Your Data

Privacy Policy

Last updated: 18 September 2026

HelloWorld Siargao Homestay ("we", "us") operates the website helloworldhomestay.com and the HelloWorld Siargao Homestay mobile app for iOS and Android. This policy explains what we collect, why, and the choices you have. Questions or requests: booking@helloworldhomestay.com.

What we collect, and why

• Booking requests — your name, email address, optional phone number, stay dates, number of guests, and any notes you add. Used to process and manage your booking and to contact you about it.
• Guest account (optional) — your name and email address, and your password stored only as a one-way bcrypt hash. We can never see or recover your password.
• Messages — the conversation threads you exchange with the host about a booking, so both sides can follow the conversation.
• Payments — when you pay for a confirmed booking we record the payment's amount, method, provider, status, and timestamps. Card and e-wallet details are entered on the payment provider's own checkout page and never touch our server; we never see or store them.
• Guest details — after payment we ask for your nationality and city/country of residence, which the local government unit requires for its tourist-arrival reports. Your passport or ID is checked physically at check-in and is never stored.
• Push notification token (app only) — if you sign in on the mobile app and allow notifications, we store your device's push token to notify you about new messages and booking updates. The token is deleted when you log out of the app.
• Sign-in session — a cryptographically signed cookie that keeps you logged in for up to 30 days. It contains no tracking identifiers.
• Error reports (app only) - if a page fails to run inside the mobile app, the error message, the script location and your device's browser version string are written to our server log so we can fix the fault. They contain no name, email address or account details.

What we never do

We run no advertising and no analytics or tracking scripts, we set no marketing cookies, and we never sell or share your personal data for marketing purposes.

Who processes data on our behalf

A small number of service providers process data strictly to operate the service:

• Cloudflare Turnstile — bot protection on the signup form. Subject to the Cloudflare privacy policy.
• Brevo — delivers transactional email: booking confirmations, verification links, and message notifications.
• Apple Push Notification service — delivers push notifications to the iOS app.
• Firebase Cloud Messaging (Google) — delivers push notifications to the Android app.
• PayMongo — processes card and e-wallet (GCash, Maya) payments on PayMongo's own hosted checkout page under the PayMongo privacy policy. We send PayMongo the amount and booking reference only — not your name or email — and PayMongo emails your payment receipt.
• BTCPay Server — our own self-hosted payment server for Bitcoin payments. Invoices contain only the amount and booking reference; paid coins go to a wallet we control, never through the booking server.
• Google (Fonts and Maps) — page typography is loaded from Google Fonts and the location map is embedded from Google; both share your IP address and browser details with Google under the Google privacy policy.
• Hetzner — hosts the server and database within the EU.

How long we keep data

Booking and payment records, and the message threads attached to them, are kept for 10 years — the period Philippine tax rules require business accounting records to be preserved — and are deleted after that. Device push tokens are removed when you log out. You can delete your account at any time — see below.

Deleting your account

You can delete your guest account yourself, in the HelloWorld Siargao Homestay app or on the website. No request to us is needed:

1. Sign in and open My Trips.
2. Choose Delete my account at the foot of the page.
3. Confirm with your password. Deletion happens immediately and cannot be undone.

Deleted with the account: the name, email address and phone number held on your account, the one-way hash of your password, any pending verification or password-reset links, and every device push token — so your devices stop receiving notifications from us.

Kept: bookings you have already requested or made, together with their stay dates, the nationality and city/country of residence you supplied, and the message threads attached to them. These are the homestay's record of a real stay and the basis of the tourist-arrival reports we are required to file with the local government unit, so they are kept for 10 years — the period Philippine tax rules require business accounting records to be preserved — and deleted after that. They also keep the name, email address and phone number you gave when making them — a booking is a record of who stayed, so deleting the account detaches those rows from it rather than emptying them. They are no longer linked to a guest account.

Deleting your account does not cancel a booking. If you need to change or cancel one, message us from My Trips first.

If you would rather have some of your data removed without closing your account, email booking@helloworldhomestay.com saying what you would like removed, and we will action what we are not required to keep.

Your rights

You can request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Email booking@helloworldhomestay.com and we will respond within a reasonable time.

Changes to this policy

If we change how we handle personal data we will update this page and the date at the top.