Privacy Policy

Indian River RV Resort mobile application · Effective 2026-05-08

This policy describes what information the Indian River RV Resort mobile application ("the App") collects, how it is used, and the choices you have. The App is operated by Indian River RV Resort ("we", "us"). If you have questions, contact info@indianriverrvresort.com.

What we collect

We collect only the information needed to make the App work. Categories:

• Account information — Provided by you when you booked your reservation.
• Reservation information — We match your account to an existing reservation in our park-management system (Campspot) using your email address.
• Location — precise GPS coordinates while the App is open, used only for AR treasure hunt gameplay (finding waypoints on resort grounds). Not collected in the background or stored by us anywhere.
• Camera and photos — the camera is used for AR treasure hunt gameplay and, if you choose, to attach photos to support tickets or hunt puzzles. Photos you do not attach are not uploaded.
• Push notification token — an opaque identifier from Apple Push Notification service or Firebase Cloud Messaging so we can deliver in-app alerts (order status, ticket status, staff messages, hunt updates, etc.).
• Application activity — records you create in the App: orders, support tickets and messages, hunt progress, and message threads.
• Diagnostic information — basic crash and error logs, including device model and OS version, for stability work.

What we do not collect

• We do not collect advertising identifiers (IDFA, AAID).
• We do not track you across other apps or websites.
• We do not sell your personal information.
• We do not run third-party advertising in the App.

How we use the information

• Operating the App — account login, magic-link email verification, password reset, displaying your reservation, processing orders, routing support tickets to staff, delivering staff messages, awarding hunt prizes.
• Communicating with you — transactional emails (magic links, password reset), push notifications about events relevant to your account.
• Improving the App — crash reports and aggregate usage data to find and fix bugs.
• Safety and compliance — preventing abuse, complying with legal requests.

Third parties that process data on our behalf

• Fly.io — hosts our application servers and database (United States region).
• Apple Push Notification service and Firebase Cloud Messaging (Google) — deliver push notifications. We send Apple/Google an opaque push token plus the message contents.
• Campspot — our park-management system. The App reads your reservation based on your email to verify guest accounts and whether you are checked-in.
• Square — processes in-app payments for orders. Card details are entered into Square's PCI-compliant fields and are not stored on our servers.
• Open-Meteo — weather forecast for the resort location. No personal data is sent.
• Email service providers — deliver transactional email. Recipient address and message contents only.

These providers act under contract and may not use the information for their own purposes.

How we secure your information

• All traffic between the App and our servers is encrypted with HTTPS / TLS.
• Passwords are stored as bcrypt hashes; we never see plaintext passwords.
• Multi-tenant data isolation is enforced at the database level via row-level security policies.
• Access to production systems is limited to authorized resort administrators.

Retention and deletion

Active accounts and the data associated with them are retained for as long as the account is active. When you ask us to delete your account, we offer two paths:

• Soft delete (default) — your account is disabled and hidden from operational views. Historical records (orders, tickets, timecards, messages) are preserved so other users' history remains intact.
• Hard delete (on request) — your account and all linked records are permanently removed. Used for GDPR right-to-erasure requests and similar.

To request either, email info@indianriverrvresort.com from the address on your account.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Request deletion (see above).
• Opt out of push notifications via your device settings.
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact info@indianriverrvresort.com.

Children

The App is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us and we will delete it.

California residents

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information are collected, the right to delete, and the right to opt out of "sale" of personal information. We do not sell personal information.

European residents

If you are in the European Economic Area or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR) including access, rectification, erasure, restriction, portability, and objection. The legal bases we rely on are: performance of a contract (delivering the service you signed up for), legitimate interests (operating and securing the App), and consent (push notifications, location).

Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the App. The effective date at the top reflects the most recent revision.

Contact

Questions about this policy or about how we handle your information:

• Email: info@indianriverrvresort.com
• Mail: Indian River RV Resort, 561 N Straits Hwy, Indian River, MI 49749