Privacy Policy

Who we are

Suroyn is operated by bisaya.dev (the Operator), a sole proprietorship registered in the Philippines. References to "we", "us", or "Suroyn" refer to bisaya.dev. You can reach us at [email protected].

What we collect

We collect only what's needed to run the service:

• Account data: your name, email, password (hashed), and preferences.
• Trip data: trips, itineraries, locations, accommodations, packing lists, expenses, comments, and files you upload.
• Tour company data: if you operate a tour company on Suroyn, the company name, description, logo, packages, and Messenger handle.
• Inquiries: when you inquire about a tour package, we record the package, group size, preferred date, and any note you include.
• Usage data: request logs, error reports, and aggregated traffic stats. We do not use ad trackers or cross-site identifiers.

How we use it

• To provide and improve the service.
• To send you transactional emails (invites, password resets, notifications).
• To debug errors and monitor reliability.
• To enforce these terms and prevent abuse.

We do not sell your personal data. We do not use it for advertising.

Where your data lives

Suroyn runs on OVH servers in Singapore. Backups and uploaded files are stored in the same region.

Sub-processors

We share limited data with the following providers to operate the service:

• OVH: application and database hosting (Singapore).
• Purelymail: transactional email delivery.
• Sentry: error monitoring and stack traces.
• Cloudflare: CDN, DNS, and privacy-friendly web analytics.

Each provider processes only what's needed for its function. We do not share data with anyone else.

Tour package inquiries

When you submit an inquiry about a tour package, you are redirected to the tour company's Messenger page with your message prefilled. The conversation that follows happens on Facebook Messenger and is governed by Meta's privacy policy, not ours. We retain a record of the inquiry on Suroyn (package, group size, date, note) for our analytics.

Your rights

You can, at any time:

• Access, edit, or export your data from your profile.
• Request deletion of your account by emailing [email protected].
• Correct inaccurate information.

We respond to requests within 30 days.

Retention

We keep your data while your account is active. When you delete your account, your personal data is removed within 30 days. Trip data shared with co-organizers may persist on their accounts. We may keep minimal records (logs, billing) for up to 12 months for audit and legal purposes.

Age requirement

Suroyn is for users 18 years and older. We do not knowingly collect data from anyone under 18.

Cookies

We use essential session cookies to keep you signed in. We do not use advertising cookies. Cloudflare Web Analytics is cookie-less.

Changes

If we make material changes to this policy, we'll email registered users and post a notice on Suroyn at least 14 days before they take effect.

Contact

Questions or requests: [email protected].