This is a translation provided for convenience. If there is any difference between the two, the Spanish version is the one that governs.
Privacy Policy — EcoRutas CR
Last updated: October 3, 2026
1. Who is responsible
EcoRutas CR is an independent project, operated by a private individual in Costa Rica (not a registered company). For any question about your personal data, write to contacto.ecorutascr@gmail.com.
2. What data we process, and why
2.1 Account (optional)
You can use the app without an account: viewing the map, searching for stations, filtering, saving favorites on your device and drawing routes do not require signing up.
If you create an account, we store your email address and a password, which our provider (Supabase) stores encrypted with a hash function: we never see it and cannot recover it. We use the email to identify you, to confirm the account and to reset the password. We do not send newsletters or advertising.
2.2 Content you publish (requires an account)
- Reviews: a rating from 1 to 5, a preset tag (there is no free text) and, if you want, the price you paid. They are public, but shown without your name or email.
- Stations you add: name, address, network or brand, type (electric or LP gas), location and, for chargers, connectors, power and price if you know it. They are public and marked as a user contribution so nobody confuses them with official data. They stay linked to your account only so that you can edit or delete them; who added them is not shown to anyone.
- Favorites: if you have an account, which stations you marked. They are private: only you can see them.
- "I'm charging" notice: if you tap "I'm charging" at a station, we store that your account is using that station, since what time and until when the notice is valid. Others see only how many people are charging there and since when, never who. The notice is deleted when you tap "I'm done" or, if you don't, when it expires (see section 6). To limit abuse we count how many notices you gave during the day, without storing which stations or at what time.
- Road reports: if you report something while navigating (traffic jam, crash, police, hazard or road closed), we store the type, the place where you were when you reported it and the time. The report is public —anyone sees it on the map and can say whether it's still there—, but who made it is never shown. It stays linked to your account while it is active, so you can withdraw it and to limit abuse. If you answer "Still there" or "Not there" to someone else's report, we store that vote so it doesn't count twice. Each report expires on its own and is deleted with its votes (see section 6). We also count how many reports you made during the day, without storing where or at what time.
2.3 Content reports (with or without an account)
If you report a station or a review, we store what you reported, the reason and the details you write. If you do it while signed in, the report is linked to your account. If you do it without an account, we store a fingerprint of your IP address computed with a secret key (HMAC), used only to limit mass reports from the same origin; we do not store the IP, and that fingerprint cannot be reversed to recover it. Reports are not shown to anyone: the moderator reviews them by hand.
2.4 Location
We use your device's location, with your permission, to show you the nearest stations, to calculate how far you have left and to follow you during navigation.
Where your location goes, exactly:
Showing you what is nearest, calculating distances and following you while you navigate all happens on your device: your position is not sent to our servers and is not stored.
There are three exceptions. The first is drawing a route. At that moment, the origin and destination coordinates are sent to our server, which forwards them to the routing engine to calculate the path: OSRM's or, when the route is calculated with live traffic, Mapbox's. They are not stored in our database and are not linked to your account. The request does remain in the server's technical logs for a maximum of 7 days, like any web request, and is then deleted.
The second is when you say you're charging ("I'm charging"), which also confirms that the station works: your position is sent to our server only to check that you are at the station (within 150 m). The position is not stored; the only things kept are what section 2.2 describes and the date someone confirmed the station, without saying who.
The third is when you report something on the road: then your position is stored and published, because it is the place of the report. It is published without saying who, and it is deleted when the report expires.
2.5 Data on your device
So that the app works offline, your browser or phone keeps a copy of the charging points, your favorites, your preferences and the route you have drawn. If the route was calculated with live traffic, only the destination is kept: Mapbox's terms do not allow storing its routes, so it is requested again when you open the app. They are not on our servers and are deleted if you clear the site data or uninstall the app.
2.6 What we do NOT do
We do not use third-party analytics or tracking: no Google Analytics, social media pixels, advertising identifiers or the like. We do not show advertising. We do not process payments or ask for card details. We do not sell or transfer your data.
