Legal
Privacy Policy
Overview
WayFinder is a camera-based assistive app for blind and low-vision users. This policy describes what the app and its backend collect, why, where it goes, how long it is kept, and how you can delete it. It is paired with a separate AI Data Use disclosure that you must agree to before any photo is sent for AI analysis.
What WayFinder collects and processes
Sign-in and account
You sign in with Apple, with Google, or with an email address and a password — all three through Firebase Authentication. Firebase issues a stable account identifier and may provide your email address, display name, and the sign-in provider. WayFinder's own backend stores none of those: it keys every record on the account identifier alone. Apple's "Hide My Email" addresses (@privaterelay.appleid.com) are forwarded to you by Apple; WayFinder cannot see behind them.
WayFinder never receives your password. That is true of your Apple and Google passwords, which we never see, and equally true of a password you set for an email sign-in: Firebase Authentication holds that credential. WayFinder does not store it, does not store a hash of it, does not log it, and stores no password-reset or email-verification token. If you choose an email sign-in, Firebase sends a verification link, and any password-reset link you request, to the address you gave — you can stop receiving them by deleting your account. An email account cannot use WayFinder until that address is verified; Apple and Google accounts are not asked to verify, because those providers have already established that the address is yours.
You can add a second or third sign-in method to an existing account in Settings. Doing so keeps the same account, the same history and the same lifetime analysis limit. WayFinder never joins two accounts together on its own, including when they share an email address.
You must affirmatively agree to the Terms of Service and acknowledge this Privacy Policy before a WayFinder backend account is created. No backend account is created without that agreement.
Camera image
When you ask a visual question or enable automatic analysis on launch, the app takes one photo and sends it over encrypted HTTPS to the WayFinder backend. The backend sends that photo, and the text of a question when present, to a Google Gemini model on Google Cloud Vertex AI to produce a scene description. WayFinder does not continuously record video. Nothing is sent to Gemini until you have agreed to the AI Data Use disclosure. You can revoke that agreement at any time in Settings; revocation stops future transmission without deleting your account.
WayFinder does not write the raw photo to its server database or durable application storage. The camera plugin creates a temporary device file for upload and the app deletes it after the request, although an operating-system cache may survive a crash.
The Gemini model is reached through Google Cloud Vertex AI, on a billing-enabled Google Cloud project, authenticated by the service's own cloud identity. Google's handling of that request is therefore governed by WayFinder's Google Cloud agreement, not by the consumer Gemini terms and not by a personal API key. Those agreements are the Google Cloud Platform Terms of Service, the Service Specific Terms and the Cloud Data Processing Addendum.
Under those terms Google states that data logged from these requests is not used to train or fine-tune any AI/ML model. What Google may retain, and for how long, is described in full on the AI Data Use page.
Voice questions
On the iPhone app, speech is converted to text in strict on-device mode. If on-device recognition is unavailable, the question fails rather than falling back to a network speech recognizer, so spoken audio does not leave the phone.
In the web demo at app.way-finder.tech, speech recognition is performed by your browser. In Chrome and other Chromium browsers this sends the audio to Google's speech service; that processing is Google's, governed by the Google Privacy Policy, and it happens before WayFinder receives anything. Use the iPhone app if you do not want spoken audio leaving your device.
In neither case does WayFinder record, store or transmit raw microphone audio itself. Only the resulting text is sent to the WayFinder backend with the photo, and only after you have agreed to the AI Data Use disclosure.
Account and history
Firebase Authentication provides a stable account identifier and may provide your email address, display name, and sign-in provider. WayFinder stores your question, derived response, confidence and grounding metadata, timestamps, request identifiers, and model-usage accounting. If you report an incorrect, unsafe, or offensive answer, WayFinder also stores the selected reason and any optional note you submit. It does not collect device location or request location permission, but question text, an answer-report note, or a visible sign can contain a place name or address.
