Your Data

Privacy Policy

Last updated: 27 July 2026

HelloWorld Siargao Homestay ("we", "us") operates the website helloworldhomestay.com and the HelloWorld Homestay mobile app. This policy explains what we collect, why, and the choices you have. Questions or requests: booking@helloworldhomestay.com.

What we collect, and why

• Booking requests — your name, email address, optional phone number, stay dates, number of guests, and any notes you add. Used to process and manage your booking and to contact you about it.
• Guest account (optional) — your name and email address, and your password stored only as a one-way bcrypt hash. We can never see or recover your password.
• Messages — the conversation threads you exchange with the host about a booking, so both sides can follow the conversation.
• Payments — when you pay for a confirmed booking we record the payment's amount, method, provider, status, and timestamps. Card and e-wallet details are entered on the payment provider's own checkout page and never touch our server; we never see or store them.
• Guest details — after payment we ask for your nationality and city/country of residence, which the local government unit requires for its tourist-arrival reports. Your passport or ID is checked physically at check-in and is never stored.
• Push notification token (app only) — if you sign in on the mobile app and allow notifications, we store your device's push token to notify you about new messages and booking updates. The token is deleted when you log out of the app.
• Sign-in session — a cryptographically signed cookie that keeps you logged in for up to 30 days. It contains no tracking identifiers.

What we never do

We run no advertising and no analytics or tracking scripts, we set no marketing cookies, and we never sell or share your personal data for marketing purposes.

Who processes data on our behalf

A small number of service providers process data strictly to operate the service:

• Cloudflare Turnstile — bot protection on the signup form. Subject to the Cloudflare privacy policy.
• Brevo — delivers transactional email: booking confirmations, verification links, and message notifications.
• Apple Push Notification service — delivers push notifications to the mobile app.
• PayMongo — processes card and e-wallet (GCash, Maya) payments on PayMongo's own hosted checkout page under the PayMongo privacy policy. We send PayMongo the amount and booking reference only — not your name or email — and PayMongo emails your payment receipt.
• BTCPay Server — our own self-hosted payment server for Bitcoin payments. Invoices contain only the amount and booking reference; paid coins go to a wallet we control, never through the booking server.
• Google (Fonts and Maps) — page typography is loaded from Google Fonts and the location map is embedded from Google; both share your IP address and browser details with Google under the Google privacy policy.
• Hetzner — hosts the server and database within the EU.

How long we keep data

Booking records and message threads are kept as part of the business's records. Device push tokens are removed when you log out. You can ask us to delete your account and associated personal data at any time — see below.

Your rights

You can request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Email booking@helloworldhomestay.com and we will respond within a reasonable time.

Changes to this policy

If we change how we handle personal data we will update this page and the date at the top.