WayfindYour customers see where the van is. Nobody's server sees where your customers live.
Live delivery and school-transport tracking with no tracking server in the middle. Addresses stay on the device that typed them. The person waiting gets a link that is 45 bytes long and needs no account, no app and no cookie banner to open.
On the way
Not before
08:59
2 stops before yours — about 4 minutes away if the van came straight here.
Live positionWhat a customer actually sees. The arrival time is worked out on their phone, from the van's own broadcast — which is why it can say "not before" honestly instead of inventing a promise.
Who it's for
It starts as one address and a link. It grows into whatever you actually run.
The same protocol underneath, and the words change to yours. A pharmacy does not have "jobs", it has patients; a school does not have "customers", it has parents who subscribe once in September.
Restaurants & takeaway
One order at a time
Orders arrive singly and go out as riders come free. Send the link with the order confirmation, before the food is even bagged.
Pharmacies
What happened at the door
Delivered, refused, nobody home — each one a signed, non-repudiable record with an optional doorstep photo. The answer to a regulator's question is already on file.
Courier fleets
Planned in the morning, reflowed all day
Rounds ordered by real driving time, handover between drivers mid-shift, and a skip that surfaces the second it happens rather than at close of business.
School transport
A route is fixed for a term; the driver is not
Parents subscribe once and the link never moves, even when today's driver is a substitute. No live map of children — a parent is told about their own stop and nothing else.
What's different
Every other tracker asks you to upload your customer book.
That is the part worth reading twice. A conventional tracker needs your stops on its servers to compute anything, which means a breach of a company you have never met is a breach of your customers. Wayfind is built so there is nothing to breach.
| Where does it live? | A conventional tracker | Wayfind |
|---|---|---|
| Your customers' addresses | On their servers, in a multi-tenant database | On the device that typed them. Never on the wire — a run broadcasts an 8-byte hash of its plan, not the plan |
| Your drivers' positions | Recorded centrally, indefinitely | Peer to peer, and only to whoever holds the link |
| The tracking link | An account, or a URL that phones home on open | 45 bytes in the part of a URL browsers never transmit. No endpoint anywhere receives it |
| The arrival time | Computed on their servers, so they learn which stop each person waits at | Computed on the recipient's own phone. Nobody is told which stop you care about |
| The map and the routing | A metered maps API, per request, forever | A static index read by byte range. No geocoding server, no directions API, no per-request bill |
The honest limit, stated plainly: because a run is peer to peer, a customer sees a position when the driver's phone is reachable. When it is not, the page says so — "nothing has arrived from the run for two minutes, so the last position has been taken down" — rather than leaving a stale dot on a map looking live.
The part nobody advertises
An estimate says "about". A floor says "not before". A settled delivery says "delivered 14:32". And when there is no map for the area, it says that — instead of a number somebody might drive to.
Overclaiming is the default failure of every tracking product: a confident ETA that was a guess, a green dot for a phone that died forty minutes ago. Wayfind is built so the interface cannot overclaim — each screen carries the specific claim the protocol authorised, and there is no code path that upgrades one.
How it works
Four steps, and none of them is "create an account for your customer".
Type the address
Read straight out of a published map index on your own device, by byte range. No geocoding request leaves the browser, because there is no query string to put an address in.
Send the job to a phone
The round travels as one sealed artifact — a QR code or a file — encrypted to a phone you paired once. A photograph of that code is ciphertext.
Give each recipient their own link
Same run, one link each, carrying only that person's own stop. They can watch the vehicle until it expires and learn nothing about anybody else on the round.
The record is the receipt
Delivered, skipped, failed — each signed by the vehicle and non-repudiable, with an optional photo committed by hash on the record itself. Not a row in a log somebody could edit.
Get started
Open the console and send one delivery.
There is nothing to install and no account to create to try it. The console runs in a browser and works with no cloud project behind it at all — which is also how a fleet running its own infrastructure will use it in production.
Run it on your own machine
A depot can run the one peer that connects its drivers and customers — a small box on its own network. Your fleet's traffic never crosses anybody else's infrastructure.
Or don't run anything
Hosted works the same way, because the hosted parts only ever hold ciphertext, receipts and wake-ups. A breach of our servers should be useless to whoever steals it.