Privacy Policy
Last updated: August 18, 2026
1. About this Privacy Policy
Wari is an independent, non-commercial project currently operated as a personal product experiment.
This Privacy Policy explains how Wari collects, uses, stores, and protects personal data when you use the Wari website and its features, including account creation, authentication, saved places, discovery activity, reflection features, and location-based features.
Wari is designed with data minimization in mind. We aim to collect and retain only the information necessary to provide the features of the service.
For privacy-related questions or requests concerning your personal data, please contact:
2. Who is responsible for your personal data?
Wari is currently operated as an independent, non-commercial project by Alexandre Favreau.
For the purposes of applicable data protection law, Alexandre Favreau is the data controller responsible for the personal data processed through Wari.
Wari is currently operated on a non-commercial basis and does not have a separate legal entity.
The identification of the data controller in this Privacy Policy does not affect the editorial anonymity preserved in Wari's Legal Notice under the regime applicable to non-professional online publishers under the French Law for Confidence in the Digital Economy (LCEN).
The Legal Notice and this Privacy Policy address different legal obligations: the Legal Notice concerns the public identification of the publisher, while this Privacy Policy identifies the data controller as required by applicable data protection law.
For privacy-related questions, requests concerning your personal data, or the exercise of your privacy rights, please contact:
Wari does not currently appoint a Data Protection Officer (DPO).
3. What personal data do we collect?
The information Wari processes depends on how you use the service.
3.1 Account and authentication data
When you create or access a Wari account, we may process:
- email address;
- name provided by your authentication provider;
- profile picture, when provided by the authentication provider;
- account creation date;
- authentication provider;
- provider account identifier;
- authentication information;
- session information.
Wari currently supports:
- Google authentication;
- passwordless email authentication using Magic Links.
Wari does not currently offer Apple Sign In.
3.2 Profile information
If you create or edit your Wari profile, we may process:
- first name;
- last name;
- email address;
- profile picture.
Wari does not currently ask for or store:
- gender;
- date of birth;
- spiritual or religious tradition.
3.3 Favorites and discovery activity
When you use Wari while signed in, we may associate the following information with your account:
- Resources you save as Favorites;
- Resources you have viewed;
- the type of Resource viewed;
- the date of a Resource view.
This information supports features such as Favorites, My Journey, and discovery counters displayed in your profile.
3.4 Reflection responses
Wari includes reflection features that allow you to respond to questions or prompts associated with certain experiences.
During the current MVP, reflection responses are not associated with your Wari account.
They are associated with an anonymous browser session identifier and are not linked to your authenticated user profile.
Anonymous reflection responses are automatically deleted 12 months after their creation.
4. Location data
Wari provides an optional location-based feature called Around Me.
When you choose to use this feature, your browser may provide Wari with your current location after you grant permission through your browser.
Your precise location is processed locally
Wari does not store your precise location in its database.
Your location is not written to localStorage or sessionStorage and is not associated with your Wari account.
During the MVP, your location is held temporarily in your browser while the feature is being used and is never persisted.
Wari uses your location locally to:
- determine whether you are within India's geographic boundaries;
- calculate distances between you and Wari Resources;
- sort nearby Resources;
- display distance information;
- position the map around your current location.
These calculations are performed locally in your browser.
Wari does not use a reverse-geocoding service to determine your country or location.
Mapbox
Wari uses Mapbox to provide interactive maps.
When you use the map, Mapbox may receive technical requests necessary to provide map content for the area being viewed. When Around Me is used, displaying a map centered around your location may result in map requests corresponding to the map viewport.
Wari does not send your precise location to its own servers as an account or profile attribute and does not store it in its database.
Mapbox may process personal data in its own capacity for certain services and purposes. Its current privacy documentation is available in its Privacy Policy.
5. Information stored only on your device
Some Wari functionality uses browser storage and does not send this information to Wari's servers.
The current MVP may store limited information locally on your device to personalize the Homepage, such as:
- emotions or experiences you have interacted with;
- the last quote you viewed.
This information:
- remains stored locally in your browser;
- is not stored in Wari's database;
- is not associated with your Wari account;
- is not transmitted to Wari's servers.
Local personalization data is automatically purged after 6 months from the last interaction.
Clearing your browser's local storage or changing devices may remove this information sooner.
For more information about browser storage and any technologies requiring consent, please see our Cookies & Local Storage policy.
6. Why do we use your personal data?
Wari processes personal data for the following purposes.
Providing Wari's services
We process account and profile information to:
- create and maintain your account;
- authenticate you;
- provide access to your profile;
- save your Favorites;
- support My Journey;
- provide account-based features.
Authentication and security
We process authentication and session information to:
- securely authenticate users;
- maintain authenticated sessions;
- protect accounts;
- prevent unauthorized access and abuse;
- maintain the security and integrity of Wari.
