Por enquanto, esta página está disponível apenas em inglês.

Privacy Policy

Last Updated: August 11, 2026 Effective Date: July 30, 2026

Camena ("we," "our," or "us") operates the Camena mobile application and the camena.tours website (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Operator: Finback Digital Inc., a British Columbia corporation. Registered office: 400 – 931 Fort St, Victoria, BC V8V 3K3, Canada.

Contact: privacy@camena.tours

1. Information We Collect

1.1 Information You Provide

Social sign-in. You can create your account with an email address and password, or by signing in with Apple or Google. When you use a social sign-in, we receive an identity token from the provider together with the name and email address you authorize it to share (with Sign in with Apple you may choose to hide your email, in which case we receive an Apple private relay address instead). We use this information only to create and authenticate your account — we never see your Apple or Google password. If you delete your account, we attempt to revoke the Sign in with Apple authorization where the required Apple authorization details are available (best-effort — your deletion completes even if revocation is unavailable or Apple's systems cannot be reached; you can also revoke it yourself in your Apple ID settings).

1.2 Information Collected Automatically

GPS Location Data

• Precise GPS coordinates are collected on your device during active tours to trigger audio narration at waypoints.
• Background location access is used so tours continue playing when your phone is locked or the app is in the background.
• Location data is processed entirely on your device and is not stored on our servers.
• We infer travel mode (walking, cycling, driving) from your speed during an active tour. This is calculated on-device and not stored.
• If you allow location access while browsing, we use a one-time location reading to show tours near you. This is optional, computed on your device, and not stored.

Tour Progress

• Which tours you start and complete, and which waypoints you reach within each tour.
• Used to resume tours and track your progress.

Purchase Records

• Records of tours you have purchased, including amount, currency, and platform (Apple/Google).
• No credit card or payment card data is collected or stored by us. Payments are processed entirely by Apple App Store or Google Play Store.

Device Information

• Push notification token (for delivering notifications you opt into).
• Device platform (iOS/Android) for compatibility.
• Crash and performance data sent to Sentry for app stability improvement. This includes error traces and device environment information. Crash reports are not linked to your name or email address.

Map Data

• Tour maps are displayed using your device's built-in map service — Apple Maps on iOS and Google Maps on Android. Rendering a map sends standard map requests (your device's IP address and the map area displayed) to Apple or Google under their own privacy policies, the same as any app that shows a map.
• Your GPS coordinates are never uploaded to a map provider, and waypoint triggering happens entirely on your device. However, because the tour map can follow you as you move, the sequence of map areas your device requests may approximate your location or route while the map is open — this is inherent to any live map.

Usage Analytics (Consent-Gated)

• When you opt in to analytics, we collect: tour browsing and viewing activity, tour download/start/completion events, waypoint reached/skipped/replayed events, purchase start/complete/failed events, and session start/end events.
• Analytics are disabled by default and only collected with your explicit consent.
• Sending private tour feedback is an operational service request, not analytics, and works whether analytics is enabled or disabled. If analytics is enabled, we may record that the feedback form was opened or submitted using tour/waypoint IDs and the selected category or requested language; those analytics events never include your optional feedback text, coordinates, or a device identifier.
• Analytics events linked to your account are permanently deleted when you delete your account. Event rows that are not linked to any Camena account, including events collected anonymously, are automatically deleted after 24 months via scheduled database cleanup; aggregate statistics may be retained for product improvement.

