Privacy Policy

1. Who is responsible for your data

Bitáco is developed and operated independently by its creator team (contact: [email protected]). Under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), this team is the data controller for your personal data.

2. What information we collect

Account: if you create an account, your email address and password (securely handled by our authentication provider, Supabase), or your Google account if you choose to sign in with it.

Profile: first and last name, country and city of origin, date of birth, sex, orientation, how many times you've visited Mexico City, and a profile photo (if you choose to upload one).

Your travel plan: if you use the "My CDMX Plan" questionnaire, we save your answers — who you're traveling with, your travel pace, whether you drink, your interest in culture, and your "warrior level," among others — only to build your itinerary inside the app.

Your progress: which achievements you've completed, the date, your rating, and any notes or photos you add as evidence. Evidence photos are stored only on your device.

Location: if you grant permission, Bitáco uses your approximate location only while the app is open, to notify you when you're near an uncompleted achievement. Your coordinates are never stored or sent to our servers — the comparison happens on your own phone.

Notifications: scheduled directly on your device, without a third-party push service.

Bitáco works local-first: all your information is saved on your own device even if you never create an account. It's only sent to our servers if you choose to sign in, so your progress isn't lost if you switch phones.

3. What we use your information for

For the app to work: showing your progress, achievements, and travel passport; generating your personalized plan from your answers; notifying you when an achievement is nearby (if you granted location permission); letting you share your achievements if you choose to; and generating internal, aggregated statistics to improve the app.

Optionally, and only with your consent: sending you communications (updates, reminders). You can withdraw this consent at any time from Settings.

4. Who we share your information with

We don't sell your personal information, and we don't share it with third parties for advertising purposes. We use service providers to run the app: Supabase (database and authentication, on Amazon Web Services infrastructure) and, if you sign in with Google, Google as an authentication provider. Some of this infrastructure may be hosted outside Mexico; by using Bitáco, you consent to that international transfer, necessary to operate the service.

5. Where your information is stored

Locally on your device, and — if you have an account — also on Supabase's servers. Your GPS location is the one exception: it's never stored anywhere, on-device or in the cloud.

6. Your data rights and how to delete your account

You have the right to Access, Rectify, Cancel, and Object (ARCO rights) to the processing of your data, and to withdraw consent at any time. You can delete your account and all your information at any time, directly from the app: Settings → Delete my profile. This action is immediate and cannot be undone. If you'd rather exercise these rights by email, write to us at [email protected].

7. Minors

Bitáco automatically hides alcohol-related achievements for profiles belonging to minors, based on the birth date entered. If you're a parent or guardian and believe a minor in your care shared personal information without your consent, contact us to have it removed.

8. Changes to this policy

If we update this policy, we'll change the date at the top of this page and, if the change is significant, notify you within the app.

9. Contact

Questions, comments, or requests about your information? Write to us at [email protected].