Providing discovery features
We associate certain activity with your account to provide features such as:
- discovery counters;
- viewed Resources;
- Favorites;
- My Journey.
Resource view records are automatically deleted after 12 months.
Providing location-based features
When you choose to use Around Me, Wari processes your location locally in your browser to provide nearby discovery features.
Operating and maintaining Wari
We may process limited technical information necessary to operate, secure, maintain, and troubleshoot the service.
Wari does not currently use personal data for:
- targeted advertising;
- behavioral advertising;
- marketing profiling;
- automated decision-making.
We use Vercel Web Analytics to understand aggregate usage of Wari (such as overall traffic and popular pages) in order to maintain and improve the service. This processing does not involve cookies, persistent identifiers, or individual profiling.
7. Legal bases for processing
Depending on the processing activity, Wari relies on the following legal bases under Article 6 of the GDPR.
Performance of a contract
We process information necessary to create and operate your Wari account and provide account-based features you request, such as authentication, Favorites, and My Journey.
Legitimate interests
We may process limited information where this is necessary for legitimate interests such as:
- securing the service;
- preventing abuse;
- maintaining the technical operation of Wari;
- protecting the integrity of the service;
- understanding aggregate usage of Wari to maintain and improve the service (via Vercel Web Analytics, without cookies or persistent identifiers).
Where we rely on legitimate interests, we consider the impact on your rights and interests and use the minimum information necessary.
Consent
Where applicable, Wari relies on your consent for processing activities that require consent under applicable law.
For location-based features, your browser will ask for permission before providing your location to Wari.
Withdrawing browser location permission will prevent Wari from providing features that require your current location.
8. Authentication providers
Wari currently uses Google for OAuth authentication.
When you choose to sign in with Google, Google provides Wari with the information necessary to establish your account and authenticate you.
The information made available through Google authentication may include your email address, name, and profile picture.
Google independently determines how it processes information within its own services. Google's current Privacy Policy is available here.
Wari also provides passwordless email authentication through Magic Links.
Wari does not currently offer Apple Sign In.
9. Email delivery
Wari uses Resend to deliver Magic Link authentication emails.
When you request a Magic Link, your email address and information necessary to deliver the email may be processed by Resend.
Resend is used as a service provider for transactional email delivery.
Wari does not currently use Resend to send:
- newsletters;
- advertising;
- promotional communications;
- marketing communications.
Resend provides a Data Processing Addendum and information regarding its GDPR practices. Its current documentation is available through its Privacy Policy and Data Processing Addendum.
10. Infrastructure and service providers
Wari relies on third-party infrastructure and service providers necessary to operate the service.
These currently include:
Vercel
Vercel provides hosting and deployment infrastructure for Wari.
Wari also uses Vercel Blob for storing media used by the service.
Wari also uses Vercel Web Analytics to measure aggregate site usage (such as page views and traffic trends). This service does not use cookies or persistent identifiers. To distinguish visits, it may briefly process a temporary hash derived from technical request information; this hash is automatically discarded within 24 hours and is never linked to your Wari account or stored by Wari beyond that period. Only aggregated, non-identifying statistics are retained.
Depending on the relevant processing activity, Vercel may process information as a data processor on Wari's behalf or as an independent controller for its own purposes.
Vercel's current Privacy Notice and Data Processing Addendum are available on its website.
Neon
Wari uses Neon to provide PostgreSQL database infrastructure.
Personal data associated with Wari accounts and application functionality is stored in the database infrastructure provided by Neon.
Neon provides a Data Processing Agreement governing processing performed on behalf of customers.
Payload
Wari uses Payload as its content management system.
Payload is used to manage Wari's editorial content and application data.
Mapbox
Mapbox provides the interactive map infrastructure used by Wari.
Google provides OAuth authentication when you choose to sign in with Google.
Resend
Resend provides transactional email delivery for Magic Links.
Third-party providers may process personal data according to their own legal documentation and, where applicable, according to agreements governing their processing on Wari's behalf.
11. Data retention
Wari retains personal data only for the periods defined below, according to the purpose for which the data is processed.
Data | Retention period | Mechanism |
|---|---|---|
Account / profile | As long as the account remains active | Deletion at the user's or administrator's request |
OAuth accounts | As long as the Wari account exists | Deleted when the account is deleted |
OAuth tokens | Only for as long as necessary to maintain the authentication connection | Deleted with the account |
Sessions | Until the session token expires | Automatic daily purge |
Favorites | As long as the account remains active | Linked to the account |
Resource views | 12 months from the date of the view | Automatic weekly purge |
Reflection responses (anonymous) | 12 months from creation | Automatic purge |
Local personalization (localStorage) | Rolling 6 months from the last interaction | Client-side purge |
Geolocation | For the duration of the browser session only | Never persisted |
Media | As long as the associated Resource exists | Cascade deletion + orphan cleanup job |
When an account is deleted, Wari deletes the personal data associated with that account according to the deletion mechanisms applicable to each data category.
