Privacy Policy

1. Who is responsible for your data

Bitáco is developed and operated independently by its creator team (contact: contacto@fxckthead.com). Under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), this team is the data controller for your personal data.

2. What information we collect

Account

• If you create an account, your email address and password (securely handled by our authentication provider, Supabase — we never store your password in plain text), or your Google account if you choose to sign in with it.

Profile

• First and last name, country and city of origin, date of birth, sex, orientation, how many times you've visited Mexico City, and a profile photo (if you choose to upload one).

Your travel plan

• If you use the "My CDMX Plan" questionnaire, we save your answers: who you're traveling with, your preferred travel pace, whether you drink alcohol, whether you're interested in day trips outside the city, your food adventurousness, your energy for nightlife plans, your interest in culture, what you do on free afternoons, your interest in local sounds/slang, and your "warrior level." We use these only to build your personalized itinerary inside the app.
• Your trip's arrival and departure dates (or how long you plan to stay), if you choose to share them when the app asks — used to calculate how many days your plan covers and to avoid showing you seasonal content (like Day of the Dead) if your trip doesn't fall within those dates.

Your progress in the app

• Which achievements you've completed, the date you completed them, the rating you gave them, and any notes or photos you choose to add as evidence. Evidence photos are stored only on your device — we don't upload them to our servers yet.
• For some achievements, an optional free-text field where you type it yourself — the name of the place where you completed it (for example, a taco stand's name). This is not location data captured by your phone — it's a text field you fill in by hand.

Location

• If you grant permission, Bitáco uses your phone's approximate location only while the app is open (never in the background) to notify you when you're near an achievement you haven't completed yet. This check happens at most every couple of hours, not continuously in real time.
• Your coordinates are never stored or sent to our servers: the comparison against achievement locations happens entirely on your own phone, and your position is discarded immediately after use. Bitáco does not track your location or share it with anyone.
• You can deny or revoke this permission at any time from your device's system settings without the app breaking — you simply won't get those proximity alerts.

Notifications

• If you agree to receive communications, Bitáco schedules local notifications directly on your own phone (reminders for pending achievements, Mexico City trivia, and the proximity alerts described above). These notifications are generated and scheduled entirely on your device — we don't use a third-party push service or collect a notification token on our servers.

Preferences

• Whether you've agreed to receive communications from Bitáco (updates, new categories, the local notifications described above, etc.).

3. What we use your information for

• Purposes necessary for the app to work: showing you your progress, achievements, and travel passport; generating your personalized achievement plan from your questionnaire answers; notifying you when an achievement is nearby (if you granted location permission); letting you share your achievements and stamps if you choose to; and generating internal, aggregated statistics about which achievements are most popular or which zones of the city see the most completions, to improve the app.
• Secondary purpose (optional): sending you communications (updates, reminders, notifications), only if you gave your consent. You can withdraw this consent at any time from Settings without affecting the rest of the app.

4. Who we share your information with

We don't sell your personal information, and we don't share it with third parties for advertising purposes.

We use service providers (data processors) to run the app: Supabase (database and authentication, running on Amazon Web Services infrastructure) and, if you sign in with Google, Google as an authentication provider. These providers only process your information so Bitáco can function, under their own confidentiality and security agreements — they don't use it for their own purposes. Some of this infrastructure may be hosted outside Mexico; by using Bitáco and accepting this policy, you consent to that international transfer, which is necessary to operate the service.

If in the future we share statistics with local businesses (for example, "this achievement was completed 20 times near your location"), those numbers will always be aggregated and anonymous — they will never include your name, your email, or any data that identifies you individually.

5. Where your information is stored

Your information is stored locally on your device, and — if you have an account — also on Supabase's servers, our cloud database provider (which runs on Amazon Web Services infrastructure). Your GPS location is the one exception: it's never stored anywhere, on-device or in the cloud — it's used and discarded on the spot (see section 2).

6. Your data rights and how to delete your account

Under Mexican law (LFPDPPP), you have the right to Access, Rectify, Cancel, and Object (known as ARCO rights) to the processing of your personal data, and to withdraw your consent at any time.

You can delete your account and all of your information — both on your device and in the cloud — at any time, directly from the app, with no need to contact us: go to Settings → Delete my profile. This action is immediate and cannot be undone.

If you'd rather exercise these rights by email, request a copy of your data, correct information, or have any question, write to us at contacto@fxckthead.com. We'll respond within a reasonable time as required by applicable law.

7. Minors

Bitáco automatically hides alcohol-related achievements for profiles belonging to minors, based on the birth date entered. If you're a parent or guardian and believe a minor in your care shared personal information without your consent, contact us to have it removed.

8. Changes to this policy

If we update this policy, we'll change the date at the top of this page and, if the change is significant, notify you within the app. We recommend checking back from time to time.

9. Contact

Questions, comments, or requests about your information? Write to us at contacto@fxckthead.com.