Legal consent audit trail
For each account, WayFinder's backend stores the version of the Terms you accepted, the timestamp of acceptance, a hash of the Terms document, the version of this Privacy Policy you acknowledged, the timestamp of acknowledgement, a hash of the Privacy document, the version of the AI Data Use consent you granted, the timestamp it was granted, the timestamp it was revoked (if ever), the app version, and the device locale. This record exists only to prove and audit your consent. It does not store additional personal evidence such as IP addresses unless a demonstrated legal or product requirement is later identified and disclosed here.
Logs and diagnostics
Backend logs record request identifiers, the user UID prefix, timestamps, status codes, the model id, and inference timing. They never log image bytes, prompts, answers, ID tokens, API keys, or your full UID. On the device, VoiceDiagnostics records state transitions for the microphone, speech, camera and the API client for the in-app System Status screen; it does not record audio, photos, or the text of your question.
Third-party SDK behaviour
WayFinder uses the following third-party SDKs in the app binary: Firebase Authentication, Firebase App Check, Google Sign-In, Sign in with Apple (platform-provided), and the speech_to_text, flutter_tts and camera Flutter plugins. The Inter font is bundled, not fetched. Network requests are limited to Firebase Authentication, Firebase App Check attestation, the WayFinder backend, and (only after you agree) the Gemini vision analysis path through the WayFinder backend. The app never contacts an advertising network and contains no advertising SDKs.
Why the data is used
- To describe the requested scene and answer a question about it.
- To keep each user's history isolated by Firebase UID.
- To enforce rate limits and the lifetime analysis quota.
- To prove and audit your legal consent (Terms, Privacy, AI Data Use).
- To diagnose reliability and safety failures without logging photos, tokens, or question text.
WayFinder does not sell personal data, show advertising, or use user data to train its own models.
Where the data goes
Account identity is held by Firebase Authentication. Account history, the lifetime quota, the answer-report channel, and the legal consent audit trail are held in the WayFinder backend database, encrypted at rest by Google Cloud. Camera imagery and question text are sent to the WayFinder backend and forwarded to Google Gemini only after you have agreed to the AI Data Use disclosure; they are not stored durably on the WayFinder server.
Retention and deletion
Interaction history, answer reports and their optional notes, and duplicated response text used for idempotent retries are scheduled for deletion after 30 days. Non-content lifetime usage accounting remains until account deletion. The legal consent audit trail remains until account deletion so a withdrawn or repeated consent can be proved if a regulator or you ask. You can erase history and duplicated ledger response text at any time inside the app. Deleting your account erases messages, reports, sessions, model-usage records, rate-limit state, the consent audit trail, and the scene memory in the handling process, then requests deletion of the Firebase identity. Other running processes can retain isolated scene facts for at most 30 seconds. We retain only an irreversible hash of the former account identifier to serialize deletion against already in-flight writes. If Firebase proves that identity deletion failed, the app reports the partial failure and allows a retry. If Firebase's status cannot be determined safely, the write barrier remains and support is required. Encrypted Cloud SQL backups may retain deleted rows until their configured expiration, but are not available through the product and are removed through backup expiry.
Security
Traffic is encrypted in transit. Protected API routes require a Firebase ID token. Firebase App Check is deployed through monitored warning stages before enforcement so release-device attestation can be verified without locking out users. Stored records are scoped by Firebase UID. Production secrets are held in Google Secret Manager, and the database is encrypted at rest by Google Cloud. No service-account JSON keys are stored on Cloud Run; Gemini is accessed using the runtime service identity via Application Default Credentials.
Children
WayFinder is not directed to children under 13. If you believe a child provided personal data, contact us so it can be deleted.
Changes to this Privacy Policy
We may update this Privacy Policy. Each version carries an explicit version number and effective date at the top of this page. A material change that affects what we collect, where it goes, or how long we keep it will require you to acknowledge the new version inside the app before continuing to use WayFinder.
Contact
Email support@way-finder.tech.