Privacy Policy

Last updated: August 2026

Short version: we store the minimum needed to run a guidebook tool, we don't sell data, and your guests get a genuinely tracker-free page.

What we store about hosts

• Your email address (it's your login). Passwords are handled entirely by Google Firebase Authentication — we never see or store them.
• Your guide content: property names, sections, cards, photos, links.
• Subscription status from our payment provider (RevenueCat, with Stripe processing payments). We never see or store card numbers.
• Standard server logs (IP, request path, timestamp) kept briefly for security and debugging.

What guests see — and what we don't collect from them

• Guide pages contain no third-party trackers, no analytics scripts, and no ads.
• Guide pages set no cookies, with one strictly functional exception: if a guide has a passcode and a guest enters it, a cookie remembers that so they aren't asked on every visit. It identifies the guide, not the guest.
• We count guide views as a single anonymous daily number per guide ("this guide was viewed 12 times today") so hosts know guests use it. No guest profiles, no guest PII, ever.
• If a host adds a YouTube video to a card, nothing loads from YouTube until the guest taps play; playback then uses YouTube's reduced-tracking (youtube-nocookie) player and is governed by Google's privacy policy.

Analytics on our own site

On the marketing site and host dashboard (never on guide pages) we use Google Analytics 4 to understand the signup funnel — and only after you accept the consent banner. Decline and it simply never loads.

Who processes data for us

• Hetzner (servers, EU) — hosting and database.
• Google Firebase Authentication — sign-in (email/password, resets, verification).
• Cloudflare — photo storage (R2) and the signup captcha (Turnstile).
• Resend — transactional email (onboarding emails, receipts).
• RevenueCat + Stripe — subscriptions and payments.
• Google Analytics — consent-gated, marketing site and dashboard only.

Your rights

Email support@casanote.app to access, export, correct, or delete your data. Account deletion permanently removes your guides and photos within 30 days (backups age out within a further 30). If you're in the EU/UK, you also have the usual GDPR rights, including complaining to your local authority — though we'd love the chance to fix things first.

Changes

If this policy changes materially we'll email account holders before the change takes effect.