If our servers were broken into, what was taken would be useless.

The two lists

Two lists, and nothing ever moves from one to the other.

Most companies would publish the left-hand list and call it transparency. The right-hand one is the list that actually matters, because a court order, a break-in, or us being bought by somebody else still cannot turn any of it into data we have.

Drivers never sign in — their phone is set up once and that is that. Customers never sign in — they just have a link. You are the only person here with an account, and that is the whole reason there is no list of people for anyone to leak.

The link

The secret part of a tracking link never leaves the browser.

A tracking link does exactly one thing: it lets one person watch one vehicle until a set time. It works like a key rather than an account — and where in the web address that key sits is a genuine safety feature, not a design quirk.

One thing is allowed in the part that does get sent: a hint about which machine a phone should call first, so a device opening the page cold can find the van at all. That is a phone-number-for-computers, not a key — it unlocks nothing. The app carries a check that refuses to run if a key ever ends up in the sent half by mistake, and that check runs for real customers, not just in testing.

The arrival time

Worked out on the phone of the person waiting.

This sounds like a small detail and is really the whole design. A normal tracker works out your arrival time on its own computers — which means it has to be told which doorstep you are standing behind. That one fact, this person is waiting at this address, is the most sensitive thing in the whole system, and an ordinary tracker creates it just by answering the question.

Notifications

A notification is a doorbell, never a letter.

This is the one place the promise is genuinely hard to keep. Phones talking directly to each other cannot wake a phone that is asleep in a pocket — only Apple's and Google's notification services can do that, and those are somebody else's computers. So a Wayfind notification only ever says something changed. Once you tap it, the phone goes and gets the real thing the usual private way.

The obvious way to guarantee that does not work. You cannot reliably scan a message for addresses — 15 Rue de la Gare looks like any other short phrase, and a filter that misses things is worse than no filter, because it looks like protection. So the wording is not written when the notification is sent. There are seven possible notifications, the words are fixed in the app, and this is all of them:

That is the whole list. There is no box anywhere for anyone to type something else into, which is a much stronger thing to be able to say than "we check the messages". And when a notification comes back through Apple's or Google's servers, the phone re-creates the wording from that list and throws away whatever actually arrived — otherwise the fixed list would be decoration. The wording is also deliberately vague about whose delivery it is, because a notification lands on a lock screen, and lock screens get read over people's shoulders on the bus.

Proof of delivery

We store the photo. We are not the reason you can trust it.

A doorstep photo counts as evidence because the driver's phone signed a fingerprint of it at the moment it was taken — not because of where the file ended up. So the file itself can sit anywhere, including with us, scrambled so that we cannot open it. The key that would unscramble it belongs to the round, and it is not in the tracking link and cannot be worked out from one.

A customer's page will tell them a photo exists, because that fingerprint is public and signed. It will not try to show them the photo, because that would only fail. A screen that sat there loading would be hinting at a permission the person does not have.

Maps and routing

An ordinary map file, not a service that bills you per lookup.

In most dispatch tools, typing an address sends it away to a search service. Here there is nowhere to send it. The list of places is a public map file, and your device reads just the few pages it needs out of it — the way you would open a phone book at the right letter rather than posting your question to someone. The address is worked out on the machine that typed it.

There is no map of the whole world here, and out of the box there is no map at all — you load the region you work in. Somewhere with no map loaded still shows everything the van reports, and simply refuses to invent an arrival time. That is the honest way to fail, and a considerably less profitable one than guessing.

Honesty you cannot switch off

The screen cannot promise more than it knows.

Every product in this category promises not to show a confident time it cannot back up. Promises like that quietly rot. Here the app is simply built so that the misleading version cannot be produced — not discouraged, not flagged in a review, genuinely not possible.

There is a version of this written for engineers further down, if you want to know exactly how it is guaranteed rather than promised.

Children

We do not build a live map of a bus full of other people's children.

Every competitor in school transport sells exactly that and calls it peace of mind. A parent using Wayfind hears about their own stop and nothing else: "the bus has left stop 7 — yours is next, about six minutes". Children's names never reach the driver's phone at all. As far as the app is concerned a stop is a place with a number of children at it, and the school office keeps the rest.

Stops-only is how school transport arrives out of the box, and it is the one setting an operator has to go out of their way to change — with the app explaining, in plain words, what they are about to give up. It works this way because of how the system is built, not because of a policy we promise to keep, and that is the only kind of promise worth anything.

For the technical reader

Everything above, stated the way an engineer would want to check it.

The rest of this page is written for the person buying it. This last part is for whoever they hand it to. Nothing here contradicts anything above — it is the same claims with the mechanism left in, so you can verify them instead of believing them.

The engine underneath Wayfind, including the routing and the mesh protocol, is a separate open library: rangefind.dev. The claims on this page are properties of that protocol, which means you do not have to take them from us.

GET                       -> 200, 280909 bytes
GET Range: bytes=0-99     -> 206, 100 bytes
accept-ranges: bytes

What we will not build

The list is as much a part of the product as the features.

This page explains how the product is built and what it is capable of holding. It is not the legal privacy notice. If you need the formal document — who the data controller is, how long things are kept, how to exercise your rights — ask us for it rather than reading it into this page.