Privacy Policy

1. Who we are

This Privacy Policy describes how Huasca (“we”, “us”) processes personal data when you use the Huasca mobile application and this website (huasca.app and related subdomains).

Controller: Maxime Dal Gobbo, sole trader (entrepreneur individuel) trading as Huasca, 6b rue Paul Langevin, 33170 Gradignan, France. SIREN 803597491. Not subject to VAT. Contact for privacy: hello@huasca.app.

The same address is used for privacy requests. A dedicated DPO will be indicated here if one is appointed.

2. Scope

Huasca is a local-first travel companion for budgets (Flux), map timeline (Trace), Memories (Moments), Backpack, traveler profile / Museum, optional AI helpers, and guest share links.

Data may be processed on your device and, only when you enable cloud features or use online services you trigger, on servers operated by our processors.

This Policy covers the mobile apps (iOS/Android) and this marketing / support / shared-trip website.

3. Data we process

Depending on how you use Huasca, we may process:

• Account data: Firebase user ID; email and profile identifiers if you link Google, Apple, Facebook or email sign-in; anonymous sessions are possible.
• Trip & finance data: trips, expenses, budgets, participants, withdrawals, splits, preferences.
• Media: receipt photos, moment photos/videos, gear images: stored locally; uploaded to Firebase Storage only if cloud sync / media sync applies.
• Location: on-demand coordinates for memories/expenses; optional passive GPS points for trip tracing; map tiles via Mapbox.
• AI inputs/outputs: images or short text you submit to Google Gemini when you use receipt OCR, gear recognition or profile insights. Processing is triggered by you; outputs may be stored with the related expense, gear item or profile on device (and in cloud only if sync is on).
• Purchases: store transaction identifiers and entitlements via Apple/Google and RevenueCat: we do not store card numbers.
• Sharing: public or guest timeline tokens and associated trip metadata when you create a share link.
• Support messages: name, email, topic and message content you send via the website support form.
• Diagnostics: Firebase Analytics events (production), Crashlytics and Performance traces on release builds where enabled.
• Technical preferences: theme, language, cloud backup on/off, stored locally.
• Website connection data: IP address, user-agent, timestamps and similar technical logs processed by the host as necessary to serve pages and ensure security: not used for advertising.

4. Purposes and legal bases (GDPR)

We process data for:

• Providing the app features you request: contract / steps prior to contract.
• Cloud backup and multi-device sync: consent (explicit opt-in; default OFF).
• Optional passive location tracking: consent / device permission.
• AI features you trigger (OCR, gear, insights): contract / steps prior to contract; the underlying model is operated by Google as processor.
• Guest / public share links you create: contract / legitimate interest in operating sharing you requested.
• In-app purchases and entitlement checks: contract.
• Website support form: contract / steps prior to contract and legitimate interest in answering your request.
• Security, crash diagnostics and product analytics: legitimate interests and/or consent where required for non-essential SDKs under ePrivacy/CNIL rules.
• Website audience measurement (Google Analytics): consent via the cookie banner.
• Responding to support and deletion requests: contract / legal obligation.
• Complying with legal obligations: legal obligation.

5. Local storage vs cloud

By default, financial data, receipt photos and GPS positions are stored on your device.

They are transmitted to our Firebase backends only if you explicitly enable cloud synchronization / backup. Offline use remains available.

Authentication, AI cloud calls, map tile requests, exchange-rate lookups, weather helpers and diagnostics may still contact third-party services independently of cloud backup when you use those features.

6. Artificial intelligence

When you scan a receipt, identify gear or request profile insights, the relevant image or text is sent to Google Gemini / Generative AI to produce a suggestion.

You should verify amounts and labels before relying on them. AI outputs are not financial, legal, medical or insurance advice.

Quota limits (Voyageur / Explorer) may apply. We do not sell your prompts or trip contents for advertising.

AI calls are intended to go through our backend where available; client-side keys are being phased out in favour of a server proxy to reduce exposure risk.

7. Processors and recipients

We use processors to operate Huasca, including:

• Google Firebase / Google Cloud (Auth, Firestore, Storage, Cloud Functions, Remote Config, Analytics, Crashlytics, Performance, App Hosting).
• Mapbox (maps / SDK).
• Google Gemini / Generative AI (OCR, gear, insights).
• RevenueCat (subscription entitlements).
• Apple App Store and Google Play (payments).
• Optional social login providers: Google, Apple, Facebook.
• Email delivery for the website support form (e.g. Resend), when configured.
• OpenStreetMap Nominatim / other public APIs for reverse geocoding; Frankfurter and exchange-rate APIs for currencies; weather providers via Cloud Functions where configured.
• Google Analytics on this website, only after cookie consent.

8. International transfers

Some processors are located outside the European Economic Area (notably the United States). Where transfers occur, we rely on adequacy decisions and/or Standard Contractual Clauses and processor terms (including Google / Firebase documentation). Details are available on request at hello@huasca.app.

9. Retention

Local data: until you delete it in-app, clear app data, or uninstall.

Cloud data: while your account exists and sync remains relevant; account deletion purges user cloud data via our deleteAccount Cloud Function (Firestore, Storage, Auth; RevenueCat best-effort).

Share links: until you revoke them or the related trip / account is deleted.

Support emails: retained as long as needed to handle your request, then for a limited archive period unless a longer period is required for legal claims.

Backups, logs and crash reports: retained for a limited operational period (typically up to 90 days unless a longer period is required for security or legal claims).

Purchase records may be retained as required by tax / consumer law.

10. Your rights

Under GDPR you may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent where processing is based on consent.

How to exercise rights: email hello@huasca.app from the address linked to your account, use the website support form, use Settings → delete account in the app, or the Account Deletion page on this site.

We will respond within the legal time limits (generally one month). You may lodge a complaint with the CNIL (France) or your local supervisory authority.

11. Security

We apply organizational and technical measures appropriate to the risk (authentication, access rules, transport encryption). No method of transmission or storage is perfectly secure.

If we become aware of a personal-data breach likely to result in a high risk, we will notify the competent authority and, where required, affected users.

12. Cookies and similar technologies (website)

This marketing website uses essential cookies or similar storage required for the service to work (for example language, theme preference, and remembering your cookie choice).

With your prior consent, we also use Google Analytics (Google Ireland / Google LLC) to measure audience and improve the site. Analytics cookies are not set until you accept them in the cookie banner. You can change your choice at any time via “Manage cookies” in the footer.

When analytics is enabled, data such as pages viewed, approximate location derived from IP (with IP anonymization where available), device/browser type and referral source may be processed. Google may process data outside the EU under its terms and appropriate transfer safeguards.

The mobile app may use the SDKs listed above. Non-essential analytics / diagnostics SDKs are subject to applicable consent and platform permission rules.

13. Changes

We may update this Policy. The “Last updated” date will change and, for material updates, we will provide additional notice when appropriate (in-app or on this site).