Privacy Policy

Effective 2026-10-21 · Applies to the Waystone iPhone app and this website

Waystone (“we”, “us”) is a goal-planning app for iPhone published under bapps.uk. This policy explains what data the app and this website handle, why, and the choices you have. If anything here is unclear, write to support@waystone.bapps.uk.

1. Data stored on your device

Everything you create in Waystone stays on your iPhone, in the app's private storage:

• goals, their descriptions, success criteria, assumptions and target dates;
• milestones and steps, including their status, notes and planned dates;
• your history: what you started, finished, skipped or moved, optional reasons and the time you reported;
• plan-change records and your app preferences (companion tone, reminders, language).

We cannot see this data. It's included in your iPhone backups (iCloud or computer) under Apple's terms. You can export it as a JSON file or delete all of it in Me → Privacy & data. Deleting the app also removes it from the device.

2. AI features (optional)

Waystone can draft routes, suggest next steps, propose plan adjustments and write a short companion message. These features only work after you agree on the “How Waystone uses AI” screen, and you can withdraw that consent at any time in Me → Privacy & data. Without AI, you can plan everything by hand.

What is sent

• the goal description you type, and your answers to the optional clarifying questions;
• an outline of your route: goal, milestones and steps with their titles, status and estimated time;
• recent progress: dates, outcomes (done, partly done, moved, skipped), optional reasons and reported minutes;
• any note you choose to add when asking for an adjustment;
• your app language, and your chosen companion tone.

We do not send your name, contacts, location, device identifiers such as the advertising ID, or the free-text notes you write in your history. Please don't type passwords, ID numbers, medical diagnoses or other sensitive details into Waystone.

Where it goes

• Waystone server (hosted on Cloudflare Workers): checks that the request is allowed, builds the instructions for the AI model, forwards the request and returns the result. It does not store request or response content.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.): runs the AI model. DeepSeek processes data in the People's Republic of China, and its handling of data, including how long it keeps it, is governed by the DeepSeek Privacy Policy.

AI-generated plans can be wrong or unsuitable for you. Waystone always shows suggestions for your review; nothing in your plan changes unless you apply it.

3. Anonymous ID, security and limits

To protect the service from abuse and keep AI costs predictable, the app creates a random identifier (a UUID) the first time it talks to our server after you agree to AI use. It's stored in your iPhone's Keychain and exchanged for a signed token that expires after 30 days. We use it to apply per-device rate limits and a daily request quota. Daily counters are kept for up to 3 days. The ID is not linked to your identity, and a new one is created when you choose Delete all data.

Like any website or online service, our hosting provider Cloudflare processes your IP address and standard request metadata to deliver the service, protect it from attacks, and apply short-lived rate limits. Our own operational logs record only the route, status, timing and token counts of each request — never its content — and are kept for up to 7 days.

4. Notifications

Reminders are optional, off by default, and scheduled locally on your iPhone. We don't use a push notification server.

5. This website

This website is a set of static pages served by Cloudflare. It uses no cookies, analytics or third-party scripts. It remembers your language choice in your browser's local storage. Cloudflare processes standard request data (such as IP address) to deliver and protect the site.

6. What we don't do

• No accounts, advertising, cross-app tracking, or analytics and advertising SDKs.
• No selling or renting of personal data, and no use of your data to build advertising profiles.
• No use of your content to train our own models. (We don't train models.)

7. Legal bases (EEA/UK users)

We process data for AI features on the basis of your consent, which you can withdraw at any time. We process the anonymous ID, IP address and request metadata on the basis of our legitimate interest in keeping the service secure and available.

8. International transfers

Cloudflare operates a global network, so requests may be handled in data centers outside your country. AI requests are processed by DeepSeek in the People's Republic of China. By turning on AI features you agree to this transfer; you can use Waystone without AI to avoid it.

9. Your choices and rights

• Turn AI off at any time in Me → Privacy & data.
• Export all of your data as a JSON file, or delete all of it, from the same screen.
• Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA or China's PIPL), you may have rights to access, correct, delete or object to processing. Because we don't hold your content and can't link the anonymous ID to you, most of these rights are exercised directly in the app. For anything else, contact us at support@waystone.bapps.uk. You may also complain to your local data protection authority.

10. Children

Waystone is not directed to children under 13 (or under 16 where local law requires), and we don't knowingly collect their data.

11. Changes to this policy

If we change how Waystone handles data, we'll update this page and its effective date. For significant changes, we'll also tell you in the app before they take effect.