WayMore Vibe — Privacy Policy

Effective date: 5 November 2026

This policy explains what personal data AMD Telecom GmbH processes when you use the WayMore Vibe apps and the WayMore service behind them: what we process, why, who receives it, how long we keep it, and what rights you have.

1. Who we are

The controller of your personal data is:

AMD Telecom GmbH Blegistrasse 15, 6340 Baar, Switzerland ("WayMore", "we", "us")

• Privacy questions and requests: dpo@waymore.io
• General contact: info@waymore.io

Our representative in the EU under Art. 27 GDPR: Rokos Dimitrios, 2 km Litis, Thessaloniki, Greece.

2. What this policy covers

• WayMore Vibe for Android.
• WayMore Vibe for Windows, and the same desktop app for macOS and Linux.
• The WayMore engine, the waymore program the desktop app includes and runs on your computer (also available as a command-line app).
• The WayMore service at chat.waymore.ai, as far as the apps use it: sign-in, AI answers, history recall, web search, usage and plan information.
• The WayMore website at chat.waymore.ai when you use it directly in your browser: your account, web chat, usage, billing and organization pages (see section 4.12 for cookies).

It does not cover services you choose to connect yourself. Their own privacy policies apply to what they receive:

• your own AI provider accounts, if you configure one instead of WayMore's;
• tools and "MCP" servers you add;
• websites the assistant opens for you;
• a WayMore engine you run yourself and pair your phone with (section 4.11).

If your organization provides WayMore

Organization plans. If your employer or another organization pays for your plan, its administrators see your usage — requests, tokens, cost and devices — to manage billing and seats. They do not see your conversation content through WayMore.

On-premise deployments. WayMore also offers an on-premise option: the organization provides the hardware (GPUs), and WayMore provides the complete AI stack, including the AI models, to run in the organization's own environment. In that case:

• your conversations, files and AI processing stay in your organization's environment. They are not sent to WayMore's cloud or to the AI providers in section 7;

• your organization is the controller of that data, and its own privacy notice applies. WayMore acts only on your organization's instructions under its contract with us, for example when providing support;

• the apps still contact WayMore for:

  • product telemetry (section 4.7), unless your organization switches it off;
  • outage alerts (section 4.8);
  • update checks, for installations not managed by an app store (section 4.9).

  Your organization can ask us about configurations that remove these connections.

3. Our commitments in short

• We never use your content to train AI models. This covers your conversations, files, code and images. Our AI providers may not use them to train either.
• Conversation content is deleted from our servers within 30 days. The exceptions are content our safety screening flags as abuse, and cases where the law requires longer (section 5.2).
• AMD Telecom's backend receives only the content needed to answer you, not your name, email address or device details.
• Much of what the apps keep never leaves your device: your conversation history, the assistant's memories, the project search index and file checkpoints (section 6).
• Telemetry describes how the software behaves, not what you type, and you can switch most of it off.
• You can delete your account and the data linked to it at any time (section 11).
• We do not sell your personal data. Your conversations, files and code are never used for advertising. Advertising cookies run on our website only if you allow them (section 4.12).

4. What the apps send, and why

4.1 Your account

You sign in through chat.waymore.ai in your browser, choosing Google, GitHub or email. From your account the apps receive:

• your name, email address and profile picture;
• your plan.

The apps keep a sign-in token so you stay signed in:

Signing out in the Android app deletes the token from the phone. You can see and revoke your signed-in devices at chat.waymore.ai.

For account security we record the IP address, browser and approximate location of each sign-in, and failed sign-in attempts.

Why: to provide the service you signed up for (contract), and to protect your account from unauthorized access (legitimate interests).

4.2 Your requests to the assistant

On the desktop, the WayMore engine sends the following to chat.waymore.ai when you use the assistant:

• your messages and the conversation so far;
• the context the engine adds to every conversation:
  • the path of the project folder you work in, and a listing of that folder;
  • your project's instruction files (such as AGENTS.md);
  • the index of the assistant's saved memories, and a memory's text when it is used;
  • git information: the branch, the names of changed files, the last three commit messages, and the repository address when it is on a well-known public host (with credentials removed);
• the contents of files the assistant reads, and the output of commands and tools it runs — including anything those files or outputs contain;
• images and videos the assistant opens;
• extra requests the engine makes for the same session:
  • titles for conversations;
  • summaries when a long conversation is condensed;
  • suggested next steps;
  • short checks that decide whether a built-in feature applies;
  • a check at the end of a task whether something is worth remembering (up to 60,000 characters of the recent work).

