Privacy Policy
Last Updated: June 2026 Effective Date: June 2026
Camena ("we," "our," or "us") operates the Camena mobile application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
*Operator: Camena. *Contact: privacy@camena.tours
1. Information We Collect
1.1 Information You Provide
| Data | Required | Purpose | Storage |
|---|---|---|---|
| Email address | Yes | Account creation, authentication, communications | Until account deletion |
| Name | No | Personalization of your experience | Until account deletion |
| Tour reviews | No | Public reviews visible to other users | Until deletion or account removal |
| Review reports | No | Content moderation | Until resolved |
1.2 Information Collected Automatically
GPS Location Data
- Precise GPS coordinates are collected on your device during active tours to trigger audio narration at waypoints.
- Background location access is used so tours continue playing when your phone is locked or the app is in the background.
- Location data is processed entirely on your device and is not stored on our servers.
- We infer travel mode (walking, cycling, driving) from your speed during an active tour. This is calculated on-device and not stored.
Tour Progress
- Which tours you start and complete, and which waypoints you reach within each tour.
- Used to resume tours and track your progress.
Purchase Records
- Records of tours you have purchased, including amount, currency, and platform (Apple/Google).
- No credit card or payment card data is collected or stored by us. Payments are processed entirely by Apple App Store or Google Play Store.
Device Information
- Push notification token (for delivering notifications you opt into).
- Device platform (iOS/Android) for compatibility.
- Crash and performance data sent to Sentry for app stability improvement. This includes error traces and device environment information. We only send your user ID — no personal data is included.
Usage Analytics (Consent-Gated)
- When you opt in to analytics, we collect: tour browsing and viewing activity, tour download/start/completion events, waypoint reached/skipped/replayed events, purchase start/complete/failed events, and session start/end events.
- Analytics are disabled by default and only collected with your explicit consent.
- Analytics events are automatically deleted after 24 months (via scheduled database cleanup, excluding anonymized aggregate data retained for product improvement).
1.3 Information We Do NOT Collect
- Credit card numbers or payment card details (handled by Apple/Google)
- Precise GPS coordinates stored server-side
- Biometric data
- Health information
- Data from children under the applicable age of majority in their province/state
- Cross-app or cross-website tracking data
2. How We Use Your Information
We use collected information to:
- Provide the Service: Authenticate your account, deliver tour content, track playback progress, and process purchases
- Core functionality: Calculate waypoint triggers using on-device GPS, manage offline audio downloads, and enable background audio playback
- Communications: Send push notifications you have opted into (proximity alerts, new tour announcements, reminders)
- Support: Respond to your support requests and feedback
- Analytics: Understand how the Service is used to improve content and features (only with your consent)
- Safety: Prevent fraud, abuse, and unauthorized access
- Legal compliance: Comply with applicable laws and regulations
3. Legal Basis for Processing
3.1 PIPEDA (Canada)
Under PIPEDA and the British Columbia Personal Information Protection Act (PIPA BC), we collect, use, and disclose information in accordance with the following principles:
| Purpose | Basis |
|---|---|
| Account creation and authentication | Your consent at signup |
| Providing the Service (tour delivery, progress) | Necessary for the service you requested |
| Processing purchases | Necessary for the transaction |
| Push notifications | Your opt-in consent (granular controls available) |
| Analytics | Your explicit opt-in consent |
| Crash reporting (Sentry) | Legitimate interest in service stability |
| Legal obligations | Required by law |
3.2 GDPR (European Union)
For users in the European Economic Area:
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Tour delivery and progress tracking | Contract performance (Art. 6(1)(b)) |
| Processing purchases | Contract performance (Art. 6(1)(b)) |
| Push notifications | Consent (Art. 6(1)(a)) |
| Analytics | Consent (Art. 6(1)(a)) |
| Crash reporting | Legitimate interest (Art. 6(1)(f)) |
3.3 CCPA/CPRA (California)
For California residents, we collect personal information for the business purposes disclosed in this policy. We do not sell personal information.
4. Information Sharing
4.1 We Do Not Sell Your Data
Camena does not sell, rent, or share your personal information with third parties for their marketing purposes.
4.2 Third-Party Service Providers
We share information with the following service providers who assist in operating the Service:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Supabase | Authentication, database, file storage, serverless functions | Email, name, purchase records, tour progress, device tokens, notification preferences, analytics events, audio settings, reviews | https://supabase.com/privacy |
| Sentry | Error tracking and crash reporting | Error traces, device info, user ID (no personal data) | https://sentry.io/privacy/ |
| Anthropic (Claude) | AI narration text generation (all text: narration, waypoint suggestions, translation, QA) | Waypoint names, descriptions, and city/country context only. No personal user data is sent. | https://www.anthropic.com/legal/privacy |
| ElevenLabs | Text-to-speech audio generation (primary voices) | Narration text only. No personal user data is sent. | https://elevenlabs.io/privacy-policy |
| Google Cloud | Text-to-speech audio generation (secondary; pronunciation control) | Narration text only. No personal user data is sent. | https://policies.google.com/privacy |
| Apple / Google Play | In-app purchase processing and receipt validation | Receipt data, transaction IDs, product IDs | Apple: https://www.apple.com/legal/privacy/ · Google: https://policies.google.com/privacy |
| Expo Push Notification Service | Delivering push notifications | Push notification tokens, notification content | https://expo.dev/privacy |
4.3 Legal Requirements
We may disclose information when required by law, court order, or governmental regulation, or to protect our rights, safety, or property, or that of our users.