1.3 Information We Do NOT Collect

• Credit card numbers or payment card details (handled by Apple/Google)
• Precise GPS coordinates stored server-side
• Biometric data
• Health information
• Data from children under the applicable age of majority in their province/state
• Cross-app or cross-website tracking data

2. How We Use Your Information

We use collected information to:

• Provide the Service: Authenticate your account, deliver tour content, track playback progress, and process purchases
• Core functionality: Calculate waypoint triggers using on-device GPS, manage offline audio downloads, and enable background audio playback
• Communications: Send push notifications you have opted into (proximity alerts, new tour announcements, reminders)
• Marketing emails: Send new-tour announcements and tips by email if you opted in at signup or in Settings (you can withdraw at any time)
• Support and tour correction: Receive private tour feedback, identify recurring issues, and route reviewed corrections through our content-quality process
• Analytics: Understand how the Service is used to improve content and features (only with your consent)
• Safety: Prevent fraud, abuse, and unauthorized access
• Legal compliance: Comply with applicable laws and regulations

3. Legal Basis for Processing

3.1 PIPEDA (Canada)

Under PIPEDA and the British Columbia Personal Information Protection Act (PIPA BC), we collect, use, and disclose information in accordance with the following principles:

3.2 GDPR (European Union) — a voluntary commitment

Camena is made for travellers in Canada. Our tours are in Canadian cities, we do not advertise the app in Europe, and our translations target Canada and the Americas (Canadian French, Mexican Spanish, Brazilian Portuguese). We do not believe European privacy law applies to us, and we have not appointed a representative in the EU.

We follow the parts of it that make sense for us anyway. If you are in the EEA — whether you are planning a trip or already on one — this is how we treat your data, as a matter of our own policy rather than because we are required to:

3.3 CCPA/CPRA (California)

For California residents, we collect personal information for the business purposes disclosed in this policy. We do not sell or share personal information. Camena may not currently meet the CCPA/CPRA's applicability thresholds; we honor the rights in Section 7.4 voluntarily regardless.

4. Information Sharing

4.1 We Do Not Sell Your Data

Camena does not sell, rent, or share your personal information with third parties for their marketing purposes.

4.2 Third-Party Service Providers

We share information with the following service providers who assist in operating the Service:

4.3 Legal Requirements

We may disclose information when required by law, court order, or governmental regulation, or to protect our rights, safety, or property, or that of our users.

4.4 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email or in-app notice of any change in ownership.

5. Data Retention

6. Data Storage and Security

6.1 Data Storage Location

Your data is stored securely by Supabase on infrastructure hosted in the United States. Audio files for offline use are stored locally on your device.

6.2 Security Measures

We implement appropriate technical and organizational measures to protect your information:

• Encryption in transit: All data transmitted between the app and our servers uses TLS/HTTPS
• Encryption at rest: Database and storage are encrypted by Supabase
• Access controls: Row Level Security (RLS) policies restrict data access to authorized users only
• Authentication: Secure session management via Supabase Auth
• Minimal collection: We collect only the data necessary to provide the Service
• On-device processing: Your GPS position is processed on your device and is never sent to our servers. Map providers receive only map-area requests, which may approximate your route while the map follows you (see Section 1.2)

7. Your Rights

7.1 Your Rights (All Users)

You have the right to:

• Access: Request a copy of your personal data
• Deletion: Request permanent deletion of your account and account-linked data
• Export: Download your data in a portable format
• Rectification: Correct inaccurate data (name, email via in-app settings)

To exercise these rights, use the in-app account settings or contact privacy@camena.tours.

7.2 Canadian Rights (PIPEDA / PIPA BC)

Under PIPEDA and PIPA BC, you additionally have the right to:

• Withdraw consent: Withdraw consent for data processing where consent is the legal basis (analytics, notifications)
• Complain: File a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/) or the Office of the Information and Privacy Commissioner for British Columbia (https://www.oipc.bc.ca/)

7.3 EU/EEA Rights (GDPR) — a voluntary commitment

As we explain in Section 3.2, Camena is made for travellers in Canada and we do not believe European privacy law applies to us. We will honour these rights anyway if you are in the EEA:

• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interest
• Restriction: Request restriction of processing in certain circumstances
• Withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal

Email privacy@camena.tours and we will reply within 30 days. Because we do not offer Camena to people in Europe, we have not appointed a representative there — write to us directly and we will handle it ourselves.

