Privacy policy

Wend is a map and navigation app for Android phones and car screens. It shows no ads, works without an account and keeps what you save on your phone. It sends your position to Wend only while you are signed in to an account, which the sign-in screen tells you before you sign in; signing out stops it. Without an account, it tells Wend at most once a week, under a random number, that it is in use, and you can switch that off. This page sets out exactly which data it uses, who else sees it, and how to delete it.

App: Wend
Made by: Spring
Contact: support@wendmap.com
Effective: 22 October 2026

1. Who we are

Wend is made by Spring (“we” on this page), which is responsible for the data described here. For any question about it, or to use any of your rights, write to support@wendmap.com.

2. In short

No ads, no analytics, no crash reporting. The app contains no advertising, analytics or crash-reporting software. We do not sell your data or share it for advertising.
No account needed. Without one, what you save stays on your phone.
An anonymous weekly count. Without an account, the app tells Wend at most once a week that it is in use, under a random number made on your phone, so that Wend knows how many people use it. It sends no name, email address, location or device identifier. A switch in Settings turns it off and deletes the record (section 5).
Your movements are kept only while you are signed in. Without an account, Wend keeps no record of your movements or of the routes you drove. While you are signed in and the app is open or navigating, it keeps your latest position and where you moved in the last 24 hours (section 5); signing out deletes both. It keeps the places you save, the last 25 places you picked as destinations (the Recent list), your hazard reports and running totals for points.
Maps come from the internet. To draw the map, find places and plan routes, the app asks public map services run by others (section 4). They see those requests and your IP address, and are not told who you are.
The account is optional. It copies your saved places, settings, hazard reports and points to Wend's back end on Google Firebase so that they reach your other devices (section 5), and, while you are signed in, your position; the sign-in screen says so. You can sign out at any time, and delete the account, and everything synced to it, in the app.

3. On your device

Wend stores these on your phone, in the app's own storage:

Home, Work, your favourite places and your recent destinations: the last 25 places you picked to go to, kept automatically so you can pick them again (the Recent list);
the hazard reports you make (police, crash, jam, hazard, closure or speed camera), each with the position where you made it and the time;
your settings, including your nickname, your avatar and any MapTiler or Stadia Maps key you enter;
your points totals (section 6);
the maps you download for offline use;
copies of Wend's remote settings, announcements and release notes, and, if you sign in, your sign-in session (your account id, email address and sign-in tokens);
for the anonymous weekly count, a random number made on the phone and the week it last checked in (section 5).

None of it leaves the phone unless you sign in to an account (section 5), apart from that random number, which the weekly count sends while you are not signed in.

Your location

Wend asks for permission to use your location (precise and approximate) to show you on the map and to navigate. While you navigate, an ongoing notification (a foreground service) keeps directions going with the screen off or another app in front. Wend does not ask for permission to use your location in the background at any other time, and it never reads your location while it is closed.

Your position is used on the phone. Wend's own back end receives it only while you are signed in to an account (section 5); signed out, it never does, although a hazard report you make is marked where you are, and your reports are synced if you sign in. Parts of your position do go to the map services in section 4, inside the requests that need them: the map area around you, the start of a route, results near you.

Phone backup

If Android's backup is switched on, Android may include Wend's stored data in your device's backup to your Google account. You control that in Android's settings.

Car screens

With Android Auto, Wend runs on your phone and uses the phone's data. On cars with Android Automotive OS, Wend runs on the car itself and has no sign-in, so what it stores stays in the car: it takes no part in the anonymous weekly count either. Location sharing needs an account, so a car running Wend itself never shares its position.

Spoken directions

Spoken directions come from your phone's own text-to-speech engine, the one chosen in Android's settings. Wend hands it the words to say.

4. Map, search and routing services

Wend draws its maps, finds places and plans routes with free public services built on OpenStreetMap and run by other organisations. Each request goes straight from your phone to the service over an encrypted connection (HTTPS). The service sees your IP address and the request itself; Wend does not send it your account, your name or any identifier of your device. The services are:

Map tiles: tile.openstreetmap.org and vector.openstreetmap.org, run by the OpenStreetMap Foundation. They see which parts of the map you look at, usually the area around you.
Search: nominatim.openstreetmap.org (OpenStreetMap Foundation) and photon.komoot.io (komoot). They receive what you type into search, and the map position used to put nearby results first. Nominatim also receives a position when Wend needs a name for it: the place at a pin you drop, the area of a map offered for download, and the country you are in, which sets kilometres or miles automatically.
Routing: valhalla1.openstreetmap.de and routing.openstreetmap.de, run by FOSSGIS e.V. They receive your starting point (usually where you are), your destination and any stops, each time a route is planned or replanned.
Offline maps and map data: overpass-api.de receives the boxes of map area that Wend asks road data and traffic lights for. download.geofabrik.de, download.mapsforge.org and ftp-stud.hs-esslingen.de serve the map files you download. raw.githubusercontent.com (GitHub) serves Wend's list of map sources, at most once a day.
Only if you enter your own key: MapTiler (api.maptiler.com) or Stadia Maps (tiles.stadiamaps.com) serve the map tiles instead, and receive your key with each request.

