Privacy Policy

1. Who we are

Wanderspace is provided by Sofiia Brahar, Ukraine ("we", "us"). We decide why and how your data is processed, which makes us its controller. For any question about your data, write to support@wanderspace.app.

2. Data we collect

2.1. Captures

While you film, the phone records a video without sound to its own storage. When you send the capture to the cloud, we receive:

• frames — selected stills from the video as JPEG, up to 1440 pixels on the long side; the video itself is not sent to the cloud;
• camera poses — the phone's position and rotation for each frame and the "up" direction, computed by ARCore;
• camera parameters — resolution, frame rate, focal length, sensor size, field of view, lens correction mode;
• capture diagnostics — phone model, capture date and time, frame rate, the phone's thermal state, tracking and depth quality, coverage, exposure (ISO, shutter speed), the result of the post-capture check (sharpness, lighting, flicker);
• for a reshoot — which tour it belongs to and how it is placed relative to it;
• the tour name you enter.

In photo mode the phone takes photos instead of a video; they are sent to the cloud reduced to 1440 pixels on the long side, together with motion sensor readings (gyroscope and accelerometer) taken while filming, the exact timing of camera frames and a more detailed ARCore tracking log. We need this data to match the frames precisely and build the 3D tour, and we keep it together with the capture, for as long as the capture itself (section 7).

2.2. Tours

From a capture we make a 3D tour, a tour cover (one frame from the middle of the capture) and alignment data for reshoots (feature points of frames and their coordinates in the tour). For each processing run we keep a record: date, capture length, number of frames, minutes charged, status, processing time and technical errors.

2.3. Installation ID

On first launch the app creates a random identifier and sends it with its requests to our server. Your captures, tours and minutes are linked to it. It is not tied to the advertising ID, your phone number or IMEI; reinstalling the app creates a new one.

2.4. Google account

When you sign in with Google, we verify the sign-in token from Google and keep your Google account ID, email address and sign-in date from it. Your profile name is passed to the app for display but is not stored on our server. We never see your Google password. When you sign in on a new phone, we link it to your account and move that phone's tours and purchased minutes to the account.

2.5. Notifications

To tell you that a tour is ready or has failed, we keep a Firebase Cloud Messaging token (a Google service) — for up to five phones per account. You can turn notifications off in Android settings.

2.6. Purchases

Payments are handled by Google Play; we don't receive your card or other payment details. From the app and Google Play we receive: which product was bought, the order number, how many minutes were credited, whether it is a test purchase and, for a subscription, when it ends. We keep the purchase token encrypted for no longer than 3 days and only to complete the purchase in Google Play; after that we keep only its hash, so that a purchase can't be credited twice. Google also notifies us about subscription renewals and cancellations and about refunds.

Your purchase history (product, order number, time, price) is stored with your account so that we can credit minutes, process refunds and keep our books. Purchase records are kept for 3 years after the purchase, and your account's minutes log, which also shows purchase prices, for as long as the account exists (section 7).

2.7. Minutes

Your minute balance (to the second): free, purchased and used time, the sharing bonus, and the charge and refund for each processing run.

2.8. Tour viewers

When someone opens a tour via its short link, we count distinct viewers for the sharing bonus. For this we keep not the IP address but its hash with a secret salt — at most 10 per tour, for up to a year after the last new viewer.

2.9. Website

The website uses no advertising or analytics cookies and no trackers. Your language choice is stored in your browser (localStorage); the test tour editor also keeps its edits only in your browser. The website serves its fonts and 3D graphics libraries itself — its pages make no requests to third-party services. Cloudflare, which runs the website, processes technical request data (IP address, time, browser type) to deliver pages and protect them from attacks. We ourselves keep no logs of IP addresses.

2.10. Messages to us

If you write to us, we receive your email address, your message and anything you attach.

2.11. Reports about tours

If you report a tour with the Report button on its page, we keep: the reason, your description and contact (both optional), the time, the tour and a salted hash of your IP address — to ignore repeats and limit the number of reports from one address. We keep reports for a year from submission. The service owner's internal notification contains only the reason from the list and a technical tour ID — without your description or contact, the tour name or its link.

2.12. Crash logs

If the app crashes or freezes, Firebase Crashlytics (a Google service) sends us a technical report. It contains:

• where in the code the crash happened (stack trace) and the technical error message;
• the app version; the phone's model, manufacturer and processor type, its memory and storage size, the Android version, and whether the phone is rooted and has a proximity sensor;
• the device state at that moment: free memory and storage, battery level and whether it is charging, screen orientation, and whether the app was on screen;
• the time of the crash;
• random Crashlytics and Firebase installation and session identifiers, so we can count how many people the same crash affects.

Crashlytics also records the start of each app session (when the app is opened) to measure the share of sessions without crashes. The only thing we add to a report is the capture mode (photo or video).

We don't add your email, name, account ID, tour names, frames or links to reports. We use reports only to find and fix crashes, not for advertising or behavioural analytics. The app has no Firebase Analytics (Google Analytics). Google keeps the reports for 90 days and then starts deleting them.

3. What we don't collect

• location — the app doesn't ask for location permission;
• sound — the app doesn't ask for microphone permission;
• contacts, photos or files from your gallery — the app only works with what it films itself;
• the advertising ID. Wanderspace has no ads, and we don't sell data.

4. Why we use data

• to build a tour from your capture, its versions and reshoots, and to show the tour via its link;
• to run your account and minute balance, credit purchases and bonuses, and return minutes when processing fails through our fault;
• to let you know when a tour is ready;
• to find and fix failures and improve processing — using capture and processing diagnostics and the app's crash logs (section 2.12);
• to protect the service from abuse (limits, getting free minutes again, other people's purchases);
• to answer your messages and handle complaints;
• to comply with the law, including purchase accounting.

