Privacy Policy

We believe privacy is a fundamental right. We treat any data relating to an identified or identifiable person as personal data, regardless of where you live — both data that identifies you directly (such as your name) and data that could reasonably identify you (such as a device identifier). We act as the data controller (in Mexico, the "responsable") and strive to collect only what we need and keep it only as long as reasonable.

(a) Account data: email, username (profile slug), display name, date of birth, sex, country, and password (stored only hashed by our auth provider); (b) Profile data: bio, avatar and cover photos, preferences; (c) Content you create: hunts, harvested animals, equipment, statistics, notes, photos, and any GPS coordinates you choose to record; (d) Subscription data: plan tier and billing status (full card details handled by our payment provider, not us); (e) Technical data: device type, browser, approximate region from IP, and basic usage needed to operate and secure the Service.

We do not seek to collect sensitive personal data. Some information you choose to provide — such as precise geolocation of your hunts — may be considered sensitive under applicable law. We treat exact locations as private and process them only to provide the Service to you. Please do not upload special-category data you do not wish to share.

Purposes that do NOT require separate consent (necessary to provide the Service): creating and managing your account; storing your journal; generating statistics and maps; operating your privacy settings and follow relationships; processing your subscription; securing the Service and preventing abuse; and complying with legal obligations. Purposes that DO require consent (optional): non-essential product or marketing communications. You may withdraw consent anytime.

We do not sell your personal data — including any "sale" or "sharing" as defined under California and Nevada law — and we do not use your private content to train third-party AI models. We share data only with: service providers processing strictly on our behalf under confidentiality obligations, who may not use it for their own purposes and must delete or return it when done; other members, only as your privacy settings allow; and authorities or third parties where we have a legal basis (to comply with law, enforce terms, prevent fraud, or protect safety). In a merger, acquisition, or asset transfer, data may be transferred subject to this Policy. We do not use automated decision-making with significant effects about you without the possibility of human review.

We use Supabase (database, authentication, storage), Google Maps (geocoding and map rendering), our hosting provider, and a third-party payment provider for Pro subscriptions (card details handled entirely by that provider). These providers may process data in the United States or other countries.

We keep personal data only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You can delete your content or account anytime; on account deletion we remove or anonymize your personal data within a reasonable period, except limited data we must retain by law or for security, and short-term backups.

We use reasonable administrative, technical, and physical safeguards, including encryption in transit and at rest, private storage buckets, row-level access controls, and restricted administrative access. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

For users in Mexico (LFPDPPP): the ARCO rights — Access, Rectification, Cancellation, and Opposition — plus the right to withdraw consent and to limit use or disclosure. The supervising authority is the Secretaría Anticorrupción y Buen Gobierno (which assumed these functions after the INAI was dissolved in 2025). For users in California and other U.S. states: the right to know, access, correct, and delete your personal information, and to opt out of any sale or sharing (we do not sell your personal information). Exercising these rights will not result in discriminatory treatment.

To protect your data, we verify your identity before acting, which may require signing in. We aim to respond to substantive privacy requests promptly — in most cases within seven (7) days — though some may require more time or information, and we will tell you if so. We may be unable to fulfill a request where the law requires us to retain data, where it would compromise others' privacy or security, or where it is manifestly unfounded or excessive. You may also lodge a complaint with the competent supervisory authority.

We use only the cookies and local mechanisms necessary to keep you signed in, remember preferences, and operate and secure the Service. We do not use third-party advertising trackers.

The Service is for adults and is not directed to anyone under 18. We do not knowingly collect data from minors; if you believe a minor provided us data, contact us and we will delete it.

The entity responsible for your data may differ by region. Hunting Passport may initially be operated by an entity in Mexico and later by an affiliated U.S. entity, or both. Your data may be stored and processed in the United States or other countries whose laws may differ from your own; where required, we use appropriate safeguards for cross-border transfers. We maintain the same standard of protection regardless of where data is processed.

We may update this Policy; we will post a new date and, for material changes, give notice. For privacy questions or to exercise your rights: privacy@huntingpassport.com.