These are Wend's built-in choices. Wend's remote settings can switch the app to other servers for the same purposes, for instance when one of these stops working.

Links you open from Wend, such as an announcement's link, an update download or OpenStreetMap's copyright page, open in your browser, under that website's own policy.

5. Wend's back end and your account

Wend's back end is a Google Firebase project. Its database (Cloud Firestore) is in the European Union, in Frankfurt (Google Cloud region europe-west3). Sign-in uses Firebase Authentication, a global Google service that is not tied to that region, and this website is served by Firebase Hosting. Google runs all three for us. Everything travels over encrypted connections, and Google encrypts what it stores.

Without an account

The app reads Wend's remote settings, announcements and the newest release from the back end. It sends no account and no device identity with these requests, only the project's public key. Google, which runs the back end, sees your IP address. Apart from the anonymous weekly count below, which keeps a random number, two week numbers and a deletion date, the back end stores nothing about you.

Anonymous weekly count

So that Wend knows how many people use it without an account, the phone and tablet app counts itself, anonymously, at most once a week. The first time, it makes up a random number on your phone (128 random bits, not derived from your device or from anything about you) and keeps it in the app's storage. Then, in each week in which you use Wend with an internet connection while you are not signed in, the app sends the back end that number, the number of the current week (the first time, as the week of its first check-in too) and the date on which the record is to be deleted, which is worked out from that week. Nothing else goes with it: no name, email address, location, device identifier, account or sign-in token, only the project's public key, as above. Google sees your IP address with the request; the record does not include it.

The back end keeps one record for each phone: the random number, the week of its first check-in, the week of its latest one, and the date on which the record is to be deleted. Weeks are whole weeks, so nothing in the record says on which day or at what time Wend was used, or where. (The database itself notes when each record was created and last changed, as it does for everything it stores; the admin console never reads a record, only counts them.) Each check-in moves the deletion date on to about a year later, so a phone that stops checking in is deleted automatically about a year after its last check-in. Wend's admin console shows only totals: how many phones checked in this week, in the last four weeks and in all.

To stop it, turn off Count this phone anonymously in Wend's Settings. The phone then deletes its record from the back end at once, or, if it is offline, the next time Wend starts with a connection, and checks in no more. Signing in to an account deletes the record too, since you are then counted as an account, and the phone does not check in while you are signed in; if you sign out again, it counts itself again unless the switch is off. Uninstalling Wend or clearing its storage makes the phone forget its random number; the record on the back end then goes by itself about a year after its last check-in. (If Android's backup restores Wend's data when you install it again, the number and the switch come back with it, and the phone goes on as before.) The switch belongs to the phone: it is not synced to an account.

If you create an account

You can sign in with an email address and a password, or with Google or Facebook. Firebase Authentication (Google) then keeps:

your email address;
for email sign-in, your password, which goes to Google over an encrypted connection and is kept by Google only in hashed form, never by Wend;
for Google or Facebook sign-in, your account id at that provider, and the name and profile photo address it passes on, which Wend does not use;
when the account was created and when it last signed in, which Firebase records itself.

Signing in also shares your position with Wend while the app is open or navigating (Location sharing, below). The sign-in screen says so before you sign in, your profile repeats it under your account, and signing out stops it.

Your profile

Your app keeps one profile for your account on the back end. It holds your email address (and a lower-case copy of it, for searching), how you sign in, when the profile was made, when you last synced and, for each kind of data you sync, a summary the app makes:

whether Home and Work are set, and how many favourites and recent destinations you have;
how many hazard reports you have, of which kinds, and when the newest was made;
your settings (such as units and voice), with any key shown only as set or not set; these include your nickname and avatar;
your points, level, kilometres driven, trips finished and reports counted (section 6).

A summary never contains a place, an address, a position, a search or a key. Your position, while you are signed in, is stored separately (Location sharing, below).

Synced data

While you are signed in, the app uploads a copy of your data so that your other devices get it: when you sign in, when the app starts and when you tap Sync now, but not when a drive ends. The copy holds:

Home, Work, your favourites and your recent destinations, with their names, addresses and coordinates;
your settings, including your nickname, your avatar and any MapTiler or Stadia Maps key (a few that belong to one device, such as its language and theme, are not synced);
your hazard reports, each with its kind, position and time;
your points counters for each app install: the distance driven while navigating, trips finished and reports counted, each under a random install id that is not derived from your device.

