Privacy Policy
Last updated: April 4, 2026
1. Who We Are
Viajero (“we”, “us”) is a travel recommendation platform that helps friends share and discover places around the world. This policy explains how we collect, use, and protect your personal information.
2. Data We Collect
Account Information
- Email address — used for authentication (magic links) and account recovery.
- Display name and username — chosen by you during profile setup.
- Profile picture URL — optional, provided by your auth provider.
Content You Create
- Saved places (recommendations), comments, and ratings.
- Friend connections and friend requests.
Analytics (With Your Consent)
If you accept analytics, we use PostHog to collect usage data such as page views, feature usage, and error reports. PostHog receives a pseudonymous user identifier but not your email, name, or other directly identifying information. IP addresses are anonymized by PostHog. Session recordings, when enabled, mask all text inputs. You can decline analytics at any time.
Automatically Collected
- IP address (anonymized by PostHog if analytics are enabled).
- Browser type, device type, and approximate location (from IP) for troubleshooting.
3. How We Use Your Data
- Provide the service — authenticate you, show your saved places, connect you with friends.
- Improve the product — anonymous analytics help us understand which features are useful.
- Communicate — transactional emails (magic links, account deletion notices). We do not send marketing emails.
4. Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication & database | Email, profile data |
| Vercel | Hosting | IP, request metadata |
| PostHog | Analytics (consent-gated) | User ID, usage events (IP anonymized) |
| Mapbox | Map display | Map tile requests (IP) |
| Google Places | Place data & photos | Place search queries |
| Resend | Transactional email | Email address, display name (delivery logs retained up to 30 days) |
5. Data Retention
We retain your data for as long as your account is active. When we process your deletion request, we anonymize your personal data (name, email) and mark the account as deleted. Recommendations you made may persist in anonymized form.
6. Your Rights
You have the right to:
- Access — download a copy of your data from Account & Data in your profile menu.
- Rectification — update your profile information.
- Erasure — delete your account from Account & Data in your profile menu. A 14-day grace period applies before data is permanently removed.
- Portability — export your data in CSV, GeoJSON, or KML format from Account & Data.
- Object — decline analytics via the consent banner.
- Direct transfer — you may request direct transfer of your data to another service where technically feasible. Contact us to arrange.
Grace Period
Your erasure request is processed immediately. We provide a 14-day window to reverse your decision before data is permanently purged. You will receive a reminder email before the grace period ends.
Do Not Sell or Share
We do not sell or share your personal information for cross-context behavioral advertising.
7. Children's Privacy
Viajero is not intended for children under 13 years of age (or 16 in the EU/EEA). We do not knowingly collect data from children. If you believe a child has provided us personal data, please contact us.
8. Security
We protect your data with encryption in transit (TLS), row-level security on our database, and regular security audits. No system is 100% secure — if you discover a vulnerability, please report it to us.
9. Do Not Track / Global Privacy Control
We respect Do Not Track (DNT) and Global Privacy Control (GPC) signals. When detected, analytics tracking is not enabled regardless of consent banner interaction.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email or an in-app notice.
11. Contact
For privacy questions or to exercise your rights, email maurorozco@gmail.com.