Altalaya
Get the app
← Back

Altalaya Privacy Policy

Last updated: 14 October 2026

Altalaya is a community map of viewpoints (miradors). This policy explains what data we collect, why we collect it, and how you can control it.

Our principle: we do not sell your data. We do not invent fake statistics. We only use your information to run the app and keep the community safe.

1. Who this applies to

This policy covers:

  • The Altalaya mobile app (iOS and Android) and the related backend services we operate
  • This public website (legal pages, APK download links, and related web pages we operate for Altalaya)

If you do not agree with this policy, please do not use the app or the website.

2. Data we collect

Account information

When you create an account (email or Google sign-in), we may store:

  • Email address
  • Display name and username
  • Profile photo (if you add one)
  • Bio (if you add one)
  • Authentication identifiers provided by our auth provider (Supabase / Google)
  • Early Founder status (is_founder) if you voluntarily support the project via our payment link

Content you create (UGC)

When you add a spot, photo, or text, we store:

  • Spot title, description, and tags
  • Photos you upload (selected from your device photo library)
  • Location of the spot you choose to publish (coordinates and place info you provide)
  • Timestamps and authorship so others can see who shared what

Before upload, photos may be resized and compressed on your device (client-side) to reduce size and bandwidth. We do not use your photo library for anything other than the media you explicitly choose to upload.

You can delete your own content at any time from the app. Deleting content removes it from public view; backups may keep residual copies for a short period for security and recovery.

Saved spots

If you save (bookmark) a mirador, we store that association on your account so your “Guardados” list syncs across sessions. Saved lists are private to your account unless you later publish related content.

Location of your device

We request location only while you use the app (foreground / “when in use”).

We use it strictly to:

  • Center the map on your current area
  • Calculate sun azimuth / golden-hour helpers for the map

We may cache the last known location on the device (secure local storage) so the map can reopen faster. This cache stays on your device and is not sold or used for advertising.

We do not:

  • Track your location in the background
  • Continuously log your movements to our servers
  • Sell or share your live position with advertisers

You can refuse or revoke location permission in your device settings. The app will still work, but map centering and sun helpers may be limited.

On-device preferences and session

Stored locally on your device (e.g. Expo SecureStore), not sold:

  • Auth session tokens needed to keep you signed in
  • Map type preference (standard / satellite / terrain)
  • Last known location cache (see above)

Technical and usage data

To keep the service reliable and secure, we may process:

  • Device type, OS version, and app version
  • Crash / error logs
  • Basic network connectivity status (e.g. offline banner)
  • Session tokens needed to keep you signed in

Product analytics in the app (PostHog)

To understand how the app is used and improve reliability, we use PostHog (typically PostHog Cloud in the EU region) as a processor for product analytics. When you are signed in, we may send PostHog:

  • Your user id
  • Email address
  • Display name
  • Profile photo URL (avatar_url), if you have one
  • Account-related metadata such as account creation time (created_at), when available
  • Product / usage events (for example screens opened, feature usage, and similar in-app actions we configure)

Purpose: analytics and product reliability (fix bugs, see which features work, improve the experience). We do not use PostHog in the app for personalized advertising or to sell your data.

Sharing: PostHog processes this data on our behalf as a service provider / processor. Data is transmitted over encrypted connections (HTTPS). Retention follows the retention setting configured in our PostHog project.

Your choices: If the app offers an analytics opt-out in Settings, turning it off stops further analytics events to PostHog (it does not undo processing that already occurred). You can also request deletion or other rights via privacy@altalaya.app (see Contact). Account deletion removes your Altalaya account data as described below; we also take reasonable steps so that associated PostHog person data is no longer retained for analytics, or you may ask us to do so by email.

Website analytics (cookie banner / consent) is separate and described under “This website — cookies and analytics” below.

Feedback you send

If you use “Enviar comentarios” in Settings, your device opens your email client. Whatever you write and send is processed as ordinary email correspondence. We do not silently scrape your mailbox.