In the Android app's cloud mode, each message sends the whole conversation of that chat. Attachments are not sent.

We pass this content to our AI model to generate the answer (sections 5 and 7). Please don't give the assistant secrets it does not need: whatever it reads becomes part of the request.

Why: this is the service itself (contract).

4.3 Device and project identifiers

Desktop. Requests to the WayMore service carry:

• your computer's name (hostname);
• the operating system, its version and the processor architecture;
• a random device ID, created on first use and stored in ~/.waymore/device_id;
• the app version and the session ID;
• a project key: the full path of the project folder with separators replaced, for example C--Users-alex-projects-shop. It usually contains your user name on that computer.

Android (cloud mode).

• Sign-in requests carry:
  • the device model and Android version (read from the system web view);
  • a device name ("WayMore Vibe (model)");
  • a random device ID.
• Every request carries the app version and platform.

We use these identifiers to list and manage your devices, to attribute usage to devices and projects, and to troubleshoot problems. We do not pass them to AI model providers. We keep them with request records for 30 days (section 9).

Why: device management (contract); troubleshooting and abuse prevention (legitimate interests).

4.4 Web search, web pages and images

When the assistant searches the web or reads a web page, the search terms and page addresses go to our search and page-reading service. That service queries search providers (section 7). If it is unavailable, the desktop engine fetches the page directly from your computer, and the website sees your IP address.

When an answer contains a link to an image, the app loads that image directly from the site that hosts it, which sees your IP address as it would in a browser. The same applies to your profile picture, which loads from wherever your sign-in provider stores it.

Why: to answer questions that need current information (contract).

4.5 Memory and history recall

The assistant can remember what you worked on in earlier sessions.

• How it works: after a desktop session goes quiet, our service extracts short facts from it — decisions, findings, preferences. These facts are added to later requests where relevant, and you can search them. Only your own facts are ever used or returned.
• What is sent: recall questions go to chat.waymore.ai with the project key. When a new request reads like a review or an audit, the desktop engine also sends its first 500 characters, so relevant earlier work appears before the assistant starts.
• Retention: 12 months, after which facts are deleted.
• Switching it off: on the desktop, set [retrieval] history_search_enabled = false in ~/.waymore/config.toml. We then stop extracting new facts from your sessions and stop using existing ones. To have existing facts deleted, contact us (section 11). The Android app only searches when you ask it to.

Why: so long-running work carries forward without you re-explaining it (contract).

4.6 Usage and billing

We record the number of requests, token counts, the model used and the cost, per account and device. You can see them on your usage page.

Why: to show you your consumption, to enforce plan limits and to bill you (contract; legal obligation for billing records).

4.7 Product and reliability telemetry

Desktop. The engine and the desktop app send events describing how the software behaves, for example:

• which tool ran, and whether it failed (by category);
• how long a step took, and token counts;
• which settings or modes you changed;
• crashes: the error type and a fingerprint of the stack trace;
• the app's own memory and CPU use;
• update checks.

Each event carries:

• a random device ID, the session ID and the project key (section 4.3);
• the app version, operating system and version, architecture, language setting, terminal type and model;
• your sign-in token, so events are linked to your account.

Our server also records the IP address and app identifier of each upload.

Telemetry does not contain the text you type, file contents or the commands you run. It does contain names you choose (MCP server names, skill names, the names of slash commands you use). It also contains short technical error messages, up to 200 characters, when a connection to an MCP server fails; these can include that server's address.

Android.

• Cloud mode sends events about:

  • chat turns (outcome, model, duration);
  • sign-in and sign-out outcomes;
  • how many results a recall search found;
  • switching between cloud and paired mode;
  • menu use.

