Cookies, SDKs and Similar Technologies Policy
Version dated: 9 November 2026.
Applies from: 9 November 2026.
1. The Company and Scope
The Policy is provided by „ФАЙЪР 09“ ЕООД (FIRE 09 EOOD), UIC 207134356, 28 Stefan Stambolov Blvd., Sofia 1000, Bulgaria, contact@wandro.io, https://wandro.io, telephone +359 877 743 009.
The website and the iOS/Android application are treated separately. The document is informational and does not constitute general consent. The Privacy Policy applies to personal data.
2. Definitions
- Cookie: a file stored and read in the browser.
- SDK: an embedded software component for an external service.
- Local storage: data on the device.
- Local notification: a message created on the device, not sent from a server.
- Strictly necessary technology: necessary for a specific, expressly requested function.
- Optional technology: not necessary for the core requested function.
- Operating system permission: technical access that is not general legal consent.
3. Choices
Necessary technologies are used only to the extent necessary. The presence of an SDK does not automatically mean that each of its operations is strictly necessary.
Analytics and optional personalisation are switched on through a separate prior choice. Refusal does not block unrelated functions.
Choices are not pre-enabled. Consent is specific, demonstrable and easy to withdraw.
Necessary technical logs are kept separate from analytics. There is no separate crash tool, and there are no advertising cookies, advertising SDKs or advertising identifier.
4. The wandro.io Website
4.1. Technologies
| Technology | Purpose and data | Activation | Retention |
|---|---|---|---|
| wandro_locale — first-party cookie, SameSite=Lax | Remembers bg/en | When a language is selected | 180 days |
| Firebase Hosting (Google) | Delivery and protection; IP, requests and technical data | On a visit | the Company keeps no separate request logs; Google processes them to deliver and protect the website |
Technical records for hosting: IP address, requested address, time of the request, browser and device — processed by Google to deliver and protect the website; the Company has not switched on separate storage of request logs.
The deletion page does not require sign-in and does not create an authentication session or its own local records. The request is sent by email. The necessary identity verification is carried out through correspondence, not through sign-in on the website.
The usual technical requests for displaying the page remain distinct from authentication.
4.2. Technologies Not Used
The website does not use visit statistics tools, Google Analytics, Meta Pixel or advertising cookies.
4.3. Browser
wandro_locale changes with the language and can be deleted from the browser. The choice is then not remembered.
Deleting cookies does not automatically erase server data already collected.
5. The Mobile Application
5.1. Services
| Service | Function | Activation |
|---|---|---|
| Firebase Authentication | Profile and sign-in | Registration and sign-in |
| Cloud Firestore | Profile, personal features, unlocks, impressions, reports and purchases | When the relevant feature is used |
| Cloud Storage for Firebase | Photos in the diary and in impressions | Upload |
| Cloud Functions | Deletion, unlocking, service messages from RevenueCat to the infrastructure, emails to Users, withdrawal from the contract and erasure by retention periods | The relevant operation |
| Google Analytics for Firebase | Statistics and events | Only after consent |
| RevenueCat | Verification of purchases, subscriptions, access and restoration | On every launch, including before a purchase |
| Google Maps SDK | Map and technical requests | Opening a map |
| Location | “Near me” („Близо до мен“), map and navigation | Active use and permission |
| Local notifications | Reminders and events | On request and with permission |
| Local storage | Settings and “For You” („За теб“) | When chosen; “For You” — switched on separately |
Data sent to RevenueCat before the first purchase: a generated identifier created by RevenueCat (without name or email) and, after sign-in, the identifier of the WANDRO profile; data on the device, the operating system, the app version and the store; purpose — showing the products and checking purchases and the subscription.
5.2. Analytics
It is switched off by default. The choice is made with a separate box when the profile is created, which is not ticked in advance; an unticked box is a refusal.
The automatic events described in the Privacy Policy and WANDRO route events are collected — opening, map, start, saving, liking and sharing, with an identifier.
No User ID is set and no advertising identifier is used.
Management: “Profile” („Профил“) → “Settings” („Настройки“) → “Usage statistics” („Статистика за ползването“).
After switching off, new collection stops. A request concerning previous data is considered separately.
5.3. Location
It is used only actively, without background use and without being recorded in the profile. Impressions contain the coordinates of the place.