Reports and blocks (UGC safety)

When you report a spot or block another user in the app, we store the minimum data needed to apply your preference and to moderate the community:

  • Spot reports: reporter_id, spot_id, reason (optional free text), and a timestamp
  • User blocks: blocker_id, blocked_id, and a timestamp

Access is protected with row-level security (RLS) on Supabase so that:

  • You can create and manage your own reports and blocks
  • Other users cannot read your private block list or your report submissions as a social graph
  • Operators / moderation tooling may review reports as needed to keep the community safe

How we use this data:

  • Blocks: hide that user’s spots from your map view (and related surfaces that respect your block list)
  • Reports: queue for moderation review; a report does not by itself delete content for everyone

Maps

Map tiles and related map services are provided by Google Maps (via react-native-maps). When the map loads, Google may receive technical data according to Google’s privacy policy. We do not control Google’s independent processing.

This website — cookies and analytics

This website is separate from the mobile app. On the website we may use:

  • Strictly necessary storage — for example remembering your analytics cookie choice in your browser (localStorage). This is required to respect your decision and does not track you across sites.
  • PostHog — only if you accept via the cookie banner. If you reject (or before you choose), we do not initialize PostHog and we do not send analytics events.

When analytics is accepted, PostHog may process data such as:

  • Pages viewed and approximate navigation paths on this site
  • Events we configure (for example opening the APK download menu, clicking the Drive or VirusTotal links, navigating to Privacy/Terms, or contacting us)
  • Approximate location derived from IP (country / region level), device / browser technical info, and referral source
  • Online identifiers (including cookie or similar client identifiers used by PostHog)

Purpose: understand how visitors use this website (traffic, engagement, which links are useful) so we can improve it. We do not use PostHog on this site for personalized advertising.

Legal basis (EU/EEA/UK where applicable): consent. You can withdraw consent at any time via Cookie settings in the website footer (or by clearing site data in your browser). Withdrawal does not affect the lawfulness of processing before withdrawal.

Retention: PostHog retention follows the retention setting configured in our PostHog project. Our consent choice is stored locally in your browser until you change or clear it.

International transfers: We typically use PostHog Cloud in the EU region. Depending on configuration, PostHog may process analytics data as described in PostHog’s privacy policy. Where transfers outside the EU/EEA occur, they rely on appropriate safeguards offered by PostHog (for example Standard Contractual Clauses).

Your choices: Accept or Reject in the banner; change later via Cookie settings; also use browser controls / opt-out extensions. Blocking analytics will not break core access to Privacy, Terms, or download links.

Voluntary support (Early Founder)

Optional support payments are processed by Stripe on Stripe’s hosted checkout. Stripe handles payment card data under its own privacy policy. We may receive confirmation that a payment succeeded and store a founder badge flag on your profile. We do not store full card numbers in Altalaya.

3. How we use your data

We use your data to:

  • Authenticate you and maintain your account
  • Show the community map, your profile, and your saved spots
  • Host photos and spot information you publish
  • Calculate on-device / in-app solar helpers from location
  • Apply Early Founder status when you support the project
  • Moderate harmful or illegal content
  • Process spot reports and user blocks so you can hide content on your map and so we can review abuse
  • Fix bugs and improve reliability, including via product analytics (PostHog) as described above
  • Comply with law when required

We do not use your data for targeted advertising resale, and we do not sell personal data.

4. Where data is stored and who processes it

We use Supabase for authentication, database storage, photo hosting, and UGC-safety tables (including spot_reports and user_blocks) with RLS. Data is processed on Supabase infrastructure under their terms and security practices.

We may also rely on:

  • Google — Google sign-in and Google Maps (app)
  • PostHog — product analytics in the mobile app (user id, email, name, avatar URL, account metadata such as created_at, and usage events; EU Cloud where configured), and website analytics only with your cookie consent
  • Stripe — optional Early Founder support payments
  • Apple / Google — app distribution, crash reporting, and store services, as configured by those platforms
  • Website hosting — our web host (for example Vercel) may process technical connection logs (IP, user-agent, timestamps) as part of serving the site and securing infrastructure

These providers process data only as needed to provide their services to us.

