Privacy Policy
Effective: April 6, 2026 | Last updated: April 6, 2026
1. Who We Are
WanderSafe is operated by Wandering With Pride Inc., a US 501(c)(3) nonprofit organization. Data controller: Michael Eisinger, michael.eisinger@wanderingwithpride.org.
2. What We Collect
| Data | When | Purpose | Stored Where | Retention |
|---|---|---|---|---|
| Page visits | Browsing destination pages | Analytics (aggregate only) | Cloudflare | Rolling 30 days |
| Email address | Newsletter signup | Deliver safety alerts | Buttondown (processor) | Until unsubscribe |
| Email address | Premium subscription | Payment + alert delivery | Stripe + Buttondown | Until cancellation + 30 days |
| Community report content | Submitting a safety report | Publish anonymized safety intelligence | Cloudflare D1 | Indefinite (anonymized) |
| Reporter name + email | Submitting a report (optional) | Follow-up on critical reports only | Not stored in database | Deleted after follow-up |
3. Sensitive Data (GDPR Article 9)
WanderSafe serves LGBTQ+ travelers. By using the platform, your browsing behavior may imply information about your sexual orientation or gender identity. We treat this with the highest level of care:
- We do not collect, store, or process data about your sexual orientation or gender identity
- We do not require identity disclosure to use the platform
- We do not track which destination pages you visit in any personally identifiable way
- Aggregate analytics (Cloudflare) do not include user identifiers
- If we introduce demographic personalization in the future, it will require explicit, granular, purpose-specific consent before any data is collected -- per GDPR Article 9(2)(a)
4. Community Report Privacy
Community reports are submitted through Tally.so. When you submit a report:
- Your name and email (if provided) are extracted for follow-up purposes only
- Name and email are not stored in the WanderSafe database
- Your report is anonymized before database insertion
- AI validation (Claude Haiku) scores report plausibility but does not receive your identity
- A human reviewer sees the anonymized report; they do not see your identity unless follow-up is needed for a critical safety report
- Published reports show destination, date, and content only -- never reporter identity
Threat model for reporters in hostile jurisdictions
We recognize that submitting a community report about LGBTQ+ safety in a country that criminalizes homosexuality carries real risk. Our protections:
- Reporter identity is never published, even with consent
- Reports do not contain IP addresses in the database
- Tally.so processes the form submission; their privacy policy applies to form processing
- We recommend submitting reports after leaving the destination, not while there
- We recommend using a VPN when submitting reports about high-risk destinations
5. Data Processors
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Cloudflare | Hosting, CDN, Workers, D1 database | Page requests, database records | Global edge network |
| Buttondown | Email newsletter delivery | Subscriber email addresses | US |
| Stripe | Payment processing | Payment method, email | US |
| Tally.so | Community report form | Form submissions | EU (Belgium) |
| Anthropic (Claude) | AI classification of report validity | Anonymized report text only | US |
6. Your Rights
You may:
- Access your data -- email us to request what we hold
- Delete your data -- unsubscribe from newsletter; request community report removal
- Correct your data -- email us with corrections
- Object to processing -- email us; we will comply within 30 days
- Port your data -- we will provide your data in a standard format on request
For all requests: michael.eisinger@wanderingwithpride.org
7. Data Retention
- Destination data (legal status, scores, alerts): retained indefinitely (public interest)
- Community reports (anonymized): retained indefinitely
- Subscriber email: retained until unsubscribe + 30 days
- Agent run logs: 90 days
- Reporter contact info: deleted after follow-up or 30 days, whichever is sooner
8. Cookies and Tracking
WanderSafe uses:
- A cookie consent banner (required for EU compliance)
- Cloudflare Web Analytics (privacy-preserving, no cookies, no personal data)
- localStorage for user preferences (identity filter, PWA state) -- never transmitted to any server
We do not use Google Analytics, Facebook Pixel, or any advertising trackers.
9. Children
WanderSafe is not directed at children under 13. We do not knowingly collect data from children.
10. Changes
We may update this policy. Material changes will be noted with an updated effective date. For significant changes affecting data handling, we will notify newsletter subscribers.
11. Contact
Wandering With Pride Inc.
Silver Spring, MD
michael.eisinger@wanderingwithpride.org