Privacy Policy

We collect the following categories of information to provide and improve the Services:

1.1 Account Registration Information

Registration is required to use WDIF. When you create an account, we collect:

• Full name, email address, date of birth, gender, country, and city.
• Password (stored in encrypted form; we never store plain-text passwords).
• If you register using Google Sign-In or Apple Sign-In, we receive your name and email address from those providers only, subject to your settings with them. We do not receive your Google or Apple passwords.

1.2 Trip and Packing Information

• Destination, travel dates, trip type, and other trip details you enter.
• Packing lists, preferences, and customizations you create and save.
• Travel reminders you set within the app.

1.3 Location Information

With your explicit permission, we collect your precise GPS location (foreground only — we do not access your location when the app is not in use). We use this solely to:

• Deliver accurate, real-time weather conditions and forecasts for your current location or travel destination.
• Suggest contextually relevant packing items based on your departure location.

You may grant or revoke location permission at any time through your device settings (iOS: Settings › Privacy › Location Services; Android: Settings › Apps › WDIF › Permissions). Revoking location access may limit certain features but will not prevent you from using the app.

1.4 Push Notification Data

With your permission, we send push notifications for trip reminders and travel updates. To deliver these, we process a device push token assigned by Apple (APNs) or Google (FCM). You can disable push notifications at any time through your device settings without losing access to the app.

1.5 Payment and Subscription Information

WDIF offers in-app purchases and subscription plans. Payments are processed through Apple Pay or Google Pay, depending on your device and selected payment method. WDIF does not directly request, collect, process, or store your payment card information. When you make a payment:

• Your payment information is entered and processed securely by Apple or Google and is not transmitted to, stored by, or accessible to WDIF.
• Apple or Google provides us only with the information necessary to confirm the transaction, such as the payment status, transaction reference, and subscription or purchase confirmation.
• Apple and Google handle payment data under their own terms and privacy policies.
• WDIF does not store, log, or have access to your raw card or banking information at any point in the payment process.

When your subscription lapses, expires, or is cancelled, your account is downgraded to the free tier and your data is retained unless you separately request deletion.

1.6 Mornel AI — ChatGPT (OpenAI)

Our in-app AI travel assistant, Mornel AI, is powered by the OpenAI API (ChatGPT). When you interact with Mornel AI:

• Your queries and relevant trip context are transmitted to OpenAI's servers to generate responses.
• OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring purposes, after which they are deleted, unless you or we have opted out of retention. We have configured our OpenAI API integration with data retention opt-out where available.
• OpenAI does not use API inputs and outputs to train its models by default. For full details, refer to OpenAI's API Privacy Policy.
• We do not use your Mornel AI conversations to build advertising profiles or share them with any third party other than OpenAI as described above.
• Do not enter sensitive personal information (e.g., passport numbers, financial details, medical information) into the Mornel AI chat.

1.7 Automatically Collected Technical Data

We use the following third-party analytics and diagnostics tools:

• Firebase (Google) — for app analytics, crash reporting, and performance monitoring. Firebase may collect device identifiers and usage events. Firebase's privacy practices are governed by Google's Privacy Policy.
• Additional analytics or crash reporting SDKs we may use in the future will be disclosed in updates to this policy.

All analytics data collected is used solely for service improvement and is not used for targeted advertising.

1.8 Communications

• Messages you send to hello@wdif.app or support@wdif.app, including any information you voluntarily include.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract (Article 6(1)(b)) — processing your account information, trip data, and subscription status is necessary to provide the Services you have registered for.
• Consent (Article 6(1)(a)) — precise GPS location access and push notifications are processed only on the basis of your explicit consent, which you may withdraw at any time via device settings.
• Legitimate interests (Article 6(1)(f)) — analytics, crash reporting, fraud detection, and security monitoring are processed on the basis of our legitimate interests in maintaining and improving a secure, functional service, provided these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)) — we may process data where required to comply with applicable law.

Where processing is based on consent, withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We use the data we collect strictly for the following purposes:

• To create and manage your account and authenticate you securely, including via Google or Apple Sign-In.
• To generate personalized packing lists, travel reminders, and weather updates based on your trip details and location.
• To operate Mornel AI via the OpenAI API, transmitting only the minimum query context necessary to generate a relevant response.
• To process and manage your in-app subscriptions and purchases through Apple Pay or Google Pay.
• To send push notifications relevant to your trips, which you can opt out of at any time.
• To provide customer support and respond to your inquiries.
• To analyze anonymized, aggregated usage data via Firebase to understand app performance and improve features.
• To detect, investigate, and prevent fraudulent activity, security incidents, and violations of our Terms & Conditions.
• To comply with applicable laws and regulatory obligations.

