Privacy notice

If you just browse

• A cookie called "vid" holds a random number that identifies your browser, not you. It lasts 90 days. Page scripts can't read it. The cookie page lists every cookie we use.
• With it we record which businesses and offers are viewed, which contact buttons are tapped (WhatsApp, call, directions, website) and which campaign link or QR code brought you. That is how businesses see whether the guide helps them.
• Our database doesn't store your IP address, your device details, or the full address of the page you came from: only the site's name, such as instagram.com. When you claim a code, it keeps for one day a scrambled key made from your connection and the date, which can't be turned back into your address; it only limits how many codes one connection can claim. Our hosting providers (below) keep ordinary request logs, which include IP addresses, for a short time, for security and troubleshooting.
• No advertising cookies and no third-party analytics.
• These records are deleted after 13 months.

If you claim an offer

• The claim stores the offer, a short code and your browser's random number, so the same browser can't claim twice. The business sees the code, never who you are.
• If you answer the quick question about whether you'd have gone without the offer, we keep the answer with the redemption.
• Claims that were never used are deleted after 13 months. Used ones are kept as the business's record of a visit, but after 13 months they are no longer linked to your browser.

If you create an account

• We store your email, your password (only as a scrambled hash we can't reverse), the places you follow, when you last read their updates, and which version of these terms you accepted.
• You can delete your account at any time from My account. That deletes all of it at once.

If you apply to list a business

• We store the business name and category, your name, your email or WhatsApp number, your message and which version of these terms you accepted, only to review the request and reply to you.
• If the request is declined, it is deleted 90 days after the decision. If it's approved, your contact details are kept while you manage the listing.
• Failed access-code attempts are kept for 30 days, to stop code guessing.

Who else handles this data

• The website runs on Vercel, and the database and sign-in on Supabase, in the United States (us-east-1). Both process the data only to run this service. Because this moves your data outside Costa Rica, we ask for your consent when you create an account or apply.
• Links to WhatsApp, Google Maps, Waze or a business's website take you to those services, under their own privacy rules.
• When a business owner uses the map to place their pin, the map images come from OpenStreetMap, which sees their IP address.
• The current weather on the home page comes from MET Norway (the Norwegian Meteorological Institute). Our server asks for the Quepos forecast; nothing about you is sent.
• We never sell or rent personal data.

Your rights

• Under Costa Rica's Law 8968 on the protection of personal data, you can ask to see, correct or delete your data, or object to its use.
• If you have an account, you can delete it yourself in My account. For anything else, contact the operator (details below). We answer within 5 working days.
• If you think we've mishandled your data, you can also complain to PRODHAB, Costa Rica's data protection agency.

Who runs this site

The operator's name, ID number and contact details will be added here before public launch.