Privacy

Who we are

Waypoint is operated by Prisha iCube, based in Bengaluru, India. For anything on this page, including a request to exercise your rights, write to us at our contact page.

What we do not do

• We do not ask you to create an account, and there is nothing to sign in to.
• We do not run advertising networks, retargeting pixels or social media trackers.
• We do not sell, rent, licence or trade your information to anyone.
• We do not ask for your name, postal address, date of birth or payment details, because the service never needs them.
• We do not set cookies of any kind.
• We do not keep a record on our side of what you searched for, which destinations you liked, or where you went next.
• We do not track you across other websites, build an advertising profile of you, or use analytics that identify you. The one analytics tool we use is described below.

What stays on your own device

Waypoint remembers a handful of things in your browser's local storage. This is not a cookie, and the difference matters: local storage is never transmitted anywhere. It sits on your computer or phone, and our server has no way to read it, ask for it or receive it.

What it remembers	Why
Your theme	Whether you chose light or dark mode.
Destinations you liked or rejected	The hearts and crosses you gave places. Waypoint reads these back on your next visit so its suggestions reflect your taste rather than starting from nothing each time.
Your public holiday calendar	A saved copy for your country, so it is not downloaded again every time you arrive.
Cost and exchange rate figures	A saved copy of cost-of-living and currency reference data.
Climate data for places you viewed	A saved copy, so looking at the same destination again is instant.
Your choice not to be counted	Only if you switched visit counting off, as described under "Counting visits".

We should be straightforward about the second of those. Over several visits, your hearts and crosses do add up to a picture of what you like, and Waypoint uses it. That is a profile, and calling it anything else would be dishonest. The point is where it lives: entirely on your device, under your control, invisible to us. We never receive it, and there is no copy of it on any server of ours.

If you want to inspect any of this, these entries are stored under names beginning wp_ and are visible in your browser's developer tools. You can erase all of it at any time by clearing site data for waypoint.holiday in your browser settings. Nothing breaks. Waypoint simply starts fresh, and forgets your taste along with everything else.

What our server sees

The site's data is served by a small program running on Cloudflare's network. When your browser asks it a question, it receives:

• Your IP address. This is unavoidable; it is how the internet returns an answer to the right computer. We do not store it in any log we keep or analyse.
• An approximate location derived from that IP by Cloudflare — typically city, region, country, time zone and a rough latitude and longitude. This is what lets Waypoint show you the right public holidays and estimate travel times from near you. It is used to answer your request and is not retained afterwards.
• The contents of your request — for example the destination you are curious about, or the month you are considering. Where an answer is worth reusing, it is cached by the destination and month, not by who asked.

Rate limiting

To stop a single visitor from exhausting the service for everyone else, we count how many expensive requests have come from the same place on a given day. The counter is filed under a one-way fingerprint of your IP address rather than the address itself, so it can tell that two requests came from the same visitor without recording who that visitor is. It holds a number, nothing else, and it is deleted automatically within 48 hours.

Cloudflare

Cloudflare acts as our infrastructure provider and processes requests on our behalf. They maintain their own security and network logs independently of us. Their privacy practices are described at cloudflare.com/privacypolicy.

Counting visits

We want to know whether Waypoint is being used, which pages people read, and whether the site is fast enough. For that we use Cloudflare Web Analytics, a privacy-focused tool from the same company that runs our infrastructure.

When a public page loads, a small script from Cloudflare records the visit: the page address, the address of the page that linked to it, your browser and device type, your country, and how quickly the page loaded. We see these only as totals, such as "120 visits from India this week".

It sets no cookies, stores nothing on your device, does not fingerprint your browser, and does not follow you to other websites. We cannot use it to identify you, and nothing it collects is used for advertising. Cloudflare describes it at cloudflare.com/web-analytics.

If your browser or an extension blocks the script, Waypoint works exactly the same; your visit is simply not counted.

You can also switch it off yourself. Open waypoint.holiday/?notrack=on once, and this browser will not load the script again. To undo it, open waypoint.holiday/?notrack=off. The choice applies to one browser on one device, and it is forgotten if you clear site data.

Using your device's location

Waypoint normally works out roughly where you are from your IP address, which is accurate to about a city. There is also a button that offers to use your device's own location instead, which is far more precise.

That button does nothing until you press it, and pressing it only asks your browser, which then asks you. Nothing is shared unless you say yes, and saying no costs you nothing: searching for your city by name works just as well.

If you do agree, here is exactly what happens to those coordinates. They are sent to Nominatim, OpenStreetMap's public address service, which turns them into a place name so the right holiday calendar can be loaded. They then become your starting point, which means they travel with the requests that work out travel times, nearby airports and weather for that position. We do not store them, we do not attach them to anything, and they are gone when you close the tab.

AI-generated content

The short destination briefings on Waypoint are written by an AI language model. To produce one, we send the model the destination name, the month, the size of your travelling party and the interests you selected. We do not send your IP address, your location or anything that identifies you. The resulting text is cached and reused for anyone else asking about the same place and month.

These briefings can be wrong. They are there for colour and context, and they play no part in how destinations are scored or ranked. That is done by our own code, from published data.

Other services your browser contacts directly

Some parts of the page are loaded by your browser from third parties rather than through us. Those services necessarily see your IP address. We have listed them rather than leave you to discover them. The list is short on purpose: the typefaces, for instance, used to be fetched from Google and are now served from our own domain, so Google no longer sees your visit.

• Wikimedia Commons — the photographs, which are freely licensed and credited at the foot of the page.
• Cloudflare Web Analytics (static.cloudflareinsights.com and cloudflareinsights.com) — the visit counting described above.
• Nominatim (OpenStreetMap), Open Exchange Rates, Nager.Date and ipwho.is — used only as fallbacks, when our own server cannot answer. On a normal visit your browser does not contact them at all.

When you follow an onward link to a booking, tour or travel-services provider, you leave Waypoint and that company's own privacy policy applies. We pass them nothing that identifies you.

Some of those links are affiliate links, and they carry a short tag so the provider can tell us that a booking came from Waypoint and which part of the site sent it. The tag describes the trip, not the traveller: the kind of link, the destination country, and the month of travel. It contains nothing about you — not your passport, not who you are travelling with, not where you live, and no identifier of any kind. We could not use it to recognise you on a return visit, and neither can they.

Children

Waypoint is not directed at children and we do not knowingly collect information from anyone under 18. Since we collect no personal information from anyone, there is nothing held about a child to delete, but if you believe otherwise please contact us.

Your rights

Depending on where you live, data protection law — including India's Digital Personal Data Protection Act, 2023 and the EU and UK General Data Protection Regulation — gives you rights to access, correct, delete or restrict the use of your personal data, and to complain to a supervisory authority.

We want to be straightforward about what that means here. Because we hold no accounts and keep no identifiable records, we normally have nothing to look up, correct or hand over. If you contact us with a request, we will tell you honestly what we hold, which in almost every case will be nothing.

Where data is processed

Waypoint runs on globally distributed networks, so your request is typically handled at a data centre near you rather than in one fixed country. Our company is in India, and any correspondence you send us is received there.

Changes to this page

If we change how any of this works, we will update this page and change the date at the top. Material changes will be noted on the homepage. We will not quietly start collecting something and tell you later.

Contact

Questions about this policy, or about anything we hold, go to our contact page.