We do not sell, rent, or trade your personal data to third parties. We do not use your data to serve you third-party advertisements.

• We receive only your name and email address from Google or Apple Sign-In, as permitted by your account settings with them.
• We do not receive, store, or have access to your Google or Apple passwords.
• Google Sign-In is governed by Google's Privacy Policy. Apple Sign-In is governed by Apple's Privacy Policy.
• You may disconnect third-party sign-in from within your WDIF account settings at any time.

We do not share your personal information with third parties except in the following limited and necessary circumstances:

5.1 Service Providers

We share data with the following categories of trusted third-party vendors who help us operate the Services:

• Cloud hosting and infrastructure providers.
• OpenAI (for Mornel AI query processing) — see Section 1.6.
• Firebase / Google (for analytics and crash reporting) — see Section 1.7.
• Apple (APNs) and Google (FCM) for push notification delivery.
• Apple and Google for payment processing through Apple Pay or Google Pay — see Section 1.5.
• Customer support tools.

All service providers are contractually prohibited from using your data for any purpose other than performing services on our behalf and are required to maintain appropriate data security standards.

5.2 Apple Pay and Google Pay

Payment transactions are processed through Apple Pay or Google Pay, depending on your device and selected payment method. We provide Apple or Google only with the minimum information necessary to complete and confirm your transaction. We do not share your trip data or AI conversation history for payment processing. Apple and Google handle payment information under their own terms and privacy policies.

5.3 Weather Data Providers

To deliver weather information, we transmit your destination city or coordinates to third-party weather API providers. We share only the minimum data necessary and do not transmit any personally identifying information beyond what is technically required.

5.4 Legal Requirements

We may disclose your information if required by applicable law, regulation, legal process, or enforceable governmental request in any jurisdiction in which we operate or where our users are located.

5.5 Protection of Rights and Safety

We may disclose information where we believe in good faith that it is necessary to prevent fraud, protect the security of the Services, enforce our Terms & Conditions, or protect the rights, property, or safety of WDIF, our users, or the public.

5.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will provide advance notice via email or prominent in-app notice and ensure continued protection of your data.

We retain your personal data for as long as your account is active or as necessary to provide the Services. Specific retention periods:

• Account and trip data: retained for the duration of your account, plus up to 90 days after deletion to allow for recovery requests.
• Push notification tokens: deleted promptly upon account deletion or when the token is invalidated by Apple or Google.
• Support communications: retained for up to 2 years for quality assurance and legal purposes.
• Analytics data (Firebase): subject to Firebase's retention settings, typically 14 months for user-level data.
• Mornel AI query data (OpenAI): retained by OpenAI for up to 30 days as described in Section 1.6.

You may request deletion of your account and personal data at any time by contacting support@wdif.app. Upon a verified deletion request, we will remove your data within 30 days, except where retention is required by law. Anonymized and aggregated data that cannot identify you may be retained indefinitely.

• Encrypted data transmission using TLS (Transport Layer Security) for all data in transit.
• Encrypted storage of passwords and sensitive credentials.
• Role-based access controls limiting internal access to user data.
• Regular security assessments and monitoring.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security. In the event of a data breach that materially affects your personal data, we will notify you as required by applicable law, including within the timeframes specified by GDPR for EU/UK users and equivalent data protection laws in other jurisdictions.

WDIF has designated a point of contact for all privacy and data protection matters:

• Privacy contact: support@wdif.app

If you are located in the European Economic Area or United Kingdom and have concerns about our data practices that we have not resolved to your satisfaction, you have the right to lodge a complaint with your local data protection supervisory authority.

WDIF is intended exclusively for users aged 18 and above. We do not knowingly collect personal information from individuals under 18. During registration, users are required to confirm they are 18 or older. If we become aware that a user under 18 has created an account, we will suspend the account and delete associated data promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at support@wdif.app.

