Cenote Finder

Privacy notice

Last updated: October 5, 2026

This notice explains what personal data Cenote Finder (the mobile app and the www.cenotefinder.app website) collects, what we use it for, who we share it with and how you can exercise your rights. It follows Mexico’s Federal Law on Protection of Personal Data Held by Private Parties.

1. Who is responsible

Controller: Mindware

For any privacy matter use the contact form.

2. What we collect

We only collect what each feature needs. You can browse the map and look up cenotes as a guest without giving us any personal data.

  • Your account: name, email address, app language and password. The password is stored hashed: we never see it or keep it in plain text. If you sign in with Apple, the identifier Apple gives us and the name and email you choose to share (Apple may give us a private relay email).
  • Your sessions: your device name (for example, “Ana’s iPhone”) and the date it was last used, so you can sign out of your devices.
  • Push notifications: if you turn them on in the app, your device’s notification identifier (Expo token) and its platform (iOS or Android).
  • Your activity: the cenotes you save as favourites and the ones you mark as visited, with the date.
  • Booking requests: the cenote, arrival date and time, number of people, activities, the message you write, the channel you prefer for the reply (in-app, WhatsApp or email) and the request’s status and history (who confirmed or declined it, and when).
  • Your contributions: reviews (ratings, comment, visit date and photos), links, nearby places and requests to verify you own a cenote, with the contact detail you type.
  • Hosts and team: each cenote’s contact name, phone, WhatsApp and email, shown in the app; and the accounts of the team that runs the dashboard (name, email, role and two-step verification).
  • Contact form: if you write to us, your name, email, phone and cenote name (the last two are optional), the topic, your message, the language, the date and that you accepted this notice.
  • Technical data: IP address and server access logs, which we use for security and to limit repeated attempts (we do not store it with your messages).

Cenote names and locations come from OpenStreetMap and from what hosts and the community contribute; they are not personal data.

3. What we do NOT collect

  • Your phone number. If you choose WhatsApp, the message is sent from your own WhatsApp to the host’s number; WhatsApp is a separate service with its own notice.
  • Your location. With your permission the app uses it on your device to show distances and nearby cenotes; we do not send it to our servers.
  • Payment details. There are no payments in the app for now.
  • Your contacts or files. We only access the photos you choose to upload in a review.

Your one-day route is kept only on your device.

4. What we use your data for

  • Creating and protecting your account.
  • Handling booking requests between you and the cenote’s host.
  • Publishing your reviews and contributions, and moderating community content.
  • Sending you service notices by email and, if you turn them on, push notifications: email verification, password recovery, the host’s answer to your requests and a reminder before your visit. You can turn push notifications off at any time in your phone’s settings.
  • Replying to people who write to us through the contact form and, if you are a host, handling your request to add a cenote.
  • Preventing abuse and fraud, and answering your requests.

We do not use your data for advertising, we do not sell it, and we do not use third-party trackers or analytics in the app or on this site.

5. Who we share it with

  • The cenote’s host you request a visit from, and the team that runs the dashboard: they see your name, your email, the request details and your message, so they can reply to you; we email them those details when you send the request.
  • The public, when you publish a review (with your first name and your photos) or when moderation approves a link or place you added (with your first name).
  • Providers that help us operate: Amazon Web Services (sending email with Amazon SES), Apple (Sign in with Apple), Expo (push notification service; together with Apple and Google it delivers notices to your device and receives the device token and the notice text: cenote name, date and your booking code) and the server hosting provider. They only receive what their function needs.
  • Our team (dashboard administrators and operators), who see contact form messages to reply to you; we do not share them with hosts or third parties.
  • Authorities, when the law requires it.

The app’s maps are shown by Apple Maps (iOS) and Google Maps (Android) directly from your device, under their own privacy notices. The map on this website loads its tiles from OpenStreetMap (or from the map provider we use), which receives your IP address when you request them; we send it no other data about you. Some providers, such as Amazon, may process data outside Mexico.

6. How long we keep it

We keep your data while you have an account. If you delete it, we erase your account, favourites, visited cenotes, booking requests, reviews, photos, contributions, sessions and notification devices. Technical logs and backups may keep data temporarily until they are overwritten. Contact form messages are deleted 12 months after the request is closed. We cannot recover what was already sent outside our system, such as an email or a WhatsApp message.

7. Your rights

You can access your data, rectify it, cancel (delete) it or object to its use (ARCO rights), as well as limit its use or withdraw your consent.

To exercise them, use the contact form (topic “Privacy (ARCO rights)”) with your account’s email address and tell us what you want to do. We will verify it is you and reply by email within 20 business days at most.

8. How to delete your account

In the app: Passport → Settings → Delete account. It is erased immediately, along with the data described in “How long we keep it”.

Through the contact form: use the contact form (topic “Delete my account”) with your account’s email address. We will delete it within 20 business days at most and confirm by email.

9. Security

Connections use HTTPS, passwords are stored hashed and the app keeps your session in your device’s secure storage. In the dashboard each host only sees the cenotes they manage and the team uses two-step verification. No system is infallible; if we detect a breach that affects you, we will tell you.

10. Children

The app is not directed at children under 13 and we do not knowingly collect their data. If you believe a child gave us data, write to us and we will delete it.

11. Cookies and storage

This public site does not use cookies. The host dashboard uses a necessary session cookie to keep you signed in; we do not use advertising or analytics cookies. The app stores your session and preferences (such as your route) on your device.

12. Changes to this notice

If we change what data we collect or how we use it, we will publish the new version here with its date and, for important changes, let you know in the app or by email.

13. Contact

Privacy questions: contact form.