  They carry the app version, the platform ("android") and the device ID, and are linked to your account. While offline, up to 200 events wait on the phone; events older than 7 days are discarded at the next upload.

• Paired mode: the same app events go to your own engine, which forwards them according to its telemetry setting.

Switching it off.

• Desktop: Settings → General → Telemetry, or telemetry = false in ~/.waymore/config.toml, or the environment variable WAYMORE_DISABLE_TELEMETRY=1. It takes effect the next time the app starts. It does not stop:
  • the outage alerts in section 4.8;
  • the in-app message events in section 4.9;
  • the identifiers that accompany service requests (section 4.3).
• Android cloud mode: the app has no telemetry switch yet. You can object at any time (section 11), and we will stop processing your telemetry.

Events that could not be sent wait in ~/.waymore/telemetry on your computer and are deleted after 7 days. With telemetry off, they are never sent.

Why: to find and fix what breaks and to improve the product (legitimate interests). You can object (section 11).

4.8 Outage alerts

When the AI service stays overloaded after the desktop engine's retries, the engine sends us an alert containing:

• the error message (up to 1,000 characters);
• the session ID, the model and the number of attempts, with times;
• the operating system and architecture, and the app version.

Why: to detect and fix service outages quickly (legitimate interests).

4.9 In-app messages and updates

The apps fetch announcements and tips from chat.waymore.ai, roughly every four hours. They report whether a message was shown, closed or clicked (the message ID and the event), linked to your account. Images and videos in these messages load from WayMore's servers.

The desktop app checks cdn13.waymore.io for a new version when it starts and every four hours. This request reveals your IP address and app version. If telemetry is on, the result is reported as an update-check event: your current and the latest version, how the app was installed, and the outcome. Apps installed from Google Play or the Microsoft Store are updated by the store.

Why: to tell you about changes, to measure whether messages are useful, and to keep the app up to date (legitimate interests).

4.10 Feedback you send

When you send feedback from the app, we receive:

• your text (up to 5,000 characters);
• the session ID, app version, operating system and default model.

Why: to answer and act on your feedback (legitimate interests).

Automatic diagnostic reports and learning controls — rollout disabled. These are separate from feedback you send manually. Backend support and account settings are being prepared; automatic collection through these new endpoints is disabled in this release. This notice does not enable collection or change the current no-training commitment in section 5.1.

The implemented rollout controls distinguish two purposes:

• Automatic diagnostics default to metadata only. Relevant diagnostic excerpts need their own content permission; reporting does not authorize training. Diagnostic content has a 30-day limit from its original acceptance.
• Optional learning candidates need explicit project approval in Learning settings, including the content classes, internal destination, capture and intended future training/evaluation uses, retention and policy version. A grant lasts 30 days and requires another explicit approval to renew. A CLI, model or ordinary API token cannot issue that approval. Candidate acceptance does not select a training dataset or start training; any future training release requires the applicable published policy and independently verified consent and dataset eligibility.

Candidate retention is limited to 30 days or the shorter approved period. Renewing authorization does not extend the original content deadline or restore deleted material. Revocation blocks new authorized use immediately and queues live-store removal within 24 hours. It does not promise automatic unlearning of already-trained models. Privacy requests remain available when collection is disabled, and operator notifications contain bounded identifiers and support references, not source excerpts, credentials or approval tokens.

Verified account deletion also queues removal of automatic-feedback content and its account-linked metadata. If the backend cannot acknowledge the access block, the administrative deletion result shows the follow-up as pending and retries it; it does not label that follow-up complete. Short-lived replay fences are removed after deletion processing, once in-flight authorization has expired.

Before this rollout can be enabled, cleanup and identity-deletion workers must be healthy, encrypted backups for this flow must age out within 30 days, and restore procedures must prevent removed content from reappearing. The existing general backup period in section 9 is not permission to retain this flow longer. No automatic-feedback data is collected merely because these controls exist.

4.11 Android: paired mode and Google components

Paired mode. You can pair the Android app with the WayMore engine running on your own computer.

• The phone then talks to that computer, which sends requests to WayMore under that computer's account, as described above.
• The pairing address and access token are stored on the phone until you disconnect.