4.4 Business Transfers
In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email or in-app notice of any change in ownership.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Until you request deletion |
| Tour progress | Until you request deletion |
| Purchase records | Until you request deletion (required for purchase verification) |
| Reviews | Until you delete them or delete your account |
| Analytics events | 24 months (automatically deleted via scheduled cleanup) |
| Push notification tokens | Until you delete your account |
| Crash reports (Sentry) | Per Sentry's retention policy (90 days default) |
| GPS location data | Not stored server-side — processed on-device only |
6. Data Storage and Security
6.1 Data Storage Location
Your data is stored securely by Supabase on infrastructure hosted in the United States. Audio files for offline use are stored locally on your device.
6.2 Security Measures
We implement appropriate technical and organizational measures to protect your information:
- Encryption in transit: All data transmitted between the app and our servers uses TLS/HTTPS
- Encryption at rest: Database and storage are encrypted by Supabase
- Access controls: Row Level Security (RLS) policies restrict data access to authorized users only
- Authentication: Secure session management via Supabase Auth
- Minimal collection: We collect only the data necessary to provide the Service
- On-device processing: GPS location data never leaves your device
7. Your Rights
7.1 Your Rights (All Users)
You have the right to:
- Access: Request a copy of your personal data
- Deletion: Request permanent deletion of your account and all associated data
- Export: Download your data in a portable format
- Rectification: Correct inaccurate data (name, email via in-app settings)
To exercise these rights, use the in-app account settings or contact privacy@camena.tours.
7.2 Canadian Rights (PIPEDA / PIPA BC)
Under PIPEDA and PIPA BC, you additionally have the right to:
- Withdraw consent: Withdraw consent for data processing where consent is the legal basis (analytics, notifications)
- Complain: File a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/) or the Office of the Information and Privacy Commissioner for British Columbia (https://www.oipc.bc.ca/)
7.3 EU/EEA Rights (GDPR)
Under GDPR, you additionally have the right to:
- Portability: Receive your data in a structured, machine-readable format
- Object: Object to processing based on legitimate interest
- Restriction: Request restriction of processing in certain circumstances
- Withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal
7.4 California Rights (CCPA/CPRA)
California residents have the right to:
- Know: Request disclosure of what personal data is collected and how it is used
- Delete: Request deletion of personal information
- Opt-out of sale: Camena does not sell personal information
- Non-discrimination: Exercise your rights without discriminatory treatment
7.5 Account Deletion
You can delete your account and all associated data at any time through in-app account settings. Upon deletion:
- Your profile, tour progress, purchase records, reviews, device tokens, notification preferences, audio settings, and analytics events (anonymized events may be retained in aggregate for product improvement) are permanently deleted
- Your authentication account is removed
- Deletion is irreversible
8. International Data Transfers
Your data is stored in the United States via Supabase. If you are accessing the Service from Canada, the EU, or other jurisdictions, your data will be transferred to and processed in the United States.
We ensure appropriate safeguards are in place:
- Supabase maintains SOC 2 Type II compliance
- Data transfers to the EU/EEA are governed by Standard Contractual Clauses where applicable
- For PIPEDA compliance, we ensure that the US-based service provider provides an equivalent level of data protection
9. Children's Privacy
The Service is not directed to or intended for children. We do not knowingly collect personal information from children under 13 (United States / COPPA), under 16 where that higher age applies (EU / GDPR), or under the age of majority in their province or state of residence (typically 18–19 in Canada).
If we become aware that we have collected personal information from a child below the applicable age without verified parental consent, we will take steps to delete it promptly. Contact privacy@camena.tours if you believe a child's data has been collected and we will act without undue delay.
10. Push Notifications
With your consent, we may send push notifications for:
- Proximity alerts: When you are near a tour starting point (location-based, optional)
- New tours: When new tours are available in cities you have visited
- Reminders: Incomplete tour reminders
- Celebrations: Tour completion milestones
You can manage notification preferences granularly in the app's Settings screen. You may opt out of any or all notification categories at any time.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Updating the "Last Updated" date at the top of this policy
- Displaying an in-app notice for significant changes
Continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact
For privacy inquiries:
- Email: privacy@camena.tours
For Canadian residents, you may also contact:
- Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/
- Office of the Information and Privacy Commissioner for BC: https://www.oipc.bc.ca/
For EU/EEA residents, you may also contact your local Data Protection Authority.
*This Privacy Policy is tailored for Camena, a GPS-triggered audio tour guide mobile application operated from British Columbia, Canada. *