Privacy Policy

How we handle your data (EN)

This is a summary. The full policy, which is the one that applies, is in Portuguese: Política de Privacidade. Last updated 17 October 2026.

• We collect only what the service needs: your profile (name, photo, airline, position), your e-mail for login, your roster and flight hours, your country of residence and, only if you opt in, your medical class and citizenships for job eligibility.
• Verifying your link with the airline is optional. If you ask for it, you send one photo of yourself holding your airline badge, with a code written by hand; while the request waits, we also keep that code and a technical fingerprint of the file (its eTag and size) to tell the moderator if the same photo was already sent by another account. The check is visual only: a moderator looks at the photo and decides. It never goes through face recognition or AI, and it never appears on your profile. After the decision, approved or not, we delete the photo and everything that came from it (the handwritten code and the file's technical fingerprint). None of it stays in our databases or our storage. If deleting the photo fails, we retry every hour, and a photo that never became a request is deleted after 24 hours. We keep only the result (verified or not, the date and how long it is valid), because that is what shows the seal on your profile, and the record of the decision: the moderator who decided, the reason if one was written and, where it applies, the note that the same photo had already been sent by another account. The automatic backups of our database provider keep data for up to 7 days, so the deleted code and fingerprint can stay in them for that long; the photo itself is never in those backups. Only WayPoint's moderators see the photo, and we never share it, not even with your airline. Legal basis: the verification you asked for (LGPD art. 7, V). This description applies from 23 October 2026, 7 days after we announced it; the deletion as soon as a moderator decides already applies.
• From a Qatar Airways roster PDF, WayPoint also keeps the hotel name, address and transport phone it prints for each layover, never the contact names; only you see them. The wake-up and pickup times you note for a layover are yours too, and are deleted 48 hours after that report.
• Direct messages are encrypted in transit (HTTPS) and at rest (Supabase's encrypted database). Nobody at WayPoint reads them day to day: we access a message only to handle a report from another pilot or when a formal court order requires it. This replaces the earlier end-to-end encryption wording from 1 October 2026.
• We never sell or rent personal data. We share it only with the services that run WayPoint: Supabase (database and login), Firebase (push notifications), Hostinger (the private server that hosts the app, in Frankfurt, Germany), Sentry (error reports, below) and Resend (sending WayPoint's e-mails), plus courts when a formal court order requires it. Our usage statistics (Umami) run on our own server and use no cookies.
• An account that never finished signing up is seen only by its owner and WayPoint's moderators. It is deleted 7 days after it was created if its e-mail was never confirmed, or 30 days after if the sign-up questions were never answered, always with a warning e-mail 48 hours before. Accounts that finished signing up are never deleted for being inactive.
• Brazilian law (Marco Civil) requires us to keep access logs for 180 days, and login records for up to 365 days.
• You can access, export, correct and delete your data in the app, or write to compliance@mywpoint.com.

Reading your roster (no AI)

WayPoint reads your roster only with its own code, which follows fixed rules for each roster format. In the reading you ask for, no AI service reads your roster, ours or anyone else's, and the file is not sent to any other company to be read. Some PDFs are read on your own device, in the browser: the file never leaves it, and only the flights and duties read reach WayPoint. Other PDFs go to WayPoint's private storage (Supabase) and are read on our own server, by programs that run on it: pdfjs, which extracts the text, and pdfplumber, which measures where each piece of text sits on the page. The PDF is deleted from that storage automatically within about a day after the reading. We read only PDFs with text, in a format we already know how to read: a PDF in another format, or a scanned one, is refused, never guessed at. Photos and screenshots of a roster are refused: they are neither read nor stored, and we ask for the PDF. Legal basis: the service you asked for (LGPD art. 7, V).

What changed on 17 October 2026: WayPoint no longer uses Google Gemini or Ollama to read rosters. In the reading you ask for, it reads only the PDF, with its own code, refuses photos and screenshots, and deletes a PDF read on our server within about a day. We also no longer suggest importing your airline's calendar link, which is not accepted today. This applies from that day, because it only reduces what we do with your data.

Auto-Sync is off

WayPoint does not accept your airline crew-portal password. The "Auto-Sync" feature that asked for it never worked and was switched off on 28 September 2026; no portal password is stored. To bring your roster in, upload the PDF, again whenever the roster changes. Any future airline integration will use the airline's own official login, so WayPoint never sees your password.