The Google Maps SDK shows the current location. With “How to get there” („Как да стигна“), Google Maps opens with the current coordinates as the start and the place as the end.
The permission is managed in iOS/Android. Refusal affects the dependent features, not all maps and content.
5.4. Notifications
They are created locally for reminders and events. There are no server-sent or advertising notifications on the device.
Service messages from RevenueCat to the infrastructure are not notifications to the user.
Management: “Profile” → “Settings” → “Notifications” („Известия“) and the operating system settings.
Reminders are kept until shown or cancelled, in accordance with the actual behaviour of the device.
5.5. “For You” and Local Data
The recommendations use local preferences based on the tags of liked impressions. These preferences are not sent to the server infrastructure.
The feature is optional and is switched on separately.
Switching on, switching off and reset: Profile → Settings → “For You suggestions” („Предложения „За теб““) (on, off and reset).
The other settings remember the choice made.
Clearing:
- iOS — removing the application;
- Android — “Settings” → “Apps” („Приложения“) → WANDRO → “Storage” („Съхранение“) → “Clear data” („Изчистване на данните“), or removal.
This is not presented as guaranteed erasure of all system backups or protected storage.
5.6. Purchases
Purchases are made through the stores and are verified through RevenueCat. The product, transaction, identifier and status are processed.
The separate records are kept in accordance with the Privacy Policy. Deletion and uninstalling do not stop the subscription.
5.7. Photos
The camera or the system photo picker is used. The selected photos are uploaded.
EXIF: photo metadata (EXIF), including coordinates, is removed on upload.
6. What Is Not Used
Advertising SDKs and cookies, the advertising identifier, the Meta SDK, cross-app tracking, a separate crash tool, server-sent notifications on the device and background location are not used.
The website does not use Google Analytics or Meta Pixel. The fonts in the application are embedded.
7. Recipients and Transfers
The persons, the specific roles, the regions and the international mechanisms are set out in Sections 8–9 of the Privacy Policy and apply equally here.
Information about the services:
- https://firebase.google.com/products/auth;
- https://firebase.google.com/products/firestore;
- https://firebase.google.com/products/analytics;
- https://maps.google.com/;
- https://www.revenuecat.com/;
- https://www.apple.com/app-store/;
- https://play.google.com/store.
Information about the safeguards: contact@wandro.io.
8. Retention
The exact periods under Section 10 of the Privacy Policy apply:
- wandro_locale — 180 days;
- profile and content data — until deletion and the defined technical period;
- RevenueCat, Firebase Analytics and Firebase Hosting — the relevant confirmed periods;
- Cloud Functions technical logs — the period actually set;
- purchases — separate periods according to the purpose;
- local settings and “For You” — until reset or clearing;
- backups — in line with the actual scope described in Section 10 of the Privacy Policy; the database is copied once a day and each copy is kept for 14 days, and its earlier states for 7 days.
The deletion page does not create an authentication session. Correspondence on the request has a separate period.
Data that an external provider processes as an independent controller is distinguished, and that provider’s applicable policy is indicated in the Privacy Policy.
9. Management
On the website:
- language — the language selection and the browser;
- profile deletion — https://wandro.io/en/delete-account and a request by email.
In the application:
- analytics — “Profile” → “Settings” → “Usage statistics”;
- “For You” — Profile → Settings → “For You suggestions” („Предложения „За теб““) (on, off and reset);
- location, camera, photos and notifications — the device settings;
- profile — “Profile”;
- subscription — the relevant store;
- restoration — “Profile” → “My access” → “Restore purchase” („Възстанови покупка“).
A valid objection or withdrawal is not ignored because of the absence of DNT.
10. Security
Measures appropriate to the risk are applied. Absolute security is not promised, and the obligations of the Company are not excluded.
11. Age
The Platform is for persons aged 18+. Where use below this age is established, the Terms of Service and the Privacy Policy apply.
12. Changes
A new optional technology is not switched on before the necessary choice.
An amendment of the policy is not consent. Before a new purpose, information is provided and, where necessary, separate consent is obtained.
13. Contact Details
„ФАЙЪР 09“ ЕООД (FIRE 09 EOOD), UIC 207134356
28 Stefan Stambolov Blvd., Sofia 1000, Bulgaria
contact@wandro.io · https://wandro.io
Telephone: +359 877 743 009.