Privacy Policy

This Privacy Policy explains how WishPath ("WishPath," "we," "us," or "our") collects, uses, shares and protects information when you use our website at wishpath.app, plan a trip, request a beta invite, or use WishPath Trip Texts (together, the "Service"). WishPath is operated by WishPath, LLC, a Colorado limited liability company.

WishPath is an independent trip-planning tool. It is not affiliated with, endorsed by, or sponsored by The Walt Disney Company or the Disneyland Resort.

WishPath Trip Texts haven't launched yet. Where this policy describes texts, it describes how the program will work when it opens.

Information we collect

We collect only what the Service needs to work. Depending on how you use it, that may include:

• Account: your email address and sign-in identifiers from our sign-in provider (never your password).
• Trips: park days, parks, Park Hopper, must-do and skipped attractions, and other preferences.
• Party: names or nicknames, whether each person is an adult or a child, and heights you choose to enter.
• Beta invite requests: your email address and, if you choose, your mobile number.
• SMS consent records: your number, when and where you agreed, the wording and policy versions shown, your browser type, a hashed IP address, and any opt-out.
• Text messages (when texting opens): the messages you send to and receive from WishPath Trip Texts.
• Location you tell us: in-park locations you report by ride name, such as "we're near Haunted Mansion" or "just got off Peter Pan." We don't use GPS or track your location.
• Trip activity (when texting opens): rides you've completed or skipped and the recommendations we've sent.
• Technical: IP address, browser type, request logs and error reports, plus a hashed IP address with each form submission to prevent abuse.

We collect this information from you directly, from your browser or device as you use the Service, and from our sign-in provider when you sign in.

Information kept in your browser

• Unsaved trip plans: if you start planning without signing in, your plan is stored only in that browser tab and is removed after 24 hours or when you clear it. It isn't sent to us until you choose to save it.
• Sign-in and settings: we use a cookie to keep you signed in, and your browser remembers settings such as reduced motion.

We don't use advertising or analytics cookies, and we don't use third-party advertising, analytics or tracking tools.

How we use information

We use information to:

• Provide recommendations about what to do next in the park, and respond to your messages.
• Check which attractions fit your party, based on the heights and other details you provide.
• Save your trips and let you edit or delete them.
• Send your beta invite and updates about the beta to the email address you give us.
• Keep a record of your agreement to receive texts, send the texts you've asked for, and honor opt-out and help requests.
• Operate, secure, test, troubleshoot and improve the Service.
• Prevent fraud, misuse and unauthorized access, including limiting repeated form submissions.
• Comply with legal obligations.

We don't send newsletters or marketing emails to beta invite addresses unless you separately agree. We don't sell your personal information, and we don't share it for targeted (cross-context behavioral) advertising.

How WishPath Trip Texts will use your information

When texting opens and you text WishPath, we'll use your phone number to find the trip you've confirmed, and the content of your message to understand what you're asking. To interpret a message written in everyday language, we'll send only the text of that message to our AI provider, OpenAI. We won't send your phone number, email address, or your party's names or heights. Recommendations themselves come from WishPath's own rules and live park data, not from the AI provider.

Mobile information and SMS consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties, except service providers that deliver the messages for us (such as our SMS provider, Twilio). Those providers may use the information only to provide their services to us.

For details on the texting program, including how to opt in and out, see our SMS Terms.

Who we share information with

We share information only with service providers that help us run the Service, and only what each one needs. They may use it only to provide their services to us.

• Twilio (text messaging): your mobile number and the messages you send and receive, once texting opens.
• OpenAI (AI message interpretation): the text of messages you send, as described above, once texting opens.
• Amazon Web Services (sign-in, through Amazon Cognito): your email address and sign-in identifiers.
• Hosting and database providers: the information stored in and processed by the Service, including account, trip, invite and consent information and technical logs.
• Email providers: your email address and messages, when we email you or you email our support address.

We get live park information, such as wait times and ride status, from a public park-data source. We don't send any of your personal information to it.

We may also disclose information if required by law or legal process, to protect the rights, safety or property of WishPath, our users or others, or as part of a sale or transfer of the Service. If the Service is transferred, this policy will continue to apply to information collected before the transfer.