Signing in shares your position; signing out stops it. The sign-in screen says so before you sign in, and your profile repeats it under your account: there is no separate setting to find. While you are signed in, Wend has your permission to use your location and the app is open or navigating, the app sends Wend your position about once a minute: your coordinates, their accuracy, your speed and direction, when the fix was taken, and your nickname, avatar and level so the map can label you. It also keeps where you moved in the last 24 hours (a trail of up to 240 points), with a copy on the phone so that reopening the app continues it rather than starting over. No position is sent while the app is closed, while it is in the background without a drive, while you are signed out, or while Wend has no permission to use your location. Signing out, deleting the synced copy or deleting the account removes your stored position and trail at once; signing out is how you stop sharing.

Wend can also pause location sharing for everyone from its back end; no position is sent until it is back, and the app shows nothing about it. Your stored position stays until you sign out, which works even then and still removes it at once.

6. Points

Points are counted on your device from the distance you drive while navigating by car, the trips you finish and the hazard reports you make.
Only running totals are kept, never the routes, places or times behind them (your position, while you are signed in, is covered under Location sharing in section 5). The one exception is the time of the last report that earned points, which stays on the device to limit how often reports count.
Points are not verified, have no value and nothing depends on them. If you sign in, the totals sync with your account, and Wend's admins can see them (section 8). They see the totals as of your last sync, so an admin who compared two visits could tell roughly how far you drove in between, but never where, along which route or when each drive was — except that while you are signed in, they see where you are and where you moved in the last 24 hours (Location sharing).

If you choose Continue with Google or Continue with Facebook, Wend opens your phone's browser on Wend's own sign-in page (at wend-510814.firebaseapp.com, served by Firebase Hosting), which sends you on to Google or Facebook. After you sign in there, the page hands the sign-in back to the app, encrypted with a one-time key the app made for that sign-in, and clears what it stored in the browser. The page loads a script from Google (apis.google.com) that this kind of sign-in needs.

Google or Facebook learn that you signed in to Wend, under their own privacy policies.
Wend receives your email address and an account id. The name and photo they pass on are not used.

8. Who can see your data

You, on your devices.
Wend's admins, the few people who run Wend, through its admin console. For each account they see the email address, how it signs in, when it was created and last synced, and the summaries in section 5, including your nickname, avatar and points. While you are signed in, they also see your latest position, when it arrived, whether you are moving, and where you moved in the last 24 hours, on a live map. They cannot see your synced places, recent destinations, report positions or keys: the back end's security rules give admins no way to read synced data, only to delete it. Of the anonymous weekly count, the admin console shows only the totals (section 5).
The project's owner, Spring, which can technically see everything stored, synced data included, through Google Cloud's own tools.
Google, which runs Firebase and processes this data for us.

We do not sell your data or give it to anyone else, unless the law requires us to.

9. Keeping and deleting

Your synced data stays until you choose Delete the synced copy or Delete account in the app, or until an admin deletes it.
Your profile (your email address, how you sign in, and when it was made and last synced) stays until you choose Delete account or an admin deletes it. Delete the synced copy clears its summaries and last-sync time but keeps the rest, since you still have the account.
Delete account removes your sign-in account, your profile and all your synced data at once. What is on your phone stays until you uninstall Wend or clear its storage.
Your position and trail stay while you are signed in. They are replaced about once a minute while the app is open or navigating; the trail keeps 24 hours. They are deleted when you sign out, choose Delete the synced copy or Delete account, or when an admin removes them. Only signing out (or deleting the account) stops new ones arriving: a device that stays signed in sends a fresh position the next time the app is open.
The anonymous weekly count's record is deleted automatically about a year after the phone's last check-in, or sooner, when you turn the count off in Settings or sign in to an account (section 5).
If an admin deletes an account, the admin log keeps only its random user id, not its email address.
Google may keep deleted data in its own backups for a limited time before it is gone for good.

How to delete your account and data, step by step, including when you no longer have the app or have no account.

10. Children

Wend is not directed at children under 13. If you believe a child has given us personal data, write to support@wendmap.com and we will delete it.

11. Your rights

Depending on where you live (in the European Union or the United Kingdom, for example), you have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable form, and to object to or restrict how we use it. Much of it you can see, change or delete in the app yourself. For anything else, write to support@wendmap.com. You may also complain to your data protection authority.

12. Changes to this policy

When this policy changes, the new version is published on this page with a new effective date.