The short version
Last updated · November 5, 2026
Wander has no account, no sign-up, and no analytics or tracking of any kind. It reads your photos on your device and plots your route there. Nothing you make is sent to me: I run no servers and hold none of your data.
Three things do leave your device, each covered below: your own private iCloud sync, the coordinates Apple’s map, weather and search services need to answer a request you made, and, only if you turn it on, one coordinate for a waypoint’s elevation.
What is stored, and where
Every Wander you save, with its photos’ locations, its route, its places and the people you attach to it, is stored on your device.
If you are signed in to iCloud, Wander also saves it to your own private iCloud database so it stays in sync across your iPhone and iPad. That data lives in your personal iCloud account under Apple’s privacy practices; I have no servers and no access to it. You can stop syncing at any time by signing out of iCloud or turning iCloud off for Wander in your device settings.
What leaves your device
Only these, and only to answer something you asked for.
Maps and directions
Wander uses Apple Maps (MapKit) to display the map, to calculate directions between your photo locations (walking, cycling, or driving, depending on each leg’s activity), and to look up a coarse place name (like a neighborhood or city) shown alongside a photo’s time. To do this, the relevant coordinates are processed by Apple under Apple’s own privacy practices. Wander does not send your data to any other service.
Weather
Wander can record the weather a journey happened in. This happens only when you ask for it: you tap Look Up Weather on a Wander, or turn on Look up weather in Settings (off by default). In each case Wander asks Apple’s WeatherKit service for the conditions at the coordinates and times of that Wander’s stops, and stores the result with the Wander so it never has to ask again. Nothing else is sent: no photos, no account, no device identifiers. Apple describes how it handles these requests in its Weather privacy notice. Leave the setting off and never tap the button, and Wander asks for no weather at all.
Waypoint elevation
When you add a waypoint, Wander can fill in that spot’s height for the elevation chart by looking it up online. This happens only when you ask for it: either you tap Look up elevation on a waypoint, or you turn on Look up waypoint elevation in Settings (off by default), which then looks up each new waypoint as you add it. In either case Wander sends that single map coordinate to Open-Meteo, a free elevation service, and receives the elevation back. Nothing else is sent: no photos, no account, no device identifiers, no other coordinates, just the one point being looked up, with no information that identifies you. If you leave the setting off and never tap the button, nothing is ever sent, and you can always type an elevation in by hand.
Naming a suggestion
To name a suggested Wander after the place it happened, Wander asks Apple Maps about the location of a suggestion you are being shown. That is a coordinate, never a photo, and Apple handles it under the practices described above.
Permissions
Wander asks for these, and nothing else. Each is optional, and you can change your mind in your device settings at any time.
Photos
When you choose photos in Wander, the app reads each selected photo’s capture date and embedded GPS location for one purpose only: to plot your route. This happens entirely on your device. Your photos and their metadata are never uploaded, shared, or sent to me or to any third party.
Wander asks for access to your photo library so its own picker can help you find the photos from one journey: filter your library to a day or a date range, group it by the places your photos were taken, or draw a circle on a map to gather everything you shot in one area. Doing that means reading the capture date and location of photos in your library, not only the ones you end up choosing. Wander never reads what is inside a photo, and nothing about your library leaves your device.
Apple Health
If you turn on Connect Apple Health in Settings (off by default), Wander can draw the path a workout actually recorded instead of guessing a route between your photos. It asks Apple Health for read-only access to two things: your workouts, and the routes recorded with them. Wander never writes anything to Apple Health, and it asks for nothing else from it: no heart rate, no steps, no health records of any kind.
It reads only workouts that overlap the times your photos were taken, and only when you make or edit a Wander. The recorded route becomes part of that Wander, which means it is stored on your device and, if sync is on, in your own private iCloud database. It is never sent to me or to any third party. You can change or revoke what Wander may read at any time in the Health app, under Sharing, and turning the Settings toggle off stops Wander asking at all.