How long we keep information

• Unsaved browser plans: up to 24 hours, in your browser only.
• Account information: while your account exists. When you ask us to delete your account, we delete it and its saved trips.
• Saved trips: until you delete them or your account.
• Beta invite requests: until the beta ends, or sooner if you ask us to delete them.
• SMS consent and opt-out records: while you're signed up for texts and for up to 5 years afterward, so we can show when consent was given or withdrawn.
• Text messages: we aren't sending or receiving texts yet. Before texting opens, we'll add how long we keep message content to this policy.
• Technical information: for a limited period needed for security and troubleshooting, then deleted.

Deleted information may remain in backups for a limited time until those backups expire.

Data security

We use reasonable administrative, technical and organizational safeguards to protect information, including encrypted connections, access controls and limited internal access. No system can be guaranteed to be completely secure.

Your choices

• Optional details: you can leave out optional information, such as heights, though some features may then be less accurate. If a height needed for a ride is missing, we won't assume the rider meets it.
• Edit or delete trips: you can edit or delete saved trips from your account.
• Texts: you don't have to agree to texts to request an invite. Once texting opens, reply STOP to any WishPath text to stop texts, or HELP for help. Until then, email us to withdraw your agreement.
• Access, correction or deletion: email support@wishpath.app to request a copy of your information, ask us to correct it, or ask us to delete it or your account.

Do Not Track

We don't track you across websites or let third parties do so, so we treat every visitor the same whether or not their browser sends a "Do Not Track" signal.

California privacy rights

If you're a California resident, you have the rights below under California law, including the California Consumer Privacy Act (CCPA).

What we collect. In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above:

• Identifiers: email address, mobile number, sign-in identifiers, IP address.
• Personal information described in Cal. Civ. Code § 1798.80(e): names or nicknames and mobile number.
• Characteristics you choose to provide: whether each party member is an adult or a child, and heights.
• Internet or other electronic network activity: request logs, browser type and error reports.
• Approximate location you report: in-park locations you text us, once texting opens. We don't collect precise geolocation.
• Other information you provide: trip details, beta invite requests, SMS consent records and, once texting opens, text messages.

We disclose each category only to the service providers listed above, for the business purposes described in this policy. We don't collect or use sensitive personal information to infer characteristics about you.

No sale or sharing. We have not sold personal information or shared it for cross-context behavioral advertising in the past 12 months, and we don't do so, including for people under 16. Because we don't sell or share personal information, there's nothing for an opt-out preference signal such as Global Privacy Control to turn off. We don't share personal information with third parties for their own direct marketing.

Your rights. You can ask us to:

• Tell you what personal information we've collected about you, where it came from, why we collected it and who we disclosed it to, and give you a copy of it.
• Delete the personal information we've collected from you, subject to legal exceptions (for example, records of SMS consent and opt-outs).
• Correct inaccurate personal information.

How to make a request. Email support@wishpath.app with your request. To protect you, we'll verify your request by confirming information we already have, such as asking you to reply from your account or invite email address, or to confirm a code sent to your mobile number. You can use an authorized agent; we'll ask for proof of the agent's authority and may ask you to confirm your identity directly. We'll confirm receipt within 10 business days and respond within 45 days. If we need more time (up to another 45 days), we'll tell you why.

No discrimination. We won't deny you the Service, charge you a different price or give you a different level of service because you exercised these rights.

Children

The Service is meant to be used by adults. A parent or other adult may enter limited information about children in their party, such as a nickname and height, to check attraction eligibility. Children may not create accounts, request invites or sign up for texts, and the Service is not directed to children under 13. If you believe a child has given us personal information directly, contact us and we'll delete it.

Where the Service operates

The Service is intended for people in the United States, and information is processed and stored in the United States.

Changes to this policy

We may update this policy as the Service changes. When we do, we'll update the effective date above and post the new version on this page. If a change materially affects how we use information you've already given us, we'll tell you by email or on the Service before it takes effect.

Contact us

Questions or requests about this policy:

WishPath, LLC · support@wishpath.app

See also our Terms & Conditions and SMS Terms.