The honest, plain-language version. Wander changes the location your device reports — nothing about where you really are ever leaves your phone. Here's exactly how, and why it isn't malware.
Wander works entirely on the device in your hand. It sets the location that apps read from the system — a local simulation — and that's it. Your real GPS coordinates are never collected, never uploaded, and never sent to us or anyone else. There's no tracking server watching where you go, because Wander doesn't need one to do its job.
On iPhone, the simulated location runs over an on-device developer tunnel. On Android it uses the built-in mock-location developer setting. On Mac and Windows it talks to a tethered iPhone over a local USB tunnel. In every case the work happens locally, between you and your own hardware.
You don't have to take our word for any of this. The iPhone and desktop apps are open-source under the MIT license. The full source is public, so anyone — you, a friend who codes, a security researcher — can read exactly what the app does, line by line, and confirm it does nothing shady.
Open-source is the strongest answer to "is this safe?" there is: the behavior is verifiable, not just promised. (The Wander brand and logo are separate from the code, but the code itself is yours to inspect.)
The Mac and Windows builds are unsigned. That means the first time you open Wander, macOS Gatekeeper or Windows SmartScreen might show a warning like "unidentified developer" or "Windows protected your PC." This is expected. It is not a virus alert — it's the operating system noticing the app didn't pay for an official code-signing certificate.
Code-signing certificates cost money every year, and for a small independent app that's a real barrier. Plenty of trustworthy indie software ships unsigned for exactly this reason. The warning is about a missing certificate, not about anything harmful in the app — and since the desktop app is open-source, you can verify that for yourself.
Our install guide walks through clicking past the warning on both macOS and Windows, step by step. See the install instructions →
A few features (Street View imagery and the AI routine generator) rely on paid API keys. Those keys are never shipped inside the apps. They live only in a small server-side Cloudflare Worker, which checks your plan and forwards the request. That keeps the keys out of reach if someone inspects the app, and means the apps themselves carry no secrets worth stealing.
Accounts are handled by Firebase Authentication (email & password, or Google — Apple sign-in is coming). We keep only what an account genuinely needs to work. Payments go through Lemon Squeezy, so Wander never sees your card numbers. Analytics are aggregate and privacy-friendly (Cloudflare Web Analytics), with no cross-site tracking. We never sell your personal data — ever.
The reassurances above, at a glance.
Your location is simulated locally. Your real location never leaves your phone.
iOS & desktop are MIT-licensed. Read every line on GitHub before you install.
Sensitive API keys stay server-side in a Cloudflare Worker — never bundled in the app.
Runs on a normal, unmodified device on every platform. Nothing risky to your phone.
We store your email and plan. No location history, no card numbers, no reselling.
Checkout runs through Lemon Squeezy. Wander never sees your card details.
Wander is an independent tool. It is not affiliated with, endorsed by, or partnered with Niantic, Pokémon GO, Life360, Apple, Google, or any app you might choose to use it alongside. If you use Wander with a third-party app or service, you're responsible for following that service's own terms.
Still have a question about how any of this works? Get in touch — we're happy to explain.
Wander