Where data is subject to a defined automatic retention period, Wari's technical systems automatically delete the relevant data once that period has elapsed.
12. Data sharing and disclosure
Wari does not sell or rent your personal data.
Wari does not currently use personal data for targeted advertising.
Personal data may be processed by service providers necessary to operate Wari, including hosting, database, authentication, map, media storage, and transactional email providers.
Wari may also disclose information where necessary:
- to comply with a legal obligation;
- to respond to a lawful request from a public authority;
- to protect the rights, security, or integrity of Wari, its users, or others;
- to detect or prevent fraud, abuse, or security incidents.
Wari does not currently share user data with third parties for their own marketing purposes.
13. International data transfers
Some service providers used by Wari are established in or may process data from countries outside the European Economic Area (EEA), including the United States.
Where personal data is transferred outside the EEA, Wari relies, where applicable, on an adequacy decision or appropriate safeguards provided for under applicable data protection law, such as Standard Contractual Clauses.
The applicable transfer mechanism may depend on the provider and the specific processing activity.
For example, Vercel states that it may transfer and process customer data in the United States and other jurisdictions and describes the safeguards it uses, including the EU-U.S. Data Privacy Framework and other appropriate mechanisms where required.
Resend currently states that its customer data is stored in the United States and that its DPA includes Standard Contractual Clauses for EU-to-US transfers.
For further information about international transfers relevant to your personal data, contact:
14. Data security
Wari takes reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction.
These measures include, where applicable:
- authenticated access controls;
- secure authentication mechanisms;
- session expiration;
- controlled access to administrative systems;
- encrypted connections;
- established infrastructure and service providers;
- limiting data collection to information necessary for current product features;
- automatic deletion mechanisms for data subject to defined retention periods.
No online service can guarantee absolute security.
If Wari becomes aware of a personal data breach that is subject to notification obligations under applicable law, appropriate measures will be taken.
The GDPR imposes specific obligations concerning personal data breaches, including notification requirements in applicable circumstances.
15. Your privacy rights
Depending on the circumstances and applicable law, you may have the right to:
- Access the personal data Wari holds about you;
- Rectification of inaccurate or incomplete personal data;
- Erasure of your personal data;
- Restriction of processing;
- Object to certain processing;
- Data portability, where applicable;
- Withdraw consent, where processing is based on consent.
These rights are subject to the conditions and limitations provided by applicable law.
To exercise your rights, contact:
Please provide enough information for us to identify your account and understand your request.
We may need to verify your identity before responding to certain requests.
Under the GDPR, requests should generally be answered without undue delay and, in principle, within one month of receipt, subject to the applicable conditions and extensions provided by law.
16. Deleting your Wari account
You may request deletion of your Wari account by contacting:
When an account deletion request is accepted, Wari deletes the personal data associated with the account according to the applicable deletion mechanisms.
Deleting your account may result in the loss of:
- your Favorites;
- your My Journey information;
- your profile information;
- account-associated discovery activity.
Information stored only on your device, such as local Homepage personalization, may remain on your device until it is automatically purged or you clear your browser storage.
17. No automated decision-making
Wari does not currently make decisions about users based solely on automated processing that produce legal or similarly significant effects.
Wari does not currently use personal data for:
- automated eligibility decisions;
- scoring;
- advertising profiling;
- automated decision-making with legal or similarly significant effects.
18. Children's privacy
Wari is intended for users aged 16 and over.
Users under 16 may use Wari only with the consent and involvement of a parent or legal guardian who has the authority to provide that consent.
Wari does not knowingly seek to collect personal data from children under 16 without the required parental involvement.
If you believe that a child under 16 has provided personal data to Wari without the required parental involvement, please contact:
If Wari becomes aware that an account has been created by a user under 16 without the required parental involvement, Wari will take appropriate steps, which may include deleting the account and associated personal data.
Nothing in this section limits any rights or protections that may apply to minors under applicable law.
19. Changes to this Privacy Policy
Wari may update this Privacy Policy when the service, the personal data processed, the services used, or applicable legal requirements change.
When changes are made, the Last updated date at the top of this page will be updated.
For significant changes affecting how personal data is processed, Wari may provide additional notice where appropriate.
20. Contact
For privacy questions, data protection requests, or questions about how Wari handles personal data:
For general questions about Wari:
If you believe that your rights relating to your personal data have not been respected, you may also lodge a complaint with the data protection authority competent for your situation.
For users in France, the competent authority is the Commission Nationale de l'Informatique et des Libertés (CNIL). The CNIL provides an online complaint service.