibly anonymized within thirty (30) days of the request, except where extended retention is required by law.



9.3. Statutory and Financial Exceptions: Certain transactional and audit records may be retained for longer statutory periods where strictly required by applicable law (e.g., Indian Companies Act, 2013, tax and accounting regulations, or active litigation hold requirements). Diagnostic crash data held within Firebase Crashlytics is retained for up to 90 days in aggregated, non-personally identifiable form before automated purging.



10. ACCOUNT AND DATA DELETION PROCEDURES

In full compliance with Apple App Store Review Guideline 5.1.1(v) and the Google Play Data Safety and Deletion Policy, we provide three accessible, permanent account and data deletion mechanisms:





┌────────────────────────────────────────────────────────────────────────┐ │ ACCOUNT & DATA DELETION CHANNELS │ ├────────────────────────────────┬───────────────────────────────────────┤ │ 1. Direct In-App Deletion │ Settings > Account > Delete Account │ │ 2. Public Web Deletion Portal │ https://wayfarer.club/delete-account │ │ 3. Direct Email Request │ support@wayfarer.club │ └────────────────────────────────┴───────────────────────────────────────┘

10.1. Method 1: Direct In-App Account Deletion:



  • Open the Wayfarer Club App on your device;


  • Navigate to: Settings > Account > Delete Account;


  • Review the deletion warning screen and confirm your choice.


  • Outcome: Your session is terminated immediately, your account is queued for permanent deletion, and data removal is finalized within thirty (30) days.

    10.2. Method 2: External Web Deletion Route (No App Installation Required):


  • Visit our publicly accessible deletion portal directly at:



    https://wayfarer.club/delete-account (linked directly from the root website at https://wayfarer.club/);


  • Authenticate or submit your registered account email address;


  • Confirm the deletion request via the verification email sent to your registered address.

    10.3. Method 3: Direct Email Request:


  • Send an email to support@wayfarer.club with the subject line: "Account Deletion Request";


  • Submit the request from the email address registered with your Wayfarer Club account;


  • Our team will verify your ownership and process the complete deletion within statutory timelines.

    10.4. Scope of Deletion: Deletion encompasses your authentication credentials, personal profile, device identifiers, submitted UGC, and any unused virtual Tokens. Non-renewing subscriptions are terminated upon account deletion and cannot be restored.


11. YOUR DATA PROTECTION RIGHTS

Under the Digital Personal Data Protection Act (DPDPA), 2023, and applicable data protection regulations, you possess specific statutory rights regarding your personal data:



  • Right to Access Information: You have the right to request a summary of the personal data we process about you and the identities of third-party processors with whom it has been shared.


  • Right to Correction and Rectification: You have the right to request correction of inaccurate, misleading, or outdated personal data, or completion of incomplete data.


  • Right to Erasure / Deletion: You have the right to request the permanent erasure of your personal data, subject to Section 10 of this Policy.


  • Right to Nominate: In accordance with Section 14 of the DPDPA 2023, you have the right to nominate an individual who, in the event of your death or incapacity, shall exercise your privacy rights.


  • Right of Grievance Redressal: You have the right to register complaints with our designated Grievance Officer regarding any suspected failure of compliance.


To exercise any of these rights, please contact our Grievance Officer at support@wayfarer.club. We will verify your identity before processing the request.



12. GRIEVANCE REDRESSAL OFFICER (INDIA IT RULES & DPDPA COMPLIANCE)

12.1. Designated Officer: In compliance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 13 of the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Redressal Officer are as follows:



  • Designation: Grievance Officer


  • Company Name: Uncharted Frontiers Private Limited


  • Corporate Jurisdiction: Kolkata, West Bengal, India


  • Official Support & Grievance Email: support@wayfarer.club


  • Developer / Executive Inquiries: ceo@wayfarer.club


  • Subject Line Format: Attn: Grievance Officer — Privacy & Data Inquiry


12.2. Statutory Redressal Timelines:



  • Acknowledgment: The Grievance Officer will acknowledge receipt of your complaint or grievance within twenty-four (24) hours of receipt.


  • Resolution: The Grievance Officer will investigate and resolve the grievance within a maximum period of fifteen (15) days from the date of receipt.


13. CHANGES AND UPDATES TO THIS PRIVACY POLICY

We reserve the right to amend, update, or revise this Privacy Policy periodically to reflect changes in our legal obligations, technical integrations, or platform operations. When modifications occur, we will update the "Last Updated" date at the top of this Policy. For material changes that substantially impact your rights or how we handle your data, we will provide prominent advance notice (such as an in-app banner, push notification, or email notification to your registered address). Continued use of the App or Services after the effective date of an amended Policy indicates your acceptance of the revised terms.



14. CONTACT INFORMATION

For questions, clarifications, feedback, or requests regarding this Privacy Policy or your personal information, please contact us at:



Uncharted Frontiers Private Limited



Kolkata, West Bengal, India