Privacy Policy

Jefferyl Castillo operates Pheaks and is the personal information controller for accounts on pheaks.com. Reach us through Contact (peakph@gmail.com, 0969 113 9717).

Account: email, password, magic-link session, or a Google account you connect, plus mobile number. Tourism Manifest: full name, date of birth or age, sex, address, blood type, emergency contact name and number, medical conditions. Bookings: trip, seat, payment rail, amounts, QR token. Organizers also store organization name, drawn signature, optional logo, and optional payment channels (account names, numbers, payment links, and QR images) for joiners who pay them off-app, plus payout setup.

Usage: which pages you open, how long you read them, how far you scroll, which buttons you tap, searches you run, error messages you see, page speed, and the device type, browser, and referring site. This is tied to a random device id and, when you are signed in, to your account. We never record what you type into a form, only which field you were on. Pheaks keeps it in its own database (no third-party analytics) for up to 400 days, and uses it only to improve the app. Turn on Do Not Track or Global Privacy Control in your browser and none of it is recorded.

Blood type and medical conditions are sensitive personal information. We collect them because local tourism practice (and an emergency on the trail) needs them on the manifest. We do not use them for marketing.

You see your own profile and tickets. You choose who else sees your joiner card, hike stats, albums, and upcoming Reserved trips (private, signed-in members, or anyone with the link). Upcoming trips default to private. The organizer and coordinators of a trip you booked still see your manifest, seat, and balance so they can run the day and reach your emergency contact. They do not get a dump of every Pheaks user. Admins may access records to approve organizers, handle bans, or fix a booking.

Processors who see what they need to run the service: Supabase (auth, database, file storage), Google (only if you tap Continue with Google, then name and email from that account), PayMongo (convenience-fee payments), and Resend (booking mail from bookings@pheaks.com). Support replies go to a Gmail inbox. We do not sell personal data. We have no Facebook, Instagram, or ad pixels.

We keep account and booking records while the account is open and as long as we need them for payouts, disputes, and the safety record of a trip. You may ask to access, correct, or delete personal data, or to withdraw consent for optional fields, by emailing us. Some records (paid bookings, manifests used on a completed trip) may be retained where the law or a live dispute requires it.

Related: Cookie Policy, Terms of Use.