Privacy Policy

TARA! ("we," "us," or "our") operates a travel companion platform that helps travelers in the Philippines discover duty-free shopping, track flights, find curated gifts, and access airport services — all in one place.

This Privacy Policy explains what information we collect when you use our website at taraapp.example.com and our related services (collectively, the "Service"), how we use it, and the choices you have.

We collect information you provide directly and information generated automatically when you use the Service.

• First name, last name, and email address (when you register or sign in with Google)
• Password (stored securely on our servers, never in plain text)
• Authentication source (e.g. email registration or Google OAuth)

• Date of birth
• Country of origin
• Mobile phone number

• Flight numbers, airport codes, and travel dates you attach to your trip
• Departure and arrival preferences

• Contact details (email or phone) entered during checkout
• Delivery and billing addresses entered during checkout
• Product browsing, basket contents, and wishlist selections

• Device type, browser type, operating system, and screen resolution
• IP address and approximate location (country/region level)
• Pages visited, features used, and time spent on the Service

We use the information we collect to:

• Provide the Service — create and manage your account, display flight information, show duty-free products, and enable gift browsing
• Personalize your experience — show relevant airport information, terminal details, and recommendations based on your flights
• Process orders — coordinate duty-free reservations and gift purchases through our partner platforms
• Communicate with you — send order confirmations, travel reminders, and respond to support requests
• Improve the Service — analyze usage patterns to fix bugs, improve performance, and develop new features
• Ensure security — detect fraud, protect against unauthorized access, and maintain platform integrity

We do not sell your personal information. We do not use your data for automated decision-making or profiling that produces legal effects.

We use browser local storage (not traditional cookies) to keep you signed in and to improve performance:

• Authentication token — a secure token stored in your browser's local storage that keeps you signed in between visits
• User profile cache — your basic account details (name, email) stored locally so pages load faster
• Application cache — flight data, product listings, and other API responses cached locally to reduce loading times (automatically expires after 24 days)

Our backend authentication system may set session cookies for security purposes. Third-party services (e.g. Google Fonts) may also set their own cookies subject to their respective privacy policies.

We work with trusted third-party services to operate the platform. Here is who we share data with and why:

• Google OAuth — if you choose to sign in with Google, Google shares your name and email address with us. Google's privacy policy applies to their handling of your data.

• Aviation Stack / NAIA Flight API — we query public flight data APIs using airport codes. No personal information is sent to these services.

• Duty Free Philippines — product catalog, pricing, and availability are provided by Duty Free Philippines. When you visit their store, their privacy policy applies.
• Shopify (SpeedRegalo) — our gifts section uses the Shopify Storefront API to display product information. No personal data is shared with Shopify through our app.

• DigitalOcean — product images are served from DigitalOcean Spaces CDN
• Google Fonts — we load typefaces from Google Fonts, which may log IP addresses per Google's privacy policy
• Vercel — our hosting provider processes web requests which include standard server logs (IP address, user agent, timestamps)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We retain your information as follows:

• Account data — retained for as long as your account is active. You can request deletion at any time.
• Flight attachments — retained until you remove them or delete your account
• Local browser data — authentication tokens and cached data persist until you clear your browser storage or the cache expires (up to 24 days for cached API data)
• Server logs — standard web server logs are retained for up to 90 days for security and debugging purposes

When you delete your account, we remove your personal data from our active systems. Some data may persist in encrypted backups for up to 30 additional days before being permanently deleted.

You have the following rights regarding your personal data:

To exercise any of these rights, email us at privacy@taraapp.example.com. We will respond within 30 days.

You can also manage your data directly by editing your profile, removing attached flights, or signing out (which clears your local session data).

To delete your account entirely, visit our Account Deletion page.

We take reasonable measures to protect your information:

• Passwords are hashed and never stored in plain text
• Authentication uses secure bearer tokens with server-side validation
• API communications use HTTPS encryption in production
• Access to user data is restricted to authorized personnel only

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you suspect unauthorized access to your account, contact us immediately.

TARA! is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at privacy@taraapp.example.com and we will promptly delete it.

TARA! is operated from the Philippines. If you access the Service from outside the Philippines, your information may be transferred to, stored, and processed in the Philippines or other countries where our service providers operate.

By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence. We take steps to ensure your data is treated securely regardless of where it is processed.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on the Service if the changes are significant
• Send an email notification to registered users for major changes

We encourage you to review this page periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all inquiries within 30 business days.