Privacy Policy

1. Who we are

Cartagena (hereinafter, "the App") is developed and operated by Ingeniería.dev, led by Chris Flores (hereinafter, "we", "the Developer").

• Contact: [email protected]
• Address: Av. Javier Barros Sierra 495, Santa Fe Lomas de Santa Fe Zedec Santa Fé, Álvaro Obregón 01219, Mexico City, CDMX, Mexico

2. What data we collect

None. This is not a simplification for the sake of a summary — it is the literal architecture of the App. Cartagena:

• Does not require registration or an account, and has no login of any kind
• Does not ask for your email, name, phone number, or any personally identifiable information
• Contains no third-party SDKs for analytics, advertising, tracking, attribution, or crash reporting
• Sends no telemetry, usage metrics, device identifiers, or behavioral data to any server
• Has no user profile to build, because there is no user identity to attach one to
• Does not access your contacts, camera, microphone, photos, calendar, or health data
• Does not display advertising and does not use the App Tracking Transparency framework, because there is nothing to track

Because we hold no personal data on any server, there is no database of users to breach, sell, subpoena, or hand over. That is the strongest privacy guarantee an app can offer, and it is the one we made by design rather than by policy.

3. Location access

The App optionally requests access to your device's location for two purposes. Both are processed exclusively on your device:

• When In Use (optional): used to show nearby places and to calculate how far each listing is from you, on foot or by car. If you deny this permission the App works normally — distances simply are not shown.
• Always (optional, off by default): used to trigger local notifications when you come near a hand-picked place, even with the App closed. This feature must be explicitly enabled by you. When active, iOS manages the geofences natively through CLCircularRegion; the App never polls or records your position in the background.

Your coordinates are never transmitted to our servers, never logged, never attached to an identifier, and never shared with any third party. They are evaluated on the device and discarded. Revoking the permission at any time from iOS Settings has no effect other than turning off distances and nearby alerts.

4. What is stored on your device

The App stores locally only what it needs to run and to work offline:

None of this is ever sent to us. It lives inside the App's sandbox on your iPhone, and deleting the App removes all of it permanently and irreversibly.

5. External services used

The App makes read-only requests to our public catalog API at https://cartagena.ingenieria.dev to download the catalog of places, restaurants, hostels, bars and cafés. This is a one-way download of public content. Specifically, the server:

• Requires no authentication and issues no user identifier, token, or cookie
• Receives no personally identifiable information
• Receives only two parameters: lang (your language, e.g. en, es, pt) and since (a timestamp used to download only what changed since your last sync)
• Never receives your location. No coordinates are included in any request the App makes

The App never performs write requests. There is no endpoint through which your data could reach us, because none exists.

5.1 Third-party maps and links you choose to open

Some actions hand off to another app or website. These are always initiated by you, by tapping a button, and are governed by that provider's own privacy policy — not ours:

• Apple Maps (MapKit): used for the in-app map view and for "Open in Apple Maps." Governed by Apple's Privacy Policy.
• Google Maps (external link): opened only when you tap "Open in Google Maps." The App does not embed the Google Maps SDK; it simply opens a URL with the destination's coordinates.
• Web searches: if you tap a button to look up a place or restaurant on the web or on social media, the App opens your browser with a search for that venue's name. Only the venue name travels in that search — never your identity or your location.

6. System permissions

The App requests only what it needs, and works without any of them:

• Location When In Use — optional. Shows nearby places and walking or driving distances.
• Location Always — optional and disabled by default. Powers local alerts when you are near a place. When active, iOS shows its standard location indicator.
• Notifications — optional. Used only for local alerts generated on your device. The App has no push notification service, no APNs device token is ever sent to a server, and we cannot send you a message remotely.

The App does not request access to: camera, microphone, contacts, calendar, reminders, photos, media library, Bluetooth, HealthKit, motion, or biometric data.

7. Marketing and advertising

The App displays no ads. We do not collect data for remarketing, profiling, segmentation, or behavioral analysis. We do not participate in ad networks. We do not sell, rent, or share information with third parties — we have none to share.

8. Minors

The App is rated 4+ on the App Store. Because it requires no registration and collects no personal data whatsoever, it complies with COPPA (United States), LGPD Infantil (Brazil), and GDPR-K (European Union) by design rather than by consent flow.

9. User rights (GDPR, CCPA, LFPDPPP, LGPD)

We collect no personal data on any server, so there is no file about you for us to produce, correct, or delete. The corresponding rights are nonetheless guaranteed by design:

• Right to access: Everything the App knows (favorites, trip plan, cache, alert history, language) lives on your device and is visible to you directly inside the App.
• Right to rectification: You can edit or remove any favorite or trip plan item at any time.
• Right to erasure: Uninstalling the App permanently deletes every byte it stored. No copy survives anywhere, because no copy was ever made.
• Right to object and to restrict processing: Revoke location or notification permissions in iOS Settings at any time; the App continues to work.
• Right to portability: Not applicable — no personal data exists on any external server.
• Right not to be subject to automated decisions: Your location is used only to compute distances and to evaluate geofences. No decision affecting your legal rights, employment, credit, or insurance is made from it.

For any question about your rights, email [email protected].

10. Security

Local data is stored inside the iOS sandbox, protected by the operating system and by device-level disk encryption (Apple's Data Protection API). No other app can read it. Network requests to our catalog API travel over HTTPS. Cached photo files may be purged by iOS under storage pressure; the App handles that gracefully and re-downloads them when you are next online.

11. International transfers

We perform no international transfers of personal data, because we store no personal data on any server. No personally identifiable information ever leaves your device.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the App or to applicable law. The current version will always be published at this URL along with the date of the last update. Material changes will also be announced inside the App.

13. Governing law

This Policy is governed by the laws of the United Mexican States, in particular the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Any dispute will be submitted to the competent courts of Mexico City.

14. Contact

Privacy Officer: Chris Flores
Email: [email protected]
Postal address: Av. Javier Barros Sierra 495, Santa Fe Lomas de Santa Fe Zedec Santa Fé, Álvaro Obregón 01219, Mexico City, CDMX, Mexico