Privacy Notice
Version 2026-09-21
In short
- We collect what Wingmate needs to work: your email, a first name, age, photos, what you are open to, your trip and your messages.
- Other travellers see your first name, age, card and trip, but never your photos or seat until you both reveal.
- Check-ins, trips, reveals, chats and groups are deleted automatically after your journey.
- No advertising, no tracking cookies, no selling of data.
- “Something romantic” is sensitive information, so it needs your separate, explicit consent.
- You can see, correct, export or delete your data, and complain to the Austrian Data Protection Authority.
1. Who is responsible
The controller responsible for your personal data is [company name and legal form], [registered address], Austria. For anything about your data, write to [privacy email]. [If a data protection officer is appointed: name and contact.]
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Sign-in: email address, one-time code, session token; if you use Google: your Google email, first name and Google account ID | Create your account and keep you signed in | Contract, Art. 6(1)(b) |
| Profile: first name, age, languages, up to three photos, card text, chosen keywords, what you are open to (travel friends, work talk, language swap, practical help), visibility setting, app language | Show your anonymous card to other travellers and match you with people who want the same things | Contract, Art. 6(1)(b) |
| “Something romantic” | Show you to people also open to romance | Your explicit consent, Art. 9(2)(a), because it reveals information about your romantic and sexual life. Optional; withdraw any time by removing it |
| Trip: flight number, departure and destination airport, terminal, gate, seat, departure, boarding and landing time, check-in time | Put you in the right terminal and flight, and delete your check-in after boarding | Contract, Art. 6(1)(b) |
| Interactions: reveals, chat messages, confirmed plans, community and ride group membership and group messages, notifications, keep-in-touch requests | Provide reveals, chats, groups (including groups to share a car to the airport) and notifications | Contract, Art. 6(1)(b) |
| Feed filters: the age range, destinations and intentions you filter by, and whether your age range is a deal-breaker | Show you the people you asked to see; with a deal-breaker, also hide you from people outside your range | Contract, Art. 6(1)(b) |
| Referrals: your referral code, which account invited you (if any), when the free month was given, until when you have free Pro | Give both people their free month and stop abuse | Contract, Art. 6(1)(b) |
| Security wait votes: the time range you tap, your terminal and when | Show other travellers an estimate of the security wait; stop one person voting many times | Contract, Art. 6(1)(b) |
| Safety: blocks, reports and their content, moderation decisions | Protect users, deal with illegal content and abuse | Legitimate interests in a safe service, Art. 6(1)(f); legal obligations, Art. 6(1)(c) |
| Wingmate Pro: plan (monthly or yearly) or Trip Pass and until when it runs, subscription or order reference and status, whether you used the free trial, trial and paid-period end dates, amounts and payments, payment provider, cancellation date, whether you are a founding member, your confirmation about the right of withdrawal | Sell and provide the Pro subscription, renew and end it, bookkeeping | Contract, Art. 6(1)(b); tax and accounting law, Art. 6(1)(c) |
| Consent records: which version of the Terms and this notice you accepted, age confirmation, romance consent, and when | Prove what you agreed to | Legal obligation, Art. 6(1)(c) with Art. 7(1) |
| Security: IP address and email address as counters against abuse, server logs (IP address, time, requested address, errors) | Stop spam, code guessing and attacks; find and fix errors | Legitimate interests in a secure service, Art. 6(1)(f) |
You have to provide sign-in, profile and trip details to use Wingmate; without them the service cannot work. Photos and “Something romantic” are optional. We do not use your data for advertising, we do not build advertising profiles, and we do not sell data.
No automated decisions with legal effect. Who appears in your feed is decided by simple rules — same terminal, flight or destination, overlapping intents, no blocks — not by profiling within the meaning of Art. 22 GDPR.
3. What other travellers see
| Who | Sees |
|---|---|
| People in your terminal, on your flight, or (Pro) landing where you land, who want at least one of the same things | First name, age, languages, card text, intents, destination, departure airport, gate or location, time until boarding — and your flight number only if they are booked on the same flight. Your photos appear only as a blurred colour tile. |
| A person you both revealed to | Additionally your photos and seat number, and a chat with you |
| Members of a community group you joined | First name, age, destination (and your flight number only if they are on the same flight), and your group messages. Photos stay hidden unless you have revealed to that person. |
| Members of a ride group you joined | Your first name, your group messages, and the range of departure times in the group. Not your flight, destination or seat. Photos stay hidden unless you have revealed to that person. |
| The person who invited you, or whom you invited | Only a count of how many friends joined with their code — never who. |
| Other travellers heading to your terminal | An estimate of the security wait and the number of votes per time range — never who voted. |
If you switch off “Show my flight” on your trip, nobody sees your flight number or destination, and you appear only to people in your terminal, not in the “My flight” or “Landing in” views. Switching visibility off in your profile removes you from other people’s feeds. Blocked people never see you.
