Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how Wayoni handles personal data. Wayoni is an early-stage, unincorporated project operated by Ivan Mytrofanov, Prague, Czech Republic ("we", "us" or "Wayoni"), who is the controller of the personal data described here. You can reach us at privacy@wayoni.com.

What this policy covers

This policy covers the Wayoni website, account features and support channel. It does not cover an airline, booking site, Google, social network or other third-party site you visit from a Wayoni link; those services process data under their own notices.

Data we collect

Information you give us

• Account and profile data: email address, password hash (never the password itself), display name, username, avatar or avatar setting, home city/country, language, currency and newsletter preference.
• Travel data you choose to save: search preferences and presets, saved destinations and routes, and trips or booking details you add, such as dates, route, carrier, price, booking reference and flight number.
• Support messages: the name, email address and message you submit, plus replies in the same support conversation.

Data created when you use the service

• Session and security data: IP address, browser user-agent, session times and a hash of the refresh token. We use this to secure sign-in, show your active sessions and investigate abuse.
• Technical logs: request identifier, route, method, response status, timing and connection IP address. Logs help us operate, secure and debug the service.
• Booking-click data: when you choose a booking link, we may store the route and offer you selected, the time of the click and a pseudonymous click ID. The ID can be included in a partner link so we can attribute a booking reported back by the partner.

Google sign-in and location

If you choose Google sign-in, Google provides an ID token. We verify it and store the Google account's stable identifier, email address and, if supplied, profile-image URL. We do not receive or store your Google password and do not request access to Gmail, Drive, contacts or other Google content.

If you use the browser's location permission, Wayoni calculates a nearby departure city in your browser. We do not send or store the device coordinates themselves; the selected city can be saved locally on your device or in your profile if you choose it.

Why we use personal data

• to provide searches, recommendations, saved items and your account;
• to authenticate you, prevent fraud and protect the service;
• to send operational messages, such as verification, password-reset and security notices;
• to answer support requests and administer the service;
• to measure and administer partner-link referrals; and
• to send travel ideas only when you have chosen to subscribe.

Where the GDPR applies, our legal bases are performance of a contract or steps you ask us to take before entering one (account and core service features); our legitimate interests in operating, securing and improving Wayoni and preventing misuse; compliance with legal obligations where applicable; and your consent for optional marketing. You may withdraw marketing consent at any time by contacting us at privacy@wayoni.com. Withdrawing consent does not affect processing already carried out lawfully.

Who receives data

We do not sell personal data or use advertising trackers. We share data only as needed with:

• Travelpayouts / Aviasales: route search parameters such as origin, destination, dates and currency to obtain offers. A partner link may contain the pseudonymous click ID described above; it is not your name or email.
• Google: when you actively choose Google sign-in, to authenticate that sign-in.
• Booking providers, including FlixBus: when you follow a booking link, the provider receives the search parameters in that link and any information you then give it.
• Service providers: the hosting, infrastructure, database, email-delivery and support tools we use to run Wayoni. They may process data only for the service we ask them to provide and subject to applicable safeguards.
• authorities or other recipients where disclosure is required by law or necessary to protect rights, safety or security.

International transfers

We are based in the Czech Republic. Some providers may process data outside the European Economic Area. When that happens, we use a transfer mechanism recognised by applicable data-protection law, such as an adequacy decision or the European Commission's Standard Contractual Clauses. Ask us at privacy@wayoni.com for information about the safeguards relevant to your data.

Retention

We keep account and saved travel data while your account remains active. You can delete your account in Settings. Deletion ends access, removes direct account identifiers and revokes sessions. A support conversation submitted separately from the account, or a required security or administrative record, may remain in a restricted form where needed to handle the matter, protect the service, resolve a dispute or meet a legal obligation.

Session tokens expire automatically (the access cookie lasts up to 15 minutes and the refresh cookie up to 30 days), and expired token records are removed. Verification, password-reset and email-change credentials are short-lived and removed after they expire. We keep support correspondence for as long as needed to handle the request and maintain the support record. We review other operational data against the purpose for which it was collected and delete or de-identify it when it is no longer needed.

Your rights

Depending on the law that applies to you, you may have rights to request access, correction, deletion, portability, restriction or objection to processing, and to withdraw consent. To make a request, email privacy@wayoni.com. We may need to verify that the request is yours. If you are in the EEA or UK, you can also complain to your local data-protection authority; in the Czech Republic, that is the Office for Personal Data Protection (ÚOOÚ).

Security

We use reasonable technical and organisational measures designed for the service, including hashed passwords and tokens, HttpOnly session cookies and access controls. No internet service can promise absolute security, so please use a unique password and notify us promptly if you believe your account has been compromised.

Children

Wayoni is not directed to children under 16. Do not create an account or submit personal data if you are under 16. If you believe a child has provided data to us, contact us and we will take appropriate steps to remove it.

Cookies and changes

Our Cookie Policy explains the essential cookies and browser storage currently used by Wayoni. If we make a material change to this policy, we will update the date above and, where appropriate, give additional notice before the change takes effect.