Legal

Privacy policy

Last updated: July 7, 2026

Zayapa ("the app", "we") is a Galápagos travel guide operated from Ecuador. This policy explains what personal data we collect when you use the Zayapa mobile app or this website, what we use it for, who it's shared with, and what rights you have. We apply Ecuador's Organic Law on Personal Data Protection (LOPDP) and, for users in the European Union, the General Data Protection Regulation (GDPR).

This English version is a courtesy translation. If anything differs, the Spanish version prevails.

01Data controller

Zayapa — Puerto Baquerizo Moreno, San Cristóbal, Galápagos, Ecuador.
Privacy contact: info@zayapa.com

02What data we collect

Account

Email address, name, username, country and city (optional), encrypted password.

When you create an account. You can also use the app as a guest without giving your email.

Sign in with Google

The email and name associated with your Google account.

Only if you choose "Continue with Google".

Content you create

Species sightings, places visited, trip itineraries, notes, reminders, checklists, flight details you log (airports, dates, times, airline), and your chosen avatar.

As you use the app.

Location

Approximate device location.

Only if you grant permission, to show you on the map and sort nearby places. We do not store a history of your location on our servers.

Technical data

Basic device identifiers and error logs.

To keep the app running and fix bugs.

We do not collect sensitive data and we do not sell personal data to third parties. The app shows no advertising.

03What we use your data for

  • Creating and maintaining your account, and syncing your progress across devices.
  • Saving your sightings, trips, and flight plans.
  • Generating itineraries and personalized suggestions (processing happens on your device and in our database; nothing is shared with third-party services for advertising purposes).
  • Sending you sign-in emails (verification codes) and, if you logged a flight, local notifications on your device — these never leave your phone.
  • Diagnosing errors and improving the app.

04Who it's shared with

We use providers that process data on our behalf:

  • Supabase (database and authentication) — stores your account and content.
  • Google — only if you sign in with Google.
  • Resend — delivery of sign-in emails.
  • OpenStreetMap / CARTO (maps) and OSRM (route calculation) — receive the coordinates of the visitor sites you look up, to draw maps and routes; they do not receive your identity.

We may disclose data if required by law or by order of a competent authority.

05How long we keep it

As long as your account exists. If you delete your account, all your data is removed immediately and permanently from our database (profile, sightings, places, trips, flights, and avatars). Technical backups rotate within a maximum of 30 days.

06How to delete your account

Inside the app: Profile → Settings → Delete account. Deletion is immediate and irreversible.

Without the app installed: write to info@zayapa.com from your account's email address with the subject "Delete my account". We process the request within a maximum of 15 days.

07Your rights

You can access, correct, update, port, or delete your data, and object to or restrict its processing (ARCO rights under the LOPDP; articles 15–22 of the GDPR if you are in the EU). Exercising them is free: write to info@zayapa.com. If you believe we did not handle your request properly, you can file a complaint with Ecuador's Superintendencia de Protección de Datos Personales or the authority in your country.

08Security

Data travels encrypted (TLS) and is stored with per-user access controls (each account can only read and write its own data). Passwords are stored hashed, never in plain text.

09Children

Zayapa is not directed at children under 13 and we do not knowingly collect data from minors. If you believe a minor created an account, write to us and we will delete it.

10Changes to this policy

If we make substantial changes to this policy, we will announce them in the app before they take effect. The current version will always be at zayapa.com/privacidad (Spanish) and zayapa.com/en/privacy (English).