Privacy

What we collect

• Account info. Email address and a hashed password if you create an account. Stored in Supabase. We never see your plain-text password.
• Wish list. Trip dates, party size, celebration, special requests, and the restaurants, parks, and times you pick. Stored in Postgres alongside your account.
• Newsletter opt-in. If you check the box at signup, your email goes to Resend so we can send updates. Unsubscribing in any email removes you instantly.
• Usage analytics. We run our own analytics: which pages you view, which planning tools you use (wish list, itinerary, concierge chat, wedding tools), clicks on booking and packing links, and how you arrived (referring site and campaign tags). This lives in two places: Mixpanel and our own database. We use two first-party cookies for it, a device id that lasts a year and a session id that expires after 30 minutes of inactivity. We use this data to see which content actually helps planners and to measure how many trips we refer to the hotel. We do not record your screen or replay your sessions.
• Walking-directions GPS, only if you turn it on. Our on-property walking directions can use your phone's location while you follow a route. If you grant your browser's location permission, we save the GPS points recorded during that walk. Why: comparing where guests actually walk against the route we suggested shows us where our hand-traced path map is wrong or missing a shortcut, which makes directions better for everyone. How it is handled: traces are anonymous by design (no account, name, or device id is attached), timestamps are seconds relative to the start of your walk rather than clock time, points are only sampled inside the resort boundary while a route is active, and nothing is collected at all unless you grant the permission.
• Standard request data. Cookies for keeping you signed in (HttpOnly and Secure), and the request metadata every server logs (IP, user agent, timestamp).

What we don't collect

• Real names (unless you choose to put one in your wish list).
• Phone numbers.
• Payment info (we don't take payment).
• Your location outside the resort. GPS is only sampled during an active walking route inside Hotel Xcaret Mexico, never in the background, and never tied to who you are.
• Session recordings. Our analytics counts events; it does not film your screen.
• Your browsing on other sites. Our own analytics sees only what you do here.

Third parties that see your data

Supabase

Hosts our database and runs the auth system. Sees your email, hashed password, and wish list. Supabase's privacy policy.

Resend

Sends transactional and newsletter emails. Sees your email if you opt in. Resend's privacy policy.

Vercel

Hosts the site and provides basic, cookieless page-view counts (Vercel Web Analytics). Sees standard request logs. Vercel's privacy policy.

Mixpanel

Product analytics. Receives the usage events described above (pages viewed, tools used, link clicks) plus your email if you have an account. Session replay is turned off. Mixpanel's privacy policy.

Anthropic

Powers our concierge chat. Receives your chat messages when you use the chat widget. Anthropic's privacy policy.

Google AdSense (when ads are enabled)

Serves the display ads that fund the site. Google may use cookies to serve ads based on your prior visits to this site or other sites. You can opt out of personalized ads in your Google Ads Settings or via the Digital Advertising Alliance opt-out. Google's ad policies.

Awin (booking links)

Our booking links to Hotel Xcaret Mexico go through Awin, the hotel's affiliate network. Awin sets a cookie so that if you book, the hotel knows we sent you and we earn a commission. You never pay more. We pass Awin an anonymous click id (never your email or name) so we can count the bookings we refer. Awin's privacy policy.

Amazon Associates (packing list links)

Links on our packing list go to Amazon with our affiliate tag. Amazon sees standard referrer data; we earn a commission on qualifying purchases at no extra cost to you. Amazon's privacy notice.

Your rights

Email mesanotescontact@gmail.com from the address on your account and we'll:

• Show you what we have on you.
• Delete your account and everything tied to it, including wish-list data and analytics events linked to your account.
• Correct anything that's wrong.

We aim to respond within 7 days.

Changes to this policy

If we materially change what we collect or who we share it with, we'll update the date at the top and, when it matters, email registered users. The current version always lives at https://mesanotes.com/privacy.