Legal bases (for users in the EU/EEA, the UK and wherever the law requires them): performance of a contract — our Terms (captures, tours, account, minutes, purchases, tour notifications); legitimate interests (security, preventing abuse, diagnostics, counting viewers); legal obligation (purchase records); consent — the Android camera and notification permissions, which you can withdraw in your phone settings.

5. Who else processes data

• Cloudflare — server, storage and delivery of the website and tours. Stores all the data described above.
• RunPod — cloud GPU servers where captures become tours. They receive frames, poses, camera parameters and capture diagnostics (in photo mode, also motion sensor readings and camera frame timing) only for the duration of processing; temporary files are deleted after each job, and the servers themselves are destroyed after use.
• Google — Sign in with Google, notifications (Firebase Cloud Messaging), payments and purchase verification (Google Play), subscription and refund notifications (Google Cloud Pub/Sub), app crash logs (Firebase Crashlytics, section 2.12), ARCore on the phone (section 13).
• Telegram — internal notifications to the service owner: a tour is ready or processing failed (number of frames, processing time, failure class), purchases and subscriptions (product, minutes), sign-in on a new phone and account deletion (number of tours and minutes), reports about tours (the reason from the list, the number of reports), support requests (only the substance and the deadline — no names, addresses or contacts). A tour or processing run appears in these notifications only as a technical job or tour ID, and phones and accounts only as the first 8 characters of their ID; there are no tour names, tour links, error texts, reporters' descriptions or contacts, email addresses or frames in them. The exception is security notifications about sign-in attempts to the internal service panel: they may contain the address of the Google account the attempt was made from, the country, city and device (the service itself keeps these details for no longer than a day).
• Anthropic — the Claude model, which on our behalf reads emails sent to our support address and service notifications to summarise their substance and deadlines for the service owner (it receives the email text and the sender's address), and, before a capture is processed, automatically checks a few of its frames, at reduced size, for prohibited content. We keep the result of the check (the category and frame numbers, not the frames themselves) for 90 days. Under Anthropic's commercial terms this data is not used to train its models.

The service owner, and people the owner has engaged for technical work, may open tours and captures to check quality or to investigate a failure or a complaint. We may disclose data if the law requires it or to protect people's rights and safety. We don't sell data or share it for advertising.

6. Who can see your tours

Every tour has a short link (wanderspace.app/t/…). Anyone with the link can see the tour, its name and its cover — without signing in or installing the app. Links are hard to guess and requests to tours are rate-limited, so codes can't be brute-forced; but a link can be forwarded, and messaging apps show the name and cover in the link preview. Tour pages are marked for search engines as not to be indexed, yet a link posted on a public page can be seen by strangers.

You can close a link or replace it with a new one — the old one stops working immediately; you can also delete the tour. The owner can still see their tour when the link is closed, through a personal link from the app that is valid for 2 hours. There are no public tour galleries now; if we add one, a tour will appear there only if you choose to publish it. We can't delete copies others have already saved (screenshots, link previews in messaging apps).

7. How long we keep data

8. Deleting data

Delete a tour in the app: open the tour → trash icon; its link stops working immediately. Delete your account with all tours: Profile (Профіль) → Delete my data (Видалити мої дані) — the links to your tours stop working immediately, the rest of the data is erased within 30 days, and unused minutes are lost. Without the app, email support@wanderspace.app from the address of the Google account you signed in with. What gets deleted and what stays is described on the Account & data deletion page.

9. Security

Data between the app, the website and the server travels encrypted (HTTPS). Processing servers fetch the files of their job with a service key. We keep a purchase token encrypted for no longer than 3 days and after that only as a hash, and the IP addresses of viewers and reporters only as salted hashes. Requests to tours from one address are rate-limited (counters use an IP hash and aren't stored) so that link codes can't be brute-forced. Only the service owner and people the owner has engaged for technical work have access to storage. No protection is absolute; if a breach affects your data, we will notify you and, where the law requires, the supervisory authority.

10. International transfers

Cloudflare, Google, RunPod, Telegram and Anthropic operate in many countries, so your data may be processed outside your country, including in the US and the EU.

11. Your rights

You can: find out what data we hold about you and get a copy; correct inaccurate data; delete a tour or your account; object to, or ask us to restrict, processing based on legitimate interests; withdraw consent (Android permissions); complain to the data protection authority in your country.

Write to support@wanderspace.app — we reply within 30 days. To protect your account, we may ask you to confirm that it's yours, for example by writing from the address of the Google account you signed in to the app with.

12. Children

Wanderspace is for adults (18 and over); younger people may use it only with the permission and under the supervision of a parent or guardian (Terms, section 2). We don't verify age. We don't knowingly collect data from children under 13; if we learn that we have, we will delete it. If you believe a child under 13 has given us their data, write to us.

13. ARCore

Filming runs on Google Play Services for AR (ARCore). ARCore processes camera images and motion sensor data on the phone to track the phone's position and estimate depth. The app uses depth maps only on the phone, to show what has already been filmed; they are not sent to the cloud. The app doesn't use ARCore features that send data to Google's cloud (Cloud Anchors, Geospatial API).

14. Changes to this policy

If we change this policy, we'll update the date at the top of this page. We'll announce significant changes — such as new kinds of data or new processors — in advance, in the app or on the website.

15. Contact

Sofiia Brahar, Ukraine. Email: support@wanderspace.app.

This policy is published in Ukrainian and English; if the versions differ, the Ukrainian one prevails.