Contacts
Wander lets you attach the people who shared a journey to your Wanders. If you import someone from your contacts, Wander reads only the contacts you pick in Apple’s system contact picker: just the details used to create that person in the app. People you add are stored with your Wanders on your device (and in your private iCloud database if sync is on) and are never sent to me or to any third party. Contacts access is optional and only requested when you use the import feature.
Suggested Wanders
Wander can look through your photo library for days that look like a journey you never saved. The search runs entirely on your device and reads only the date and location saved with each photo, never what is inside the photo. Nothing is searched until you ask for it, and a suggestion becomes a Wander only when you save it. What counts as a journey is learned from the Wanders you have already saved, on your device.
Backups
Back Up Now writes your whole Logbook to a file in your own iCloud Drive. It is your file, in your account: it is not sent to me, and I cannot read it. Restoring reads a file you choose and adds what is missing.
Third parties
Wander contains no third-party advertising, analytics, or tracking software. The one third-party service it can contact is the Open-Meteo elevation service, and only when you ask for a waypoint’s elevation, as described above.
Deleting your data
Deleting a Wander removes it from your device and, if sync is on, from your private iCloud database and your other devices. Erase All Data & Reset in Settings removes every Wander, folder, place and person the same way, and offers to back up first. Deleting the app removes everything stored on that device. None of this needs to reach me, because none of it was ever mine to delete.
Children
Wander does not knowingly collect information from anyone, including children.
Changes
If this policy changes, the updated version is posted here. Every revision is recorded below, oldest first.
- First published.
- Restructured into clear sections (data we collect, photos and location, maps and directions, third parties, children) and clarified that all processing happens on your device.
- Updated the privacy contact address to feedback@getwander.app.
- Added the iCloud sync section explaining that walks sync through your own private iCloud account.
- Added the People and contacts section for the People feature introduced in 1.5 (optional, picker-scoped Contacts access; nothing leaves your device or your private iCloud). Broadened the maps section: directions are now calculated per leg’s activity, and Apple’s geocoder supplies the coarse place names shown with photos.
- Added the Elevation lookup section for the 1.6 waypoint-elevation feature: looking up a waypoint’s height sends that one coordinate to the third-party Open-Meteo service. It is optional. It happens only when you tap Look up elevation or turn on the off-by-default Look up waypoint elevation setting, and sends nothing else. Updated the opening and Third parties sections to reflect this.
- Added the Weather lookup section for the 1.7 weather feature: recording a Wander’s weather sends its stop coordinates and times to Apple’s WeatherKit service, only when you ask for it, and nothing else is sent.
- Corrected the Photos and location section. It said Wander accessed only the photos you pick through Apple’s system picker, which stopped being true in 1.7: Wander’s own picker reads the dates and locations of photos in your library so it can filter them by day, place, and map area. Nothing about your library leaves your device.
- Added the Apple Health section for the 1.8 workout-route feature: with the off-by-default Connect Apple Health setting on, Wander reads your workouts and their recorded routes, read-only and never writing anything back, to draw the path you actually traveled. Added the Suggested Wanders section: the search through your library for unsaved journeys runs on your device and reads only each photo’s date and location, and only a shown suggestion’s coordinate is sent to Apple Maps to name the place. Reworded the opening so it names every service a request can reach, rather than only iCloud sync and the elevation lookup.
- Reorganized the policy into sections that answer a question each (what is stored and where, what leaves your device, what each permission is for, how to delete things) instead of one long list, and added a short version at the top. Nothing about what Wander does with your data changed. Two things already true were written down that this policy had not said plainly: that a backup is a file in your own iCloud Drive which I cannot read, and what deleting a Wander, erasing all data, or deleting the app actually removes. The voice is now first person singular, which is what the rest of the site uses: Wander is one person’s hobby project, and “we” implied a company that does not exist.
Contact
Questions about this policy? Email feedback@getwander.app.