4. How long we keep it
| Data | Deleted |
|---|---|
| Check-in (appearing in the terminal) | 1 hour after boarding |
| Trip, reveals, notifications | At the latest 2 hours after landing |
| One-to-one chats and plans | With the trip, unless both of you chose to keep in touch |
| Community group membership | With your check-in; a group and its messages when nobody is left in it |
| Ride group membership | When your flight departs; a group and its messages when nobody is left in it |
| Security wait votes | After 24 hours |
| Sign-in codes | After 10 minutes, after use, or after 5 wrong tries |
| Sessions | After 30 days, or when you sign out |
| Abuse counters | When their time window ends (at most one hour) |
| Account and profile | Straight away when you tap You → Delete account; within one month if you ask us by email. Copies in our sign-in and account directory provider (Supabase) are deleted at the same time |
| Reports and moderation decisions | 12 months after the account is deleted, to stop abusers returning; blocks are deleted with the account |
| Payment and subscription records | 7 years after the end of the year of each payment, as required by Austrian tax law (§ 132 BAO) |
| Consent records | As long as the account exists, then 3 years for legal claims |
| Server logs | [number] days |
| Backups | Up to 30 days, then overwritten |
5. Who receives data
We use service providers who process data on our behalf under data processing agreements (Art. 28 GDPR), and only as far as needed:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Fly.io, Inc., USA | Hosting the app and its database | All data described above | Servers in London, United Kingdom |
| Resend (Plus Five Five, Inc.), USA | Sending sign-in emails | Email address, sign-in code | USA |
| Supabase, Inc., USA | Account directory and backup of account details | Account ID, email, first name, age, languages, intents including “Something romantic”, keywords, card text, number of photos (not the photos), visibility, app language | Ireland (EU) |
| Google Ireland Ltd. / Google LLC | Sign in with Google, if you use it; loading the app’s fonts | Sign-in token; for fonts, your IP address and browser details when the app loads | EU / USA |
| [Cloudflare, Inc.] | Encrypted database backups, once enabled | Backup copy of the database | [region] |
| [Functional Software, Inc. (Sentry)] | Error reports, if enabled — configured to send no personal data or request contents | Technical error details, IP address | [region] |
| Anthropic, PBC, USA | Only if you use the AI card writer (currently switched off) | Keywords and text you enter for your card | USA |
| AeroDataBox | Only if flight lookup is enabled (currently switched off) | Flight number and date — no personal details | [region] |
Payments. If you subscribe to Pro, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, processes the subscription and the monthly payments as an independent controller under its own privacy notice. We receive the subscription's reference, status and billing dates, never your card or bank details.
Authorities. We disclose data to courts, police or other authorities only where the law requires it, or where it is necessary to protect someone’s life or safety.
6. Transfers outside the EU
Hosting takes place in the United Kingdom, for which the European Commission has adopted an adequacy decision. Some providers are based in the USA. Transfers there rely on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses with additional safeguards (Art. 46(2)(c) GDPR). [Confirm each provider’s certification and signed clauses before launch.] You can ask us for a copy of the safeguards.
7. Storage on your device
Wingmate uses no advertising or tracking cookies and no analytics. It stores only what is strictly necessary for the app to work, so no consent banner is required (§ 165(3) Austrian Telecommunications Act 2021):
wingmate.token(local storage): keeps you signed in until you sign out or the session expires;wingmate.lang(local storage): your chosen language;wingmate.pendingOrder(session storage): a Pro subscription being set up, removed afterwards;- a copy of the app’s own files (service worker cache), so it opens on poor airport wifi.
8. Security
Connections are encrypted (HTTPS). Photos and seat numbers of other people are never sent to your phone until a reveal is mutual. Sign-in codes expire quickly and are blocked after repeated wrong tries. Access to production systems and secret keys is limited to the people who run Wingmate. No system is perfectly secure; if a breach puts your rights at high risk, we will tell you without undue delay.
9. Your rights
You have the right to:
- access the data we hold about you (Art. 15);
- have it corrected (Art. 16) — most of it you can edit in the app;
- have it deleted (Art. 17);
- restrict its processing (Art. 18);
- receive it in a machine-readable format (portability, Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw consent at any time, without affecting what happened before (Art. 7(3)) — for “Something romantic”, simply remove it from your profile.
Write to [privacy email] from the email address of your account. We answer within one month.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. You may also contact the authority in the EU country where you live.
10. Age
Wingmate is only for people aged 18 and over. We do not knowingly process data of anyone younger and delete such accounts when we learn of them.
11. Changes
When this notice changes, the date and version at the top change and the app shows you the new version before you continue.