Google components. The Android app includes Google's ML Kit and Google Play services components for scanning pairing QR codes.

• If you scan a code, the camera image is processed on your phone by Google Play services; the app receives only the decoded pairing address and does not store or send the image.
• Google states that ML Kit collects device information, the app's package name and version, per-installation identifiers, and performance and error metrics, and sends them to Google for diagnostics and usage analytics.

Device backup. If Android backup is enabled on your phone, app data may be included in your device backup, including sign-in tokens, the device ID, cloud chats and pairing settings.

4.12 The website: cookies and browser storage

The website at chat.waymore.ai uses two kinds of cookies and similar technologies. The apps themselves do not use advertising cookies.

Necessary: always on. The website needs these to work:

When you sign in with Google or GitHub, or pay through PayPal (Braintree), those providers may set their own cookies, for example for fraud prevention. Their own privacy policies apply.

Why: necessary to provide the website you asked for (contract; legitimate interests), so we do not ask for consent to these.

Marketing and measurement: only if you allow them. We run advertising campaigns, including on Meta (Facebook, Instagram) and Google. With your consent, the website loads tags from these providers (such as the Meta Pixel and Google's advertising and measurement tags). They let us:

• measure which campaigns bring visitors, sign-ups and purchases;
• show WayMore ads to people who visited our website, and to similar audiences;
• understand how visitors use the website.

These tags send the provider information such as the pages you visit, the actions you take (for example signing up or buying a plan), your IP address, browser and device details, and cookie identifiers. Meta and Google may link this to your account with them and use it under their own privacy policies. They never receive your conversations, files or code.

Nothing in this category runs until you agree in the cookie banner. If you decline, we use Google's consent mode: Google tags then send only cookieless signals without identifiers, and Meta tags do not load. You can change or withdraw your choice at any time in the website's cookie settings; this does not affect what was done before you changed it. These cookies last as long as the provider sets them, up to 2 years.

Why: your consent (section 10).

4.13 Download-page recommendations and enterprise enquiries

The optional plan finder can show a recommendation without collecting contact details. Your answers are held in the page until you choose to submit them. If you explicitly agree to save your answers and be contacted about your request, we store your name, email, company if provided, role, intended use, team size, workload estimates, current AI providers and plans, stated spending, deployment preference, and any message you include. We also store the resulting recommendation and when you gave consent. A signed-in submission is linked to your account.

Contact details and answers are encrypted at rest. Authorised administrators can read the enquiry to advise you. Our internal Mattermost sales channel receives a link to the authenticated enquiry view, without your contact details or answers in the notification. We retain enquiries for 90 days and delete account-linked enquiries when the account is deleted. Contact dpo@waymore.io to request a copy, withdrawal, or earlier deletion, including for guest enquiries. Submitting a request does not subscribe you to marketing messages.

Why: your consent to save and follow up on the request.

5. How we handle data on our servers

5.1 No training

We do not use your conversations, files, code, images or memories to train AI models, and we do not sell them or share them for advertising. We only use AI providers whose terms do not allow them to train on the content we send.

5.2 Retention

• Conversation content is deleted within 30 days: requests, answers, tool output, summaries, uploaded images and videos, search terms and the related logs.
• Exceptions:
  • Our automated safety screening checks each request. If it flags a request as abusive, we may keep that request for up to 2 years to investigate and prevent abuse.
  • If the law requires us to keep something longer, we keep it only as long as that obligation lasts.
• Speed-up cache: while you are working, a short-lived cache may keep a question and its answer for up to 7 days. It is used only for your own requests.
• All other periods are listed in section 9.

5.3 Who can see it

Access to conversation content is limited to a small number of authorized staff. They access it only to:

• investigate abuse or a security incident;
• resolve a problem you reported, with your permission;
• comply with the law.

Access is logged.

5.4 What AI providers receive

AI providers receive the conversation content needed to generate an answer, and a random session identifier some use for caching. They do not receive your name, email address, device name or other device identifiers.

