Privacy Policy

How Waylight handles account information, saved documents, reminders, support data, and privacy choices.

This policy explains how Waylight handles privacy for the product, including health-touching features where they apply.

Who we are

Waylight is operated by Hypercowboy LLC DBA Waylight, 318 Main St #101, Evansville, IN 47708. Waylight helps families navigate Medicaid and home-care programs. Waylight is not affiliated with, endorsed by, or acting for any state, Medicaid agency, Medicaid program, or government body. Using Waylight is optional; official forms are free directly from the government agency responsible for the relevant program.

What we collect

• Account: email address or phone number (passwordless sign-in), your state, notification preferences.
• Waitlist: if you join before launch, your email address, where on the website you signed up, and records showing when you requested and confirmed launch updates. The waitlist does not collect health information, form answers, IP addresses, or user-agent information.
• What you save: the care situation you set up (a short name and optionally birth year for the person you care for), journey stages, deadlines, documents and letters you choose to save, questions you ask.
• Technical basics: device push token (if you enable notifications), app version, and first-party usage events (which screens are used — never containing personal or health details). We use no advertising or third-party analytics trackers.

What we don't do

No selling data — ever. No advertising. No sharing with data brokers. No Social Security numbers on our servers (packet documents are created on your device and never uploaded). No health details in text messages or notification previews. No geofencing.

How your information is used

To run the product you see: placing you on the right journey, showing deadlines and reminders you set or confirm, answering questions from Waylight's own verified content, and providing support when you contact us. If you join the waitlist, we use your email address only to confirm your request, send occasional Waylight launch updates, maintain your subscription preferences, and respond to privacy or support requests. Legal bases and consent mechanics for health data are in the Health Data Privacy Policy — health-touching features are opt-in, separately.

Text messages

Text messages are optional. If you choose phone sign-in, Waylight may send one-time verification codes. If you turn on text reminders, Waylight may send generic reminder texts for items you save or enable in the app. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out or HELP for help.

Waylight SMS messages do not include names, Medicaid IDs, health details, case details, or other sensitive details. We do not sell, rent, disclose, or share mobile information or SMS opt-in data with third parties or affiliates for promotional or marketing purposes. We may share mobile information and SMS consent status with service providers only as needed to deliver messaging services.

Service providers

Supabase (database/storage, encrypted), Google Cloud Vertex AI (AI processing; no training on your data), Resend (email), Telnyx (SMS, only if you opt in), Vercel/Expo (hosting/app delivery). Each receives only what its function needs.

Retention

The published schedule in retention-schedule.md governs: letter photos and AI outputs ≤30 days; packets and SSNs never stored; account data for the life of the account. Waitlist email addresses and consent records are retained while the Waylight waitlist and launch-update program operates and deleted within 90 days after it ends, unless deletion is requested sooner. Unsubscribe information may be retained during the program solely to prevent future email. Documents you choose to save (submission receipts, proof documents, and vault documents) are kept for the life of your account, can be deleted one at a time whenever you like, and are removed by account deletion. Deleted data leaves backups on their rotation (≤35 days).

Your choices and rights

Access/export, correction, deletion (in-app: Settings → Delete my account; web: askwaylight.com/delete-account; email: support@askwaylight.com). Every Waylight launch update includes an unsubscribe link. You may also unsubscribe, request deletion, or correct your waitlist email information by contacting support@askwaylight.com. Unsubscribing stops future launch and marketing email; a later subscription requires a new signup and confirmation. Notification and SMS opt-outs are available any time (reply STOP for SMS). Indiana, Washington, Nevada, Connecticut and other state-specific rights are honored per the Health Data Privacy Policy.

Security

Encryption in transit and at rest; least-privilege access; row-level isolation of every account's data; no plaintext sensitive fields; breach notification under applicable state law and the FTC Health Breach Notification Rule should it ever be needed.

Children

Waylight is for adults (18+). Care recipients are described by the account holder; children do not use Waylight themselves.

Contact & changes

support@askwaylight.com. Changes are posted with a new version; material changes are announced in-app before taking effect.