Privacy Policy
How Waylight handles account information, saved documents, reminders, support data, and privacy choices.
Companion to the Health Data Privacy Policy, which governs health information specifically and controls where the two overlap.
Who we are
Waylight is operated by Hypercowboy LLC DBA Waylight, 318 Main St #101, Evansville, IN 47708. Waylight helps families navigate Medicaid and home-care programs. Waylight is not affiliated with, endorsed by, or acting for the State of Indiana, FSSA, Medicaid, or any government agency. Using Waylight is optional; official forms are free directly from FSSA.
What we collect
- Account: email address or phone number (passwordless sign-in), your state, notification preferences.
- What you save: the care situation you set up (a short name and optionally birth year for the person you care for), journey stages, deadlines, documents and letters you choose to save, questions you ask.
- Technical basics: device push token (if you enable notifications), app version, and first-party usage events (which screens are used — never containing personal or health details). We use no advertising or third-party analytics trackers.
What we don't do
No selling data — ever. No advertising. No sharing with data brokers. No Social Security numbers on our servers (packet documents are created on your device and never uploaded). No health details in text messages or notification previews. No geofencing.
How your information is used
To run the product you see: placing you on the right journey, showing deadlines and reminders you set or confirm, answering questions from Waylight's own verified content, and providing support when you contact us. Legal bases and consent mechanics for health data are in the Health Data Privacy Policy — health-touching features are opt-in, separately.
Text messages
Text messages are optional. If you choose phone sign-in, Waylight may send one-time verification codes. If you turn on text reminders, Waylight may send generic reminder texts for items you save or enable in the app. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out or HELP for help.
Waylight SMS messages do not include names, Medicaid IDs, health details, case details, or other sensitive details. We do not sell, rent, disclose, or share mobile information or SMS opt-in data with third parties or affiliates for promotional or marketing purposes. We may share mobile information and SMS consent status with service providers only as needed to deliver messaging services.
Service providers
Supabase (database/storage, encrypted), Google Cloud Vertex AI (AI processing; no training on your data), Resend (email), Telnyx (SMS, only if you opt in), Vercel/Expo (hosting/app delivery). Each receives only what its function needs.
Retention
The published schedule in retention-schedule.md governs: letter photos and AI outputs ≤30 days; packets and SSNs never stored; account data for the life of the account. Documents you choose to save (submission receipts, proof documents, and vault documents) are kept for the life of your account, can be deleted one at a time whenever you like, and are removed by account deletion. Deleted data leaves backups on their rotation (≤35 days).
Your choices and rights
Access/export, correction, deletion (in-app: Settings → Delete my account; web: askwaylight.com/delete-account; email: support@askwaylight.com). Notification and SMS opt-outs any time (reply STOP for SMS). Indiana, Washington, Nevada, Connecticut and other state-specific rights are honored per the Health Data Privacy Policy.
Security
Encryption in transit and at rest; least-privilege access; row-level isolation of every account's data; no plaintext sensitive fields; breach notification per Indiana law (≤45 days) and the FTC Health Breach Notification Rule (≤60 days) should it ever be needed.
Children
Waylight is for adults (18+). Care recipients are described by the account holder; children do not use Waylight themselves.
Contact & changes
support@askwaylight.com. Changes are posted with a new version; material changes are announced in-app before taking effect.