Privacy.

1. What we collect

1.1 On the website (saunasto.com)

For every request to the website, the Cloudflare edge that serves your traffic, and a small Cloudflare Pages Function that we operate, record the following:

• IP address of the requesting client.
• User-Agent string.
• Requested URL path (and any query string).
• Cloudflare-derived metadata: country, autonomous-system number, edge data center, TLS version + cipher, and verified-bot category if applicable.
• Referrer header, if your browser provided one.
• Timestamp.

This data is written to a Cloudflare D1 database we operate. We use it for security forensics (catching scrapers and vulnerability scanners), citation verification (proving an AI agent fetched a specific manifest), and aggregate analytics. We retain it for 90 days, then a scheduled job deletes it.

We do not use cookies, browser fingerprints, or third-party trackers. We do not run Google Analytics, Facebook Pixel, or any advertising-network code.

1.1a The MCP endpoint (saunasto.com/mcp)

We operate a public Model Context Protocol endpoint that AI assistants can query. It requires no account and no authentication. For each tool call we log the tool name, the query arguments (for example a searched city or venue slug), the result count, and a timestamp. These logs contain no personal identifiers and are not linked to any individual; we use them to understand aggregate demand (which cities and topics people ask about). Standard edge request metadata (IP address, User-Agent) is handled the same way as website requests, described above. Assistant conversations themselves never reach us; we only see the tool calls an assistant chooses to make.

1.2 In the iOS app (Saunasto for iPhone)

The iOS app is offline-first. The full venue catalogue ships on device; basic browsing requires no server round-trip and no data leaves your phone.

Optional features that do connect to a server:

• Voting (when you sign in): Supabase stores your email + your venue picks. RLS policies ensure no one else can read them.
• Closure reports: when you flag a venue as closed, we receive its venue id and a SHA-256 hash of your device's identifierForVendor (stable per device, not personally identifying).
• Anonymous app analytics: aggregate event counts (e.g., "paywall viewed", "filter toggled") with no personal identifiers attached.
• Proximity alerts (Pro): location processing happens entirely on device. Your coordinates never leave your phone.

1.3 In the Android app (Saunasto for Android)

The Android app is offline-first. The full venue catalogue ships on the device, and browsing, search, filters and saved venues all work with no account and no server round-trip. We operate no server that the Android app talks to, so it sends nothing about you to us.

• Location: used on your device only, to list the saunas nearest you and to power proximity alerts. Alerts work by registering 400-metre geofences around nearby venues; the matching is done on your phone by Google Play services. Your coordinates are never sent to us.
• Map tiles: the map screen fetches its tiles from OpenStreetMap's public tile servers. As with any web request, those carry your IP address and the map area you are looking at to that provider. We do not run those servers and receive nothing back from them. Every other screen works fully offline.
• Purchases: handled entirely by Google Play Billing. We never see or store payment details; the app only reads whether a Pro entitlement exists on your device.
• No account, no analytics, no ads: the Android app has no sign-in, sends no analytics events, and contains no advertising, attribution or tracking SDKs.

2. What we don't collect

• No tracking pixels.
• No third-party advertising IDs.
• No selling, renting, or sharing data with marketers.
• No combining your data with profiles obtained from data brokers.

3. Your rights

You can request deletion of any data we hold about you by emailing [email protected]. Visit logs older than 90 days are deleted automatically; we will purge specific recent entries on request.

4. Contact

Questions: [email protected]. Press: [email protected].

5. Changes

We will keep this page in sync with what we actually do. The effective date at the top reflects the last material change.