Skip to content

Cookies and device storage

Version 1.0.0In force since 10 August 2026Last revised: 10 August 2026

What we store in your browser or on your phone, what each item is for, and how to get rid of it.

Document in preparation

The responsable's identity details are still to be set, and the law requires them to appear in this document. Until they are filled in, the text holds on substance but the identity block is incomplete. Write through the app's usual channels if you need to exercise a right in the meantime.

Fields still missing: entityName, responsibleName, address, contactEmail, privacyEmail, supportEmail

1. Everything we store

What
Supabase session cookies
Kind
Essential
What it does
Keep you signed in as you move between pages
How long
As long as the session lives
What
Language cookie (NEXT_LOCALE)
Kind
Essential / preference
What it does
Remembers whether you chose Spanish or English
How long
One year
What
Session identifier (huatulco.sid, in sessionStorage)
Kind
Analytics
What it does
Groups the events of one visit so every tap is not counted as a new visitor
How long
Dies when you close the tab
What
Welcome draft (in localStorage)
Kind
Essential / preference
What it does
Holds your answers from the first screen while you have no account
How long
Until you clear site data or create an account
What
Offline cache (native app only)
Kind
Essential
What it does
Stores the content pack so the app works with no signal
How long
Until you clear the app’s data

2. What is not here

There are no advertising cookies, no tracking pixels, no cross-site tracking, and no third-party analytics or crash-reporting SDK of any kind. This is not a statement of intent: it was verified across the whole codebase.

The only analytics are ours and first-party, and they do two concrete things: rank places by real popularity, and populate the dashboards businesses pay for. Those events carry no user column.

3. Why there is no consent pop-up

Mexico does not impose the prior pop-up consent that European rules require. The law that applies here treats this storage as ordinary processing: the notice must be made available to you, and consent is tacit unless you say otherwise.

There would also be nothing to ask about: there is no advertising and no tracking to authorise. A dialog asking permission to remember your language would be paperwork, and paperwork is what teaches people to accept without reading.

4. How to get rid of it

  • Close the tab and the analytics identifier is gone. There is nothing else to do.
  • Clear site data in your browser and the language cookie and the welcome draft go too. It will sign you out.
  • Browse privately and none of this survives the window.
  • Blocking cookies for this site will stop you signing in: session cookies are the mechanism by which the app knows you are you.
  • In the native app, clearing the app’s data from your phone’s settings removes the offline cache.

If you want to object to the analytics purpose in general, rather than just clear the identifier, write to us — the route is at Your data and your rights.