01 What we collect
Only what you choose to enter into the app. That includes:
- Place names, coordinates, addresses, dates of visit, notes, ratings, and category-specific details (dishes ordered, teams playing, trip names, friends' names, occasions).
- Photos you attach to a place, plus their EXIF metadata (location, capture date) when present.
- App settings — accent color, default category, distance unit, notification preferences. These live on the device.
That's the full list. We don't collect analytics events, advertising identifiers, crash dumps, device fingerprints, or any usage telemetry. The app links Apple frameworks only — no Mixpanel, Amplitude, Firebase, Sentry, or any other tracking SDK.
02 Where your data lives
Your library is stored locally on each device using SwiftData and synced between your own Apple devices through your private CloudKit container (iCloud.com.wendmark). Photos travel as CKAssets.
Wendmark, as the developer, has no read access to your private CloudKit data. Apple operates the infrastructure; we publish the schema. The same separation that keeps your iMessages private from Apple keeps your places private from us.
There are no Wendmark-operated servers in the picture. Nothing about your library is uploaded to anywhere we control.
03 Outbound network calls
Wendmark makes outbound HTTPS calls only when you trigger them, and only to two third-party services:
- TripAdvisor Content API — when you tap "Search TripAdvisor" on a restaurant, the search query and (if enabled) your nearby coordinates are sent to TripAdvisor's API. The response is rendered locally; nothing is logged on our end.
- ESPN public scoreboard — when you tap "Look up the game" on a stadium place, the requested sport and date are sent to ESPN's public site API.
No call includes any data from your library beyond the literal search terms or coordinates you typed. No call is made in the background. Quitting the app stops any in-flight request.
04 Apple system services
Wendmark also uses several first-party Apple services. These are subject to Apple's own privacy terms — Wendmark, as the developer, never sees the data you send through them.
- Apple Maps — when you search for a place or ask Wendmark to fill in the address for a coordinate, the app uses
MKLocalSearchandMKReverseGeocodingRequestto query Apple. Only the search text or coordinate is sent. - Speech recognition — when you tap the mic to dictate a note, Wendmark uses Apple's Speech framework. On-device recognition is preferred and used whenever your device and locale support it; otherwise the audio is sent to Apple for transcription. Wendmark never sends voice data anywhere else, and never records without you initiating it.
- On-device intelligence (Apple Intelligence) — Wendmark's smart features (Smart Capture, natural-language search, the "Year in Places" recap, and wishlist suggestions) run on Apple's Foundation Models framework, the same on-device model behind Apple Intelligence. This processing happens entirely on your device. Wendmark uses no cloud AI service and sends none of your places, notes, photos, or searches to Anthropic, OpenAI, Google, or anyone else for these features. They appear only on devices that support Apple Intelligence and are hidden everywhere else.
- CloudKit — covered in §2; sync between your own devices through your iCloud account.
All of these are triggered only by an action you take in the app and never run in the background.
05 Tracking
None. Wendmark does not track you across apps or websites, does not request the App Tracking Transparency permission, and is not associated with any identifier-for-advertisers. There is nothing to opt out of because there is nothing to opt into.
06 Children
Wendmark is rated 4+ and is suitable for everyone. We do not knowingly collect personal information from children under 13 — but only because we don't collect personal information from anyone, regardless of age. If a child uses the app, the same rules apply: their data sits in their own iCloud account and never reaches us.
07 Your rights
You can:
- Export your full library to JSON at any time (Settings → Library → Export to JSON). The file is yours.
- Delete a place, all its photos, and any cached geocoding data — instantly, irreversibly, with the swipe-to-delete or detail view's Delete button.
- Delete everything — Settings → Library → Delete all places. Removes every record from your device and from iCloud.
- Sign out of iCloud on the device or uninstall the app — both detach this device from the sync, and uninstall removes the local store.
Because Wendmark holds none of your data on its own servers, there is no separate request channel to delete it from us. We have nothing to delete on our end.
08 Data retention
Your data is retained for exactly as long as you keep it in the app. There is no separate Wendmark retention period because there is no separate Wendmark store. Your iCloud account's retention policies (set by Apple and by you) are the only ones that apply.
09 Security
The transport-layer story is Apple's. CloudKit uses TLS in transit and encryption at rest in Apple's data centers, with iCloud account credentials managed entirely by the operating system.
On-device, your library lives in the SwiftData store inside the app's sandboxed container. Photos use SwiftData's external-storage path to keep large blobs out of the SQLite row store. Any third-party API keys you enter (e.g. your optional TripAdvisor Content API key) are written to the device keychain, never to disk in plaintext. Wendmark's AI features need no key — they run on-device (see §4).
Wendmark performs no custom cryptography. The app uses Apple's standard URLSession HTTPS for outbound network calls, which qualifies as exempt under U.S. export rules (declared in the App Store submission).
10 Third-party services
The two outbound services named in §3 each have their own privacy policies governing what they do with the search terms or coordinates you send them:
- TripAdvisor Content API — tripadvisor.com/PrivacyPolicy
- ESPN — Disney Privacy Center (ESPN is part of The Walt Disney Company)
Wendmark sends them only what you explicitly trigger. Neither service receives identifying information about you from us — no email, no name, no device ID — but they may apply their own logging based on the IP address of the request.
11 Updates to this policy
If we make a material change to how Wendmark handles data — for instance, adding a new outbound service or a new permission — this page is updated and a notice will appear inside the app on next launch. The "Last updated" date at the top reflects the most recent change.
The current version of this policy is always available at wendmarkapp.com/privacy.html.
12 Contact
Questions, concerns, or anything in this policy that didn't make sense to you: support@wendmarkapp.com.