This is a translation provided for convenience. If there is any difference between the two, the Spanish version is the one that governs.
Privacy Policy — EcoRutas CR
Last updated: September 15, 2026
1. Who is responsible
EcoRutas CR is an independent project, operated by a private individual in Costa Rica (not a registered company). For any question about your personal data, write to contacto.ecorutascr@gmail.com.
2. What data we process, and why
2.1 Account (optional)
You can use the app without an account: viewing the map, searching for stations, filtering, saving favorites on your device and drawing routes do not require signing up.
If you create an account, we store your email address and a password, which our provider (Supabase) stores encrypted with a hash function: we never see it and cannot recover it. We use the email to identify you, to confirm the account and to reset the password. We do not send newsletters or advertising.
2.2 Content you publish (requires an account)
- Reviews: a rating from 1 to 5, a preset tag (there is no free text) and, if you want, the price you paid. They are public, but shown without your name or email.
- Stations you add: name, address, network or brand, type (electric or LP gas), location and, for chargers, connectors, power and price if you know it. They are public and marked as a user contribution so nobody confuses them with official data. They stay linked to your account only so that you can edit or delete them; who added them is not shown to anyone.
- Favorites: if you have an account, which stations you marked. They are private: only you can see them.
2.3 Content reports (with or without an account)
If you report a station or a review, we store what you reported, the reason and the details you write. If you do it while signed in, the report is linked to your account. If you do it without an account, we store a fingerprint of your IP address computed with a secret key (HMAC), used only to limit mass reports from the same origin; we do not store the IP, and that fingerprint cannot be reversed to recover it. Reports are not shown to anyone: the moderator reviews them by hand.
2.4 Location
We use your device's location, with your permission, to show you the nearest stations, to calculate how far you have left and to follow you during navigation.
Where your location goes, exactly:
Showing you what is nearest, calculating distances and following you while you navigate all happens on your device: your position is not sent to our servers and is not stored.
The exception is drawing a route. At that moment, the origin and destination coordinates are sent to our server, which forwards them to the routing engine to calculate the path. They are not stored in our database and are not linked to your account. The request does remain in the server's technical logs for a maximum of 7 days, like any web request, and is then deleted.
2.5 Data on your device
So that the app works offline, your browser or phone keeps a copy of the charging points, your favorites, your preferences and the route you have drawn. They are not on our servers and are deleted if you clear the site data or uninstall the app.
2.6 What we do NOT do
We do not use third-party analytics or tracking: no Google Analytics, social media pixels, advertising identifiers or the like. We do not show advertising. We do not process payments or ask for card details. We do not sell or transfer your data.
3. Legal basis
We process your data with your consent — when you create the account, grant location permission and publish content — and because it is needed to provide the service you asked for. You can withdraw consent at any time: by revoking the app's location permission, deleting your content, or deleting your account.
4. Who data is shared with
EcoRutas CR uses these providers to work:
- Supabase (United States): hosts the database, manages sign-in and runs the server functions, including forwarding route requests. It is a data processor: it only processes data according to our instructions. See its privacy policy.
- Routing engine (Project OSRM, the open-source project's public server): receives the origin and destination coordinates through our server. Your device never connects to it directly, so it does not see your IP address or your account.
- OpenFreeMap: provides the map imagery (OpenStreetMap data). Your device requests it directly, so that service sees your IP address and which map areas you load.
- Vercel and Netlify (United States): host the site. Like any web server, they log the requests they receive (IP address, browser, page requested) for a limited time.
- Open Charge Map: the source of the EV charging station data. We copy its Costa Rica data into our database twice a day, under the Creative Commons Attribution 4.0 license. The query is generic (country = Costa Rica) and includes no data about you.
- ARESEP: the LP gas station data comes from its public registry. We send it nothing.
We do not share data with third parties for advertising or commercial purposes.
5. International transfer
Our providers have servers in the United States, so the data described above is stored and processed outside Costa Rica. We choose providers with contractual and technical security measures, and we process only the minimum necessary.
6. How long we keep each thing
| Data | Until when |
|---|---|
| Account, reviews and favorites | Until you delete the account. They are deleted immediately then. |
| Stations you added | They remain on the map, because they are useful information for everyone, but when you delete the account they lose any link to you. You can delete them before, from the app. |
| Content reports | As long as needed for moderation. They are not deleted automatically; you can ask for their deletion by writing to us. |
| Server technical logs | Up to 7 days. |
| Data on your device | Until you delete it yourself. |
7. Your rights
Under Costa Rica's Law 8968 (Protection of the Person Regarding the Processing of Their Personal Data) and its regulations, you have the right to:
- Access the data we hold about you
- Rectify incorrect data
- Delete your data
- Object to its processing and revoke your consent
To access, rectify or object, write to contacto.ecorutascr@gmail.com from the email you signed up with. We reply within the time limits set by law. To delete your account and your data, you can do it yourself instantly from the app, or ask by email: see how to delete your account.
If you consider that we did not handle your request, you can turn to Costa Rica's data protection agency, the Agencia de Protección de Datos de los Habitantes (PRODHAB).
8. Security
All communication travels encrypted (HTTPS). Permissions are enforced in the database, row by row: your favorites and your account data are only accessible with your session, and who created each station or review is never returned to any client. The content the app makes public — reviews and added stations — is visible to anyone, as described above.
9. Minors
EcoRutas CR is meant for people who drive and is not directed at anyone under 18. We do not knowingly collect data from minors; if you believe a minor created an account, write to us and we will delete it.
10. Changes to this policy
If it changes in an important way, we will say so in the app before the change takes effect, and this page always shows the date of its latest version.