7.4 California Rights (CCPA/CPRA)

We may not currently meet the CCPA/CPRA's applicability thresholds; we extend these rights to California residents voluntarily regardless:

• Know: Request disclosure of what personal data is collected and how it is used
• Correct: Request correction of inaccurate personal information
• Delete: Request deletion of personal information
• Limit use of sensitive personal information: We do not use or disclose sensitive personal information (such as precise geolocation) for purposes that would require a right to limit — your precise location never leaves your device
• Opt-out of sale or sharing: Camena does not sell or share personal information
• Non-discrimination: Exercise your rights without discriminatory treatment

Residents of other U.S. states with comprehensive privacy laws (Virginia, Colorado, Connecticut, and others) may exercise similar rights — access, correction, deletion — by contacting privacy@camena.tours.

7.5 Account Deletion

You can delete your account and account-linked data at any time through Profile → Account → Delete Account. Upon deletion:

• Your profile, tour progress, Camena purchase records, private tour feedback, device tokens, notification and marketing email preferences, audio and language settings, and legal-policy acceptance records are permanently deleted
• Analytics events linked to your account are permanently deleted; event rows not linked to any Camena account remain subject to the 24-month retention job, and aggregate statistics may be retained for product improvement
• Your authentication account is removed
• Deletion is irreversible

8. International Data Transfers

Your data is stored in the United States via Supabase. If you are accessing the Service from Canada, the EU, or other jurisdictions, your data will be transferred to and processed in the United States.

Camena is a Canadian service and our tours are in Canadian cities, so most of our users are in Canada or the United States when they use the app. The safeguards below apply wherever you are:

• Supabase maintains SOC 2 Type II compliance
• If you use Camena while you are in Europe, your data leaves Europe to reach our servers in the United States. Our agreements with the providers listed in Section 4.2 include the European Commission's Standard Contractual Clauses where required for that transfer
• For PIPEDA compliance, we ensure that the US-based service provider provides an equivalent level of data protection

9. Children's Privacy

The Service is not directed to or intended for children. We do not knowingly collect personal information from children under 13 (United States / COPPA), under 16 where that higher age applies (EU / GDPR), or under the age of majority in their province or state of residence (typically 18–19 in Canada).

If we become aware that we have collected personal information from a child below the applicable age without verified parental consent, we will take steps to delete it promptly. Contact privacy@camena.tours if you believe a child's data has been collected and we will act without undue delay.

10. Push Notifications

With your consent, we may send push notifications for:

• Proximity alerts: When you are near a tour starting point (location-based, optional)
• New tours: When new tours are available in cities you have visited
• Reminders: Incomplete tour reminders
• Celebrations: Tour completion milestones

You can manage notification preferences granularly in the app's Settings screen. You may opt out of any or all notification categories at any time.

11. Website & Launch Waitlist

Our website (camena.tours) offers a launch waitlist. If you join it, we collect your email address for one purpose: sending you a single announcement when Camena launches (plus, at most, service messages about the waitlist itself). We record the time of your consent, which lets us demonstrate it — as Canada's Anti-Spam Legislation (CASL) requires of anyone who claims to have consent. We do not use the address for any other marketing, do not share it with anyone, and delete it after the launch announcement is sent — or earlier on request. Email privacy@camena.tours at any time to be removed.

The website itself is a static page: it sets no cookies and includes no advertising or analytics trackers. It is hosted on Vercel, which processes standard web-server request logs (such as IP address and browser type) to serve the site.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date at the top of this policy
• Displaying an in-app notice for significant changes

Where required, material changes take effect after you accept the updated policy in the app.

13. Contact

Finback Digital Inc. has designated a Privacy Officer responsible for compliance with PIPEDA and PIPA BC.

For privacy inquiries:

• Privacy Officer, Finback Digital Inc. — privacy@camena.tours

For Canadian residents, you may also contact:

• Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/
• Office of the Information and Privacy Commissioner for BC: https://www.oipc.bc.ca/

For EU/EEA residents, you may also contact your local Data Protection Authority.

This Privacy Policy is provided by Finback Digital Inc., a British Columbia corporation and the operator of Camena, a GPS-triggered audio tour guide mobile application.