Privacy Policy

Costa Rica Backpackers · Last updated: April 25, 2026 · Version 1.0

One-line summary Costa Rica Backpackers does not collect, store, or transmit personal data. Your location is used only on-device to show distances and trigger local alerts — it never reaches any server.

1. Who we are

Costa Rica Backpackers (hereinafter, "the App") is developed and operated by Ingeniería.dev, led by Chris Flores (hereinafter, "we", "the Developer").

Contact: christian@irack.mx
Address: Av. Javier Barros Sierra 495, Santa Fe Lomas de Santa Fe Zedec Santa Fé, Álvaro Obregón 01219, Mexico City, CDMX, Mexico

2. What data we collect

None. The App was designed with privacy by default. It:

Does not require registration or an account
Does not ask for your email, name, phone number, or any personally identifiable information
Does not include any third-party SDKs for analytics, advertising, tracking, or crash reporting
Does not send telemetry, usage metrics, or behavioral data to any server we control
Does not access your contacts, camera, microphone, photos, calendar, or health data

The public API at https://tours.ingenieria.dev is read-only and receives only a ?lang= query parameter (e.g., ?lang=en). This parameter contains no personally identifiable information and is not logged per user.

3. Location access

The App optionally requests access to your device's location for two purposes, both of which are processed exclusively on your device:

When In Use (optional): used to show your distance from nearby curated places and hostels on the map. If you deny this permission, the App works normally — distances are simply not displayed.
Always (optional, user-initiated): used to trigger local geofence alerts when you are within approximately 5 km of a curated place. This feature is off by default and must be explicitly enabled from Profile → "Nearby alerts." When enabled, iOS manages geofences natively; the App never polls your location in the background.

Your location coordinates are never transmitted to any server, logged, or shared with any third party. They are processed locally on the device and discarded when no longer needed.

4. What is stored on your device

The App stores locally only what is needed to operate and deliver an offline experience:

Data	Purpose	Location
Cached place and hostel data (names, coordinates, descriptions, URLs)	Enable offline browsing and faster loading	Device (SwiftData + `cachesDirectory`)
Cached photo files	Display place and hostel photos without a network connection	Device (`cachesDirectory` — clearable from Profile → "Clear photo cache")
Favorites list	Remember the places and hostels you saved	Device (SwiftData)
Custom trip plan	Store your personalized itinerary	Device (SwiftData)
Geofence alert history	Prevent repeat notifications (max 2 alerts per place, 24 h cooldown)	Device (SwiftData)
Language preference	Remember your chosen language across sessions	Device (UserDefaults)

All of this data is never sent to our servers. Deleting the App removes everything permanently.

5. External services used

The App makes read-only network requests to the public API at https://tours.ingenieria.dev to load the list of curated places and hostels. This server:

Does not require authentication
Does not receive personally identifiable information
Receives only the ?lang= query parameter (language preference, e.g., en, es, pt)
Does not log IP addresses per user in a way that identifies individuals

When you tap "Open in Google Maps" or "Open in Apple Maps," the App passes the place's coordinates to the external maps application of your choice via a deep link. This action is initiated by you and is subject to the privacy policies of Google or Apple, respectively. The App has no control over data handled by those applications.

5.1 Third-party maps

Apple Maps (MapKit): used for the in-app map view. Governed by Apple's Privacy Policy.
Google Maps (external link): opened only when you explicitly tap "Open in Google Maps." Governed by Google's Privacy Policy. The App does not include the Google Maps SDK.

6. System permissions

The App requests only the permissions it needs:

Location When In Use — optional. Used to show your distance from nearby places on the map. You can use the App without this permission.
Location Always — optional, user-initiated. Used to deliver local geofence notifications when you are near a curated place. Disabled by default. When active, iOS shows the blue location indicator in the status bar.
Notifications — optional. Used only for local geofence alerts. No push notifications are sent from any server.

The App does not request access to: camera, microphone, contacts, calendar, reminders, photos, media library, Bluetooth, HealthKit, or biometric data.

7. Marketing and advertising

The App displays no ads. We do not collect data for remarketing, profiling, segmentation, or behavioral analysis. We do not participate in ad networks, and we do not sell information to third parties.

8. Minors

The App is rated 4+ on the App Store. Because the App requires no registration and collects no personal data, it complies with COPPA (US), LGPD Infantil (Brazil), and GDPR-K (EU) by design.

9. User rights (GDPR, CCPA, LFPDPPP, LGPD)

Even though we collect no personal data on any server, the following rights are guaranteed by design:

Right to access: All data (favorites, trip plan, cache, alert history) lives on your device and is directly accessible from the App.
Right to rectification: You can edit or delete any saved item, favorite, or trip plan at any time.
Right to erasure: You can clear the photo cache from Profile → "Clear photo cache." Uninstalling the App deletes all locally stored data permanently.
Right to portability: Not applicable — no personal data exists on external servers.
Right not to be subject to automated decisions: The App uses your location only to calculate distances and manage geofences. No decision affecting legal rights, employment, credit, or insurance is made based on this data.

For any questions about your rights, please email christian@irack.mx.

10. Security

Local data is stored inside the iOS sandbox, protected by the operating system and by device-level disk encryption (Apple's Data Protection API). Cached files in cachesDirectory may be purged by iOS under storage pressure; the App handles this gracefully by re-downloading on next launch.

11. International transfers

We do not perform international transfers of personal data because we do not store personal data on any server. No personally identifiable information leaves your device.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the App or to applicable law. The current version will always be published at this URL, along with the date of the last update. Material changes will also be announced inside the App.

13. Governing law

This Policy is governed by the laws of the United Mexican States, in particular the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Any dispute will be submitted to the competent courts of Mexico City.

14. Contact

Privacy Officer: Chris Flores
Email: christian@irack.mx
Postal address: Av. Javier Barros Sierra 495, Santa Fe Lomas de Santa Fe Zedec Santa Fé, Álvaro Obregón 01219, Mexico City, CDMX, Mexico