Sayulita GuideSayulita Guide

Privacy Policy

This policy explains what the Sayulita Guide app and the sayulitaguide.com website collect about you, what we do with it, who else receives it, how long we keep it, and the choices you have. It describes version 1.13.1 of the app and later.

The short version: we do not sell your personal information, we do not use advertising networks, and we do not track you across other companies' apps or websites for advertising. The app does use product analytics and crash reporting. Both are on by default, and you can turn them off in Settings.

1. Who We Are

Depending on where you live, laws such as Mexico's LFPDPPP, Canada's PIPEDA, the GDPR in the EU and the UK, and California's CCPA give you rights over your personal data. Section 6 explains how to use them.

2. What We Collect

2.1 Information you give us

Your name and profile photo appear next to your community posts and comments, where other signed-in users of Sayulita Guide can see them. Reviews are public: your full name, profile photo, rating and review text are shown in the app and on our website, where anyone, including search engines, can see them. The public leaderboards show your first name and the initial of your last name (or your whole name if it is a single word), your profile photo, your points and the number of missions you completed; the games leaderboard also shows how many games you played and your best score.

2.2 Location and photos

The app only asks for location access "while using the app". It never asks for background location and does not collect your location while it is closed. With your permission, it uses your location for:

Your last known location. If you have allowed location access, when the app starts and you are signed in, the app sends your phone's last known location to our server, if your phone has a reading from the last few minutes (at most once every 10 minutes). We store it on your profile, replacing the previous one. This happens whether or not you have turned on Deals & offers. We use it to decide whether you are in or near Sayulita when a local business sends a promotional notification to people in town, and to tell a business how many people such a notification would reach (a number only). A reading older than 72 hours is not used for this. To stop it, turn off location access for Sayulita Guide in your phone's settings.

Photos. Before any photo leaves your phone, the app re-encodes it, which removes the location data (GPS) stored inside the file. If that cannot be done, the photo is not uploaded. Uploaded photos are stored on our content delivery network (CDN) at public web addresses: anyone who has a photo's link can view it. For passport stamps, the check-in coordinates are sent separately from the photo, as described above.

2.3 Collected automatically in the app

2.4 Inquiries to businesses

To contact a business through the app you need a phone number on your profile. When you send an inquiry, we build a message that includes your name, email, phone number, the details you chose (such as dates and number of people) and what you wrote, save a copy of it, and open WhatsApp or your email app with the message filled in. You send it. From then on the business has your details and handles them under its own practices. We keep our copy until you delete your account, when it is deleted with everything else (see 5.1).

On this website you can also write to a business from its page, without an account, when the business has an email address with us. The form asks for your name, your email and your message. We email them to the business through SendGrid, our email provider, with your email set as the reply address, so the business answers you directly. We never show you the business's email address. We do not save your message on our servers: the only thing we keep is a record of the listing, contact method, sending time and reference code, without your name, email or message. We use these records to count sent enquiries separately from contact-button taps and keep them for 13 months. Open and click tracking is switched off for these emails. A Cloudflare Turnstile check on the form stops spam (see 2.6). Once the business has your message, it handles your details under its own practices.

2.5 Purchases (business owners)

Business products are paid through the Apple App Store or Google Play Billing. Some earlier subscriptions were paid through Stripe on our website. We store which product you bought and for which listing, its tier, status and dates, the price paid for promotions, and the transaction identifiers from Apple, Google or Stripe. For Stripe subscriptions we also created a customer record at Stripe with your name and email. We never receive your card number.

2.6 On this website

3. What We Do Not Do

4. How We Use Your Information

4.1 Our legal basis for each use

Where the law asks us to name a legal basis, these are ours:

5. How Long We Keep It

5.1 When you delete your account

Request it in the app under Profile → Settings → Privacy & Data → Delete Account. We email you to confirm. While the request is still pending, you can cancel it by replying to that email or writing to [email protected]. Our team reviews the request and completes it within 30 days of when you made it. When we delete your account, we also delete its link to your Apple or Google sign-in. To remove Sayulita Guide from your Apple or Google account as well, use Settings → your name → Sign in with Apple on your iPhone, or Security → Third-party connections in your Google account.

Deletion is permanent. Your content is deleted, not anonymized. We delete:

Public listings and events you created stay in the directory with your name removed, and businesses you claimed stay listed without an owner. Photos you uploaded for a business listing are not removed from our CDN, because a listing that stays in the directory may use them.

What we keep after deletion:

6. Your Rights

You can access, correct and delete your data, and withdraw consent. In Mexico these are known as ARCO rights.

6.1 How long we take

We answer privacy requests within 30 days of receiving them. There is no charge. The in-app export is only ever sent to the email address on your account.

6.2 Why app analytics are on by default

In the app, product analytics and crash reports are on by default, and you can turn them off. That is an opt-out model, not an opt-in one. Here is why, so you can judge it:

The website is stricter: nothing optional loads there until you agree in the cookie banner, except the review tool for someone who opened a private review link (see 2.6).

7. Who Else Receives Data

These companies receive data when you use the app or the website. Most process it for us; some, such as Apple, Google, Mapbox and OpenStreetMap, also handle it under their own terms. Each has its own privacy policy.

8. Children

Sayulita Guide is not directed at children under 13. Signing up on the app's sign-up screen asks you to confirm that you are at least 13. If you believe a child under 13 has an account, email [email protected] and we will delete it.

9. Data Outside Your Country

We are based in Canada, and the companies in section 7 operate in several countries, including the United States. Your data may be processed outside the country where you live.

10. Security

Connections to the app's servers and this website use HTTPS. Passwords are stored as scrypt hashes. On your phone, the app keeps your sign-in token in the phone's secure storage (the iOS Keychain, or encrypted storage backed by the Android Keystore). We limit request rates, check email sign-ups for bots, run our servers behind Cloudflare, and encrypt our database backups. Remember that uploaded photos are at public web addresses, so do not post anything you would not want others to see. No system is perfectly secure.

11. Changes to This Policy

When we change this policy, we update this page and the date at the bottom of it.

12. Contact

Questions, requests or complaints about your privacy: [email protected]

This policy is also available in Spanish. If the two versions ever differ, the English version applies.