Privacy notice (full)

Huatulco.app is a travel guide to Huatulco, Oaxaca, Mexico. Much of it works without an account.

If you never sign in, we store nothing linked to you. We record usage events — which screens and places were viewed, what was searched for, how many results came back — in a table that has no user column at all: it cannot technically be tied to a person. Those events carry a session identifier generated in your browser, held in sessionStorage, which dies when you close the tab. It does not follow you between visits.

What you tell the welcome screen (language, dates, party size, interests) stays in your own device storage until you create an account. If you never create one, it never reaches us.

If you create an account, we process:

• Identification and contact data: your email address and password, handled by Supabase Auth. Passwords are stored hashed and we never see them. If you sign in with Google, we receive the basic profile details Google shares.
• Profile: display name, username, avatar image, language and country, if you provide them.
• Your saved activity: favourite places and events, trip plans and itineraries, your nature life list, any hours or content reports you file, and anyone you have blocked.
• AI concierge conversations: the messages you write and the model’s replies, plus technical details of each turn (model used, token counts, latency). Read the AI notice — this is the most sensitive part of all of it.
• Purchases: payment identifier, amount, currency and tier. Your card details never touch our servers — they are handled by Mercado Pago, Apple or Google Play depending on where you buy.
• If you claim a business or work as a photographer: the link between your account and that business or photographer profile, and whatever you publish from it.

We do not ask for sensitive personal data — health, ethnic origin, beliefs, sexual preference, biometrics — and no screen in the app requests any. The only way such data could reach us is if you typed it into a concierge conversation, which is why the AI notice asks you plainly not to.

When you tap a "near me" control or the map’s locate button, your browser asks your permission and, if you grant it, uses your position to sort the list by distance. We never ask for it on load and never in the background.

Those coordinates travel in the page address (?lat=…&lng=…) so the server can order the results. We do not write them to our database, but, like every address you visit, they appear in our hosting provider’s request logs described in section 7.

Necessary purposes — without these the service cannot be provided, and they need no separate consent because they are the service you asked for:

• Creating and maintaining your account and session.
• Storing and showing you your favourites, trip plans, nature list and concierge conversations.
• Generating concierge replies and itineraries (see section 7 and the AI notice).
• Processing and recording purchases, and giving you what you bought.
• Preventing abuse: rate-limiting requests, moderating visitor-submitted content and handling reports.
• Meeting legal, tax and accounting obligations, and responding to lawful requests from a competent authority.
• Handling your ARCO requests and being able to show that we handled them.

Optional purposes — you can object to these and still use the service:

• Our own usage analytics, which is how places are ranked by real popularity and how the dashboards businesses pay for are populated. These events carry no user column, so they do not describe an identified person.
• Commercial messages. Today we send none: the only email this service sends is Supabase Auth’s confirmation and password-recovery mail. If we ever send a newsletter it will be because you asked for it, with a way to unsubscribe in every message.

• Use the app without an account. Most of the content works signed out, and with no account there is no record tied to you.
• Delete your account whenever you like, from Delete my account. Read section 9 first: two things do not go with it.
• Object to the optional purposes by writing to the privacy address in section 1. You do not need to give a reason to object to an optional purpose.
• Withdraw your consent at any time by the same route. Withdrawal has no retroactive effect on processing already carried out.
• Control your browser storage. Clearing site data removes the session identifier, the language preference and the welcome-screen draft.

You have the right to access your data, to rectify it when it is inaccurate or incomplete, to cancel it when you believe it is not needed for the purposes in this notice, and to object to its processing for a legitimate reason.

The full procedure — what your request must contain, how quickly we answer, and what to do if the answer does not satisfy you — is at Your data and your rights. Exercising these rights is free.

We do not sell your personal data and we do not share it with advertisers. These providers process it on our behalf so the service can work:

Supabase, Vercel, Google and Anthropic operate mainly from the United States, so using the service involves an international transfer of data. Mercado Pago operates from Mexico and Argentina.

Weather comes from Open-Meteo, and map data and species photographs from OpenStreetMap and iNaturalist. Those services receive destination coordinates and catalogue queries — never anything about you.

We also share data when a competent authority lawfully requires it, and we may do so in a corporate reorganisation, in which case the acquirer takes on the same obligations set out in this notice.

To limit how many requests one origin can make — which is how abuse of the concierge, the contact form and the analytics endpoint is held back — we take your IP address, run it through SHA-256 with a secret salt, and keep only the truncated result. The address itself is never stored in our database.

Separately, Vercel and Supabase log the IP of every request in their own infrastructure logs, as any internet server does. Those logs are theirs, outside our control, and we cannot delete them on your behalf.

In addition, payment records are kept as accounting evidence, and editorial content you created as a business owner (the listing, the menu, events) stays published, with no attribution to your account.

• Passwords are hashed by Supabase Auth and we never see them.
• Every table holding personal data is protected by row-level security policies in the database: a query made with your session can only reach your own rows.
• Photos you submit wait for approval in a private bucket, not a public one.
• A photographer’s deliveries are private to the person receiving them.
• Traffic is encrypted with TLS.

We claim no certifications we do not hold, and no system is invulnerable. If we detect a breach that significantly affects your rights, we will tell you without delay at the email address on your account.

The service is not directed at children under 13 and we do not knowingly collect their data. If we find an account belonging to someone younger we will delete it; if you are a parent or guardian and believe this has happened, write to the privacy address.

This notice carries a version number and an effective date at the head of the page. When it changes, the version goes up.

• A substantial change — new data, new purposes, a new provider receiving your data — moves the major or minor number and is shown to you inside the app the next time you open it, before you carry on using it.
• A wording correction that does not change the meaning moves only the last number and updates the last-revised date, without interrupting you.

The version in force is always the one published on this page.

If you believe we have breached your right to data protection, you may file a solicitud de protección de datos with the Secretaría Anticorrupción y Buen Gobierno, which has been the private-sector data protection authority since INAI was dissolved. You have fifteen days from the day we give you our answer, or from the day our deadline to answer expired.

Resolutions of the Secretaría are challenged by juicio de amparo, heard by specialised judges and courts.