OAuth sign-in may return to the app via deep links (e.g. custom URL schemes such as altalaya://). Those redirects carry auth tokens only as needed to complete login.

5. Sharing

We share personal data only when:

  • You publish content that is meant to be public (spots, photos, profile fields you choose to show)
  • A service provider needs it to run Altalaya (e.g. Supabase hosting, PostHog for product analytics, Stripe for voluntary payments)
  • The law requires it (valid legal request)
  • Needed to protect users, the public, or the integrity of the service (fraud, abuse, safety), including reviewing spot reports

We do not sell your personal information.

6. Retention and account deletion

  • Account data: kept while your account is active
  • Public spots / photos: kept until you delete them, or until we remove them for policy violations
  • Saved-spot associations: kept until you unsaved them or delete your account
  • User blocks: kept until you unblock or delete your account
  • Spot reports: kept as reasonably needed for moderation, security, and dispute handling
  • Auth sessions / tokens: kept until you sign out or they expire
  • Logs: kept only as long as reasonably needed for security and debugging
  • App analytics (PostHog): kept according to our PostHog project retention setting

In-app account deletion: from Settings you can permanently delete your account. That process removes your profile, your spots, associated photos in storage (best effort), your blocks, and signs you out. Spot reports you filed or that concern your content may be retained where required for legal, security, or dispute reasons. Residual backups may exist briefly for security and recovery. We also take reasonable steps regarding PostHog person / analytics data linked to your account; if anything remains, email privacy@altalaya.app.

Web account deletion: you can also delete your account at /delete-account on this site (sign in with the same Google or email account, then confirm). The same data removal rules apply.

You can also email us (see below) to request deletion or other data rights.

7. Your choices and rights

Depending on where you live (for example EU/EEA, UK, California), you may have rights to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Export data you provided
  • Object to or restrict certain processing
  • Withdraw consent (e.g. location or photo-library permission, website analytics cookies, or in-app analytics where an opt-out is offered)

In the app you can already:

  • Edit your profile (including avatar from the photo library)
  • Delete spots and photos you uploaded
  • Save / unsave spots
  • Report a spot or block a user from a mirador’s detail menu (⋯ → Reportar / Bloquear)
  • Sign out
  • Delete your account from Settings
  • Revoke location or media permissions in system settings
  • Where available, turn off product analytics in Settings (stops further PostHog events)

On this website you can:

  • Accept or reject PostHog analytics via the cookie banner
  • Change that choice anytime via Cookie settings in the footer
  • Delete your Altalaya account via Delete account in the footer
  • Read this Privacy Policy and the Terms of Use without accepting analytics

To exercise other rights, email us at the contact address below. We may need to verify your identity first.

8. Children

Altalaya is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will take appropriate action.

9. Security

We use industry-standard protections provided by our hosting and auth stack (encrypted transport, access controls, authenticated APIs, Supabase RLS on sensitive tables such as reports and blocks, secure on-device session storage where available). No method of transmission or storage is 100% secure. Please use a strong password and protect your device.

10. Nature and outdoor responsibility (data context)

Altalaya helps people discover real places in nature. Publishing a spot does not grant permission to enter private land, ignore local rules, or harm the environment. Location data you share about places should be accurate and respectful. See our Terms of Use for conduct rules at real-world sites.

11. Changes

We may update this policy. When we do, we will change the “Last updated” date and, when appropriate, notify you in the app or by other reasonable means. Continued use after an update means you accept the revised policy.

12. Contact

Questions about privacy or data requests:

Email: privacy@altalaya.app App: Altalaya In-app: Profile → Privacidad y Términos, Settings → Legal, and mirador detail → ⋯ → Reportar / Bloquear

Also see our Terms of Use.