3. Legal basis
We process your data with your consent — when you create the account, grant location permission and publish content — and because it is needed to provide the service you asked for. You can withdraw consent at any time: by revoking the app's location permission, deleting your content, or deleting your account.
4. Who data is shared with
EcoRutas CR uses these providers to work:
- Supabase (United States): hosts the database, manages sign-in and runs the server functions, including forwarding route requests. It is a data processor: it only processes data according to our instructions. See its privacy policy.
- Routing engine (Project OSRM, the open-source project's public server): receives the origin and destination coordinates through our server. Your device never connects to it directly, so it does not see your IP address or your account.
- Mapbox (United States): calculates routes with live traffic. It receives the origin, destination and stop coordinates through our server, just like the routing engine: your device does not connect to Mapbox, so it does not see your IP address or your account. See its privacy policy.
- OpenFreeMap: provides the map imagery (OpenStreetMap data). Your device requests it directly, so that service sees your IP address and which map areas you load.
- Vercel and Netlify (United States): host the site. Like any web server, they log the requests they receive (IP address, browser, page requested) for a limited time.
- Open Charge Map: the source of the EV charging station data. We copy its Costa Rica data into our database twice a day, under the Creative Commons Attribution 4.0 license. The query is generic (country = Costa Rica) and includes no data about you.
- ARESEP: the LP gas station data comes from its public registry. We send it nothing.
We do not share data with third parties for advertising or commercial purposes.
5. International transfer
Our providers have servers in the United States, so the data described above is stored and processed outside Costa Rica. We choose providers with contractual and technical security measures, and we process only the minimum necessary.
6. How long we keep each thing
| Data | Until when |
|---|---|
| Account, reviews and favorites | Until you delete the account. They are deleted immediately then. |
| Stations you added | They remain on the map, because they are useful information for everyone, but when you delete the account they lose any link to you. You can delete them before, from the app. |
| Road reports and their votes | They expire on their own: a traffic jam after 30 minutes, a crash or police after an hour, a hazard after 3 hours and a road closure after 6 hours (each "Still there" extends it a little), and they are deleted a few minutes after expiring. They are deleted earlier if the person who reported it withdraws it or if several people say it's no longer there. The daily report count is deleted the next day. If you delete your account, they are deleted immediately. |
| Content reports | As long as needed for moderation. They are not deleted automatically; you can ask for their deletion by writing to us. |
| "I'm charging" notice | Until you tap "I'm done". If you don't, it expires on its own: after 60 minutes at an EV station and 15 at an LP gas one ("Still charging" adds 30 minutes, up to 4 hours in total), and it is deleted a few minutes after expiring. The daily notice count is deleted the next day. If you delete your account, it is deleted immediately. |
| Server technical logs | Up to 7 days. |
| Data on your device | Until you delete it yourself. |
7. Your rights
Under Costa Rica's Law 8968 (Protection of the Person Regarding the Processing of Their Personal Data) and its regulations, you have the right to:
- Access the data we hold about you
- Rectify incorrect data
- Delete your data
- Object to its processing and revoke your consent
To access, rectify or object, write to contacto.ecorutascr@gmail.com from the email you signed up with. We reply within the time limits set by law. To delete your account and your data, you can do it yourself instantly from the app, or ask by email: see how to delete your account.
If you consider that we did not handle your request, you can turn to Costa Rica's data protection agency, the Agencia de Protección de Datos de los Habitantes (PRODHAB).
8. Security
All communication travels encrypted (HTTPS). Permissions are enforced in the database, row by row: your favorites and your account data are only accessible with your session, and who created each station or review is never returned to any client. The content the app makes public — reviews, added stations, how many people are charging at each station and road reports — is visible to anyone, as described above. Who is charging and who made a report are never returned to anyone.
9. Minors
EcoRutas CR is meant for people who drive and is not directed at anyone under 18. We do not knowingly collect data from minors; if you believe a minor created an account, write to us and we will delete it.
10. Changes to this policy
If it changes in an important way, we will say so in the app before the change takes effect, and this page always shows the date of its latest version.