Garmin watch (optional)

You can connect a Garmin watch to see your next duties on it. It starts only when you confirm, signed in, the 6-digit code your watch shows. The watch receives your own next duties only (from 12 hours back to 7 days ahead): your airline's code, flight numbers, airports, report, departure and arrival times, aircraft type, the deadhead and instruction marks, duty codes, the first and last day of your days off or vacation, the date your roster was uploaded and, when you note them, the wake-up and pickup times of your next duty. Nothing about other people: no names, no crew, no hotel. We keep the watch's model, when it was connected and last used, and an access key that belongs to that watch alone; the 6-digit code lasts 10 minutes and is deleted, with the watch's model and language that come with it, about an hour after it expires. Your data export lists the model and the dates, never the key. Every time a watch is connected to your account you get a notice in WayPoint (and on your phone, if notifications are on) with the way to disconnect it. Only connect a watch that is on your own wrist: if somebody sends you a pairing link or a code, do not confirm it. The watch keeps its key and the last answer it received, and talks to WayPoint through the Garmin Connect app on your phone, a Garmin product under Garmin's own privacy policy. Disconnect it in Settings > Tools > Watch, where the key stops working at once, or from the watch's menu, where it stops working as soon as the watch reaches WayPoint (if the watch cannot reach it, disconnect it in Settings). It also expires 180 days after its last use, and connecting another watch disconnects the previous one. Legal basis: the service you asked for (LGPD art. 7, V).

Apple Watch (optional)

The WayPoint app for Apple Watch works like the Garmin watch above. It starts only when you confirm, signed in, the 6-digit code it shows, and it receives the same data: your own next duties only, with flight numbers, airports, times, aircraft type, duty codes and the other items listed above, and, when you note them, the wake-up and pickup times of your next duty. Nothing about other people: no names, no crew, no hotel. What we keep, the notice of every connection, the data export and the time limits are the same as for the Garmin watch. The differences: the Apple Watch talks to WayPoint directly over the internet (through the iPhone it is paired with, Wi-Fi or cellular), with no WayPoint app on your iPhone and no Garmin service in between. Apart from the access key WayPoint creates when you connect it (it identifies that connection and is linked to your account), the app sends us no name, serial number or other identifier of the watch, so the model we keep is simply "Apple Watch". On the watch, the access key stays in the watch's secure storage (Keychain), and the last answer received stays in the app's own storage, which the WayPoint complications and widgets on your watch face also read to show your duties without a connection. The app uses no location and no health data, and has no ads and no tracking. Apple handles the App Store download under Apple's own privacy policy. One watch per pilot: connecting an Apple Watch disconnects a Garmin watch, and the other way round. Disconnect it in Settings > Tools > Watch, where the key stops working at once, or from the app's menu on the watch, where it stops working as soon as the watch reaches WayPoint (the watch keeps trying; if it never can, disconnect it in Settings). Legal basis: the service you asked for (LGPD art. 7, V).

Error monitoring (Sentry), from 21 September 2026

To find and fix bugs, WayPoint uses Sentry, a service of Functional Software, Inc. (USA), with our data stored in Frankfurt, Germany (EU). When something breaks in your browser or on our servers, we send an error report: the error message and technical stack trace, the page address (with profile handles, conversation IDs and access codes removed), the last few technical steps before the error (pages opened, network calls and their status, console warnings and errors), browser, operating system and device type, the app version, and your WayPoint account ID. We do not send your name, e-mail, IP address, cookies, message contents or form contents, and we do not record your screen. This uses no cookies. Legal basis: our legitimate interest in keeping WayPoint secure and working (LGPD art. 7, IX; GDPR art. 6(1)(f)). Reports are deleted automatically after 30 days. Sentry processes this data only on our instructions under its Data Processing Addendum; Sentry may access it from the US for support and security. You can switch error reports off on your device in Settings > Privacy, or object at compliance@mywpoint.com. This starts on 21 September 2026, 7 days after we announced it.

Optional test recording

Beta testers we invite may choose to let us record their sessions (pages, clicks and scrolling, with all on-screen text, images and typing masked, and direct messages never recorded) to reproduce bugs. Recording starts only after the tester agrees on a dedicated screen, shows a visible "Recording" badge, can be stopped at any time in Settings > Privacy (at once on the device used, within a minute on the tester's other devices), and recordings are deleted after 30 days or sooner on request. Legal basis: consent (LGPD art. 7, I and art. 33, VIII; GDPR art. 6(1)(a)). No other member is ever recorded.