Privacy Policy

Last updated: April 29, 2026

Byahe Builder (“we”, “us”) is a free trip-planning tool for the Philippines. This page explains what personal information we collect when you use the site, why we collect it, and what your rights are.

We’re a small project — not a company, not VC-backed. The shorter this policy is, the more likely you’ll actually read it, so we’ve kept it as plain as we can.

What we collect

When you create an account:

A username (required) — this is what identifies you publicly when you publish a trip to the community gallery
Your email address (optional, but required if you want password recovery or to publish to the community)

When you build or save a trip:

The trip itself: destination, day-by-day schedule, activities, your custom activities and notes, costs you’ve entered, your “home base” location if you set one
Your trip title and description — only public if you choose to publish to the community gallery

When you share or publish a trip:

The shareable slug that appears in /s/<slug> URLs
The last time the share was viewed (used only to prune unused links over time)
For community-published trips: the public description, tags, and copy count. Personal notes you’ve added to activities are stripped before publishing — they never appear on /community/<id> or in copies made by other users.

When you report an issue with an activity:

The activity, your selected reason, and any text you write

Automatically, by our infrastructure providers:

Standard server logs (IP address, browser type, request paths, timestamps) recorded by Vercel (our hosting provider) and Supabase (our database and auth provider). We don’t read these unless we’re debugging an issue.
Vercel Web Analytics — aggregated, privacy-friendly pageview counts. No cookies, no cross-site tracking, no personal identifiers. We use this to see which pages are popular and whether the site is working. (Vercel Analytics privacy)

We do not collect: payment data, location from your device, contact lists, or anything outside the actions you take in the app.

We do not use ad networks or cross-site behavioral trackers.

Why we collect it

Username + email — to give you an account that can save trips across devices and recover access if you forget your password
Trip data — that’s the product; saving and revisiting your trip is the point
Issue reports — to fix mistakes in the activity catalog
Server logs — for security, debugging, and protection against abuse

Who processes your data

These are the third-party services that handle data on our behalf. Some of them store data on servers outside the Philippines.

Supabase — database, authentication, file storage. Stores all trip data, account info, and uploaded images. (Supabase privacy)
Resend — sends transactional emails (verification and password reset). (Resend privacy)
Vercel — hosts the website. (Vercel privacy)
OpenStreetMap / Nominatim — used when you search for a location in the custom-activity picker. The query string you type is sent to their server to return coordinates. (Nominatim usage policy)

We don’t share your data with anyone else. We don’t sell it.

Cookies and local storage

Supabase authentication cookies — required to keep you logged in. Essential; the site won’t work without them.
localStorage — used to remember your in-flight trip draft so it survives a page refresh, and to remember which destination you last picked. Stays on your device.

We don’t use third-party cookies.

How long we keep it

Account info and saved trips — as long as your account exists. If you delete your account, we delete your trips too.
Shared trip links — persistent while the underlying trip exists, or until you delete the trip.
Email verification and password reset tokens — 24 hours and 1 hour respectively, then they expire automatically.
Server logs — subject to our infrastructure providers’ retention policies (typically 30 days).

Your rights

Under the Philippine Data Privacy Act (RA 10173) and as a matter of good practice, you can:

Access the personal data we have about you
Correct anything that’s wrong (you can edit your profile and trips directly in the app)
Delete your account and associated data — email us and we’ll do this manually for now
Object to specific processing
File a complaint with the National Privacy Commission if you think we’re mishandling your data

To exercise any of these rights, email us at privacy@byahebuilder.com.

Children

The app isn’t designed for anyone under 13. If you’re a parent or guardian and you believe a child has created an account, email privacy@byahebuilder.com and we’ll delete it.

Changes to this policy

If we change this policy in a way that affects what we collect or how we use it, we’ll update the “last updated” date at the top and (for material changes) notify users with active accounts by email.

Contact

Questions, concerns, or data-rights requests:

Email: privacy@byahebuilder.com