6. Data stored only on your device

Desktop. The engine keeps its data in the folder ~/.waymore in your home folder. On macOS and Linux the folder is readable only by your user account; on Windows, your user profile's permissions apply. It holds:

• your conversations and settings;
• the assistant's memories, with their history;
• copies of your project's files taken at each step, so changes can be undone;
• a search index of your project's text files;
• how long commands take;
• the assistant's to-do lists;
• logs (kept 10 days);
• working files the assistant made;
• the device ID;
• telemetry waiting to be sent.

The desktop app's own window also keeps interface preferences and, in cloud mode, cloud chats and sign-in tokens.

Android. The app keeps its settings, sign-in tokens, the device ID and cloud-mode chats on the phone. Signing out clears your cached cloud chats from the device. When a new account signs in, only that account's history will load from the server.

We only receive this data when it is sent as described in section 4 — for example, when the assistant reads a file into a conversation. You can delete it at any time: remove the ~/.waymore folder, uninstall the app, or clear the app's data on Android.

7. Who receives your data

We use the following service providers ("sub-processors"). Each processes data only on our instructions, under a written agreement.

Other service providers

Others

• Sign-in providers you choose (Google, GitHub) confirm your identity to us.
• Google, through the ML Kit and Play services components in the Android app (section 4.11), and through Google Play if you install from there.
• Microsoft, if you install from the Microsoft Store. The Windows app displays its interface with Microsoft Edge WebView2.
• Authorities, where the law requires it.

We will update this list before a new provider starts receiving personal data.

8. International transfers

Our own servers are located in Greece. Personal data is also transferred to the countries in section 7. For these transfers we use the European Commission's standard contractual clauses, as recognised by the Swiss Federal Data Protection and Information Commissioner, or another safeguard the law permits. You can ask us for a copy (section 11).

9. How long we keep data

10. Legal bases

We process personal data under the Swiss Federal Act on Data Protection (FADP) and, for users in the European Economic Area and the United Kingdom, the GDPR. Where the GDPR applies, we rely on:

• performance of a contract (Art. 6(1)(b)) for your account, AI answers, web search, memory and history recall, device management, usage and billing;
• legitimate interests (Art. 6(1)(f)) for telemetry, outage alerts, safety screening and security, identifiers used for troubleshooting, and in-app messages. Our interest is running a reliable, secure and improving service;
• legal obligation (Art. 6(1)(c)) for billing and accounting records;
• consent (Art. 6(1)(a)) for marketing and measurement cookies on the website (section 4.12). You can withdraw it at any time.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

11. Your rights and choices

Depending on the law that applies to you, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict processing;
• data portability;
• object to processing based on legitimate interests, including telemetry, and to direct marketing at any time;
• withdraw consent where we rely on it.

To exercise a right, write to dpo@waymore.io from the email address of your WayMore account. We answer within 30 days.

You may also complain to a data protection authority:

• in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch);
• in the EU, the authority in the country where you live or work.

Deleting your account

You can ask us to delete your account and the data linked to it:

• In the app: Settings → Delete account.
• By email: write to dpo@waymore.io from the email address of your account, with the subject "Delete my WayMore account".

We confirm the request, delete the account, and delete the linked data within 30 days: conversation content, memory facts, uploaded files, device records and telemetry. We keep billing records only as long as the law requires (section 9). Data stored on your own devices is not affected; remove it as described in section 6.

12. Security

• All connections between the apps and WayMore's servers are encrypted (HTTPS).
• On the desktop, sign-in tokens are kept in your operating system's credential store where available, and the ~/.waymore folder is restricted to your user account on macOS and Linux.
• Access to our servers and to conversation content is restricted and logged (section 5.3).
• No system is perfectly secure. Protect your devices, and disconnect a phone from your computer if you lose it (section 4.11).

13. Children

The apps are not directed to children under 16, and we do not knowingly collect data from them.

14. Changes to this policy

We may update this policy. The effective date above shows the current version. We will announce material changes in the apps or by email before they take effect.

15. Contact

AMD Telecom GmbH, Blegistrasse 15, 6340 Baar, Switzerland Privacy: dpo@waymore.io · General: info@waymore.io