Your trips, and what we do with them

Wander stores your account information (name, email, password hash), the trips you plan (destination, dates, brief, and the generated itinerary), and the adjustments you make to days. Nothing in your trips is financial data, medical data, or anything sensitive beyond the details of where you want to travel.

We do not connect to your bank, your calendar, or any third-party account. Your data enters Wander when you type it, and nowhere else.

All data transmitted between your browser and Wander's servers uses TLS 1.2 or better. Your account and trip data are stored encrypted at rest by our database provider.

Your trip data is never posted anywhere public, never shared with another user, and never sent to any third party other than the model provider that designs your itinerary.

To design your itinerary, Wander sends a structured prompt to a language model provider containing your brief: destination, dates, budget, pace and taste preferences. The provider returns a plan.

We use the model provider under its business API terms, which prohibit training on API traffic. We do not fine-tune any model on your trip data. We do not sell or license your data to anyone for any purpose.

The summary sent to the model provider does not include your name, email or any account identifier. It contains only the planning brief you entered.

Access to the production database is limited to the engineers who operate it, and it is used to fix problems, not to browse. We do not read customer trip data for product research.

If you open a support ticket and describe a specific trip or plan, we may look at the relevant records to answer your question. If you would rather we did not, say so in the ticket and we will work from your description instead.

• Trips and account records: until you delete them, or until 30 days after you close your account, whichever is sooner.
• Form submissions from contact, help and careers forms: 24 months.
• Server logs, which record request paths and timings but not trip content: 30 days.
• Backups: rolling 7 days. Once a record is deleted from the database and the next backup cycle runs, it is gone from backups too.

From Settings you can export any trip as a clean PDF at any time. You can also delete your account from Settings, which removes your trips, your plan history and your account record immediately.

Both export and deletion are immediate and neither requires a support ticket. The Your data page at /your-data walks through both in detail.

• Passwords are hashed with scrypt and a per-user salt. Nobody at Wander can see a password, and we never log one.
• Sessions are httpOnly, sameSite cookies signed with a server-side secret, expiring after 30 days.
• Every request for trip data checks that the data belongs to the account making the request, in the database query itself rather than in the application layer.
• Two-factor authentication is available on all accounts and required for any account with administrative access to the service.

• Two-factor authentication is required on every service Wander uses, with no shared logins and no exceptions.
• Production database access is limited to the engineers who operate it and is reviewed quarterly.
• Dependencies are updated on a weekly cadence and security advisories are addressed within 72 hours for anything reachable from production.
• We do not yet hold a SOC 2 report. We are a Pre-Seed company and would rather say that than imply otherwise. If you need a completed security questionnaire for procurement, email us and we will fill it in honestly.

Email security@wandertrip.org. We acknowledge within two business days, we will not take legal action against you for reporting in good faith, and we will tell you when the issue is resolved. If you want to be credited, say so and we will credit you.