Depending on your country or region, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request erasure of your personal data, subject to lawful retention requirements.
• Portability — receive your data in a structured, machine-readable format.
• Objection or restriction — object to or request restriction of certain processing activities.
• Withdraw consent — for location access and push notifications, withdraw consent at any time via device settings.
• Opt out of communications — unsubscribe from non-essential emails via the unsubscribe link or by contacting us.
• Lodge a complaint — EU/UK users may lodge a complaint with their local data protection authority.
• California (CCPA) rights — California residents may request disclosure of data categories collected, sold, or disclosed, and may opt out of any sale of personal data. We do not sell personal data.

To exercise any of these rights, contact support@wdif.app. We will respond to all verified requests within 30 days (or within the timeframe required by your local law, whichever is shorter). We may verify your identity before processing requests.

Push notifications are opt-in and require your permission during onboarding or via device settings. They are used solely for trip reminders and service updates. You may disable them at any time in device settings (iOS: Settings › Notifications › WDIF; Android: Settings › Apps › WDIF › Notifications) without losing access to any app features.

WDIF offers optional premium subscriptions and one-time purchases, processed through Apple Pay or Google Pay depending on your device and selected payment method. WDIF does not directly request, collect, or store payment card or banking information. Payment information is handled by Apple or Google under their own terms and privacy policies. When a subscription is cancelled or expires, your account reverts to the free tier and your data is retained in accordance with Section 6. For billing or refund queries, please refer to our Refund Policy or contact support@wdif.app.

Our website at wdif.app uses cookies and similar technologies. On your first visit, a cookie consent banner will ask for your preferences before any non-essential cookies are set. You can update your cookie preferences at any time via the cookie settings link in the website footer. Essential cookies required for site functionality are set without consent.

Cookie categories we use:

• Essential cookies — required for basic site functionality. Always active.
• Analytics cookies — used to understand visitor behavior (e.g., page views, referral sources). Active only with your consent.

Our mobile application uses Firebase SDKs that collect usage and diagnostic data as described in Section 1.7. These do not set browser cookies and are governed by Firebase's data practices.

Our Services may contain links to third-party websites or integrate with external platforms. This Privacy Policy applies solely to WDIF's Services. We are not responsible for the data practices of third parties and encourage you to review their privacy policies independently.

WDIF is a globally available service. We do not designate a single national legal system as the exclusive governing framework for data protection. We are committed to protecting your personal data in accordance with internationally recognized data protection principles and the applicable laws of the jurisdictions in which we operate and serve users.

Your data may be transferred to and processed in countries outside your country of residence, including the United States (OpenAI, Firebase/Google). We take the following steps to ensure adequate protection:

• For EU/UK users: transfers are conducted in accordance with GDPR or UK GDPR requirements, including through Standard Contractual Clauses (SCCs) where applicable.
• For all users: we contractually require third-party processors to maintain data protection standards equivalent to those described in this policy.

WDIF is distributed via the Apple App Store and Google Play Store. Our data practices are fully disclosed in each platform's Data Safety section (Google Play) and Privacy Nutrition Label (App Store). In the event of any conflict between those platform disclosures and this Privacy Policy, this Privacy Policy governs.

We comply with Google Play's User Data Policy and Apple's App Store Review Guidelines. Payments within the App are processed through Apple Pay or Google Pay, depending on your device and selected payment method. We do not use sensitive user data for undisclosed purposes, and we do not collect data beyond what is described in this policy.

To the fullest extent permitted by applicable law, WDIF shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of, or inability to use, the Services — including but not limited to unauthorized access by third parties, data loss, AI-generated content from Mornel AI, or any event beyond our reasonable control.

Our total aggregate liability for any claim arising out of or relating to this Privacy Policy shall not exceed the amount you have paid us in the twelve (12) months preceding the event, or AED 100 if no payments have been made. Nothing in this section limits liability that cannot be excluded under applicable mandatory law, including GDPR for EU/UK users.

We may update this Privacy Policy periodically. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Notify you via email to your registered address and/or a prominent in-app notice at least 14 days before the changes take effect.
• Where required by law (e.g., for new consent-based processing), request your renewed consent.

Your continued use of WDIF after the effective date constitutes acceptance of the revised terms. If you disagree with any changes, you may stop using the Services and request deletion of your account.

This Privacy Policy is governed by internationally recognized data protection principles. We do not designate a single national legal system as the exclusive governing law. Disputes relating to this Privacy Policy shall be resolved through ICC arbitration as described in our Terms and Conditions, except where mandatory local law in your country of residence provides otherwise.

For any questions, concerns, or data rights requests relating to this Privacy Policy, please contact us: