Privacy
Last updated 21 August 2026
Wayside is a guide to what is beside the road. It needs to know where you are going, and for one feature where you are. This page says exactly what is kept, for how long, and who else sees it.
Who we are
Wayside is operated by OpenCircle.ai. For anything on this page, including a request to see or delete what we hold about you, write to support@opencircle.ai.
What we store
| What | Why | How long |
|---|---|---|
| Your email address | It is your account. It is also where a verification code or a password reset is sent. | Until you ask us to delete the account. |
| Your password, hashed | Signing you in. We store a scrypt hash with a salt unique to your password, never the password itself, and the parameters are stored alongside it so the cost can be raised later without locking anyone out. | Until you ask us to delete the account. |
| Your sessions | Keeping you signed in. We store a hash of the session cookie rather than the cookie, so a copy of our session store is not a set of working logins. | Sessions expire on their own. Signing out deletes one immediately. |
| Routes you plan | So a route you have already paid to build opens again for nothing, and so your history list is there when you come back. | Until you delete the route, or the account. |
| Drives you record | Drive mode saves as it goes rather than at the end, because a drive does not end — the phone locks, the signal goes, the tab is closed five hundred miles later. A saved drive holds the positions it used and which pieces played, so it can be replayed. It does not hold audio. | Until you delete the drive, or the account. |
| Ratings and reports | Whether a piece was worth hearing, and anything you tell us is wrong with one. Ratings are stored against your account so a later tap replaces an earlier one rather than stacking. | Until you ask us to delete the account. |
| Deep dives you request | Which longer pieces you asked for, so they appear in your library. The piece itself is shared with everyone who asks about that place; the record of asking is yours. | Until you ask us to delete the account. |
| Server logs | Knowing whether the service is working. A line per request: the method, the path, the status and how long it took. | Held by our hosting provider on their retention schedule. |
Counting visits
Wayside uses Google Analytics to count page views and see which pages people arrive on. We use it to answer one question: is anybody finding this.
Nothing is stored on your device unless you agree to it. The first time you arrive, a bar at the bottom of the page asks. Until you answer, and if you answer no, no analytics cookie is set and nothing that could identify you or recognise you on a later visit is kept — Google is told to hold off before its tag has loaded, rather than after. Either answer leaves the app working exactly the same way.
If you say yes, it sets cookies in your browser, which is how it tells a returning visit from a new one, and it sends Google the page you are on, the page you came from, your browser and device type, and your IP address, which Google turns into an approximate location and does not keep in full.
You can change your mind whenever you like: the Cookies link in the footer of every page reopens that bar. We do not treat carrying on browsing as an answer, and we do not ask again once you have given one.
Google's advertising and remarketing features are switched off on our property. Wayside also sends your browser a policy naming the only Google hosts it is allowed to contact, and the advertising ones are not on that list — so those features cannot quietly start working because a setting changed somewhere.
Beyond that, Google publishes a browser add-on that turns analytics off on every site, and any browser setting that blocks third-party scripts will stop it here too.
Location
Drive mode asks your browser for your position, and your browser asks you first. If you say no, drive mode does not work and nothing else changes.
Positions are used to work out which way you are pointing and what is on the next ten miles of road. While a drive is being recorded, the fixes it used are saved with it so the drive can be replayed and so it can be given a name — the first and last position are turned into place names for the history list. We do not build a continuous history of where you have been, we do not sell location data, and we do not share it with advertisers. There are no advertisers.
Wayside cannot watch your location in the background. No browser permits it, which is why the app is a playlist rather than a live tracker.
What stays on your phone
Some settings never reach us at all. Your answer to the cookie question is one of them: it is written in your browser and read there, and we hold no record of who agreed. Whether children are in the car is kept the same way and sent with a request rather than stored against your account, because the same person drives alone on Tuesday and with the children on Saturday. Where you had got to in a route is kept the same way. Audio you have saved for offline use sits in your browser's cache and is deleted when you clear it.
Who else sees it
Four companies process data on our behalf. Each one gets the least it needs.
- Stripe takes payment. If you buy the paid plan, your card details go directly to Stripe on a page Stripe hosts. They never touch our servers: there is no card field anywhere in this application and no Stripe code on our pages. We receive an identifier for your subscription and nothing else about the card.
- Google counts visits, as described above. They receive the page you are looking at and what your browser tells any website: your IP address, which is turned into an approximate location and not stored by them in full, your referrer, and your device and browser type. They do not receive your email address or anything else from your account.
- Resend sends email — verification codes and password resets. They receive your email address and the message.
- Anthropic writes the pieces. They receive the text of a public source article and a prompt. Nothing about you is sent: not who asked, not what you are interested in, not where you are going. A piece about a place is written once and shared by everyone who ever drives past it, which is only possible because it contains nothing personal.
- OpenAI records the pieces as audio. They receive the text of a piece. Nothing about you is sent.
Our hosting provider runs the servers and the disk the corpus lives on.
Planning a route sends the place names you typed to a mapping service to turn them into coordinates and a road. That request carries the place names and nothing that identifies you.
What we do not do
- No advertising, no advertising identifiers, and no remarketing. Google's advertising features are switched off, and the browser is additionally told to refuse the hosts they would need.
- No tracking pixels beyond the analytics described above, and no other third-party scripts of any kind. Wayside loads nothing from a CDN.
- No selling of personal information, and no sharing of it for cross-context behavioural advertising, in the sense those words carry under California law.
- No profile built across sites, and nothing that tries to recognise you anywhere else.
Your rights
Whatever jurisdiction you are in, we will do these on request: tell you what we hold, correct it, give you a copy, or delete it. Write to support@opencircle.ai from the address on the account and we will answer within thirty days.
Deleting your account removes your email, your password hash, your sessions, your routes, your drives, your ratings and your library. It does not remove the writing about places, which is not about you and is shared with everybody.
Children
Wayside is not intended for children under 13 and we do not knowingly collect anything from them. The setting about children in the car is for the driver's benefit and is not an invitation for a child to hold an account.
Changes
If this page changes in a way that matters, the date at the top changes and we will say so by email to anyone with an account.