Last updated: March 20, 2026
Exuma Secrets ("we," "our," or "us") operates the Exuma Secrets mobile application (the "App"), available on the Apple App Store and Google Play Store. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. This policy applies to all users worldwide, including those in the United States, Canada, the European Economic Area (EEA), the United Kingdom, and the Asia-Pacific region.
Account Information: When you create an account, we collect your first name, last name, email address, username, and password. You may optionally provide a telephone number and profile photo.
Location Data: With your explicit permission, we collect your device's precise GPS location. This data is used to enable check-ins at points of interest and show nearby places. Location data may be retained and used in aggregated, anonymized form for analytics. You can revoke location permission at any time in your device settings.
Photos and Media: When you upload photos to community posts, reviews, business listings, or menu pages, we collect and store those images on our servers. We access your device's photo library or camera only when you choose to upload, and only the selected media is transmitted.
User-Generated Content: We collect content you voluntarily submit, including community posts, comments, reviews, ratings, trip itineraries, direct messages, and business listing submissions. Trip itineraries, community content, and direct messages are stored on our servers. Packing list data and certain trip data may be stored locally on your device. All user-generated content (posts, comments, reviews, and direct messages) is processed by our AI-powered content moderation system before publication to detect and prevent objectionable content.
Trip Sharing Data: When you share a trip with another user, we store the sharing relationship, including the sender, recipient, trip details, and sharing status (pending, accepted, or declined).
Usage Data: We collect information about how you interact with the App, including features used, points of interest viewed, interactions with business listings (calls, emails, website visits, WhatsApp messages, bookings), and the dates and times of your activity. This data is used to provide analytics to business owners and to improve the App.
Device Information: We may collect information about your device, including device type, operating system version, unique device identifiers, and push notification tokens.
Purchase Information: If you make in-app purchases or subscribe to Premium features, payment processing is handled entirely by Apple (App Store) or Google (Play Store). We receive confirmation of your purchase status but do not collect or store your payment card details or financial information.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR) and equivalent UK legislation:
The App uses Apple's App Tracking Transparency (ATT) framework to request your permission before tracking your activity across other companies' apps and websites. If you grant permission, we may:
You can change your tracking preferences at any time in your device's Settings under Privacy & Security > Tracking. If you decline tracking, we will not use your IDFA or link your data with third-party data for advertising purposes.
Cookies: The App uses session cookies solely to maintain your login state. These are not used for cross-site tracking.
We may share your information in the following situations:
We do not sell your personal information to data brokers. Anonymized, aggregated analytics data that cannot identify any individual may be shared with business partners for research and tourism development purposes.
Your personal data may be transferred to, stored, and processed in countries other than your country of residence, including the United States and The Bahamas. These countries may have data protection laws that differ from those in your jurisdiction.
If you are located in the EEA, UK, or Switzerland, we ensure that any transfer of your personal data to countries outside the EEA/UK is protected by appropriate safeguards, such as:
If you are located in Canada, transfers are conducted in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, ensuring a comparable level of protection.
We retain your account information and user-generated content for as long as your account is active or as needed to provide you services. After account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal obligations). Anonymized, aggregated data that cannot identify you may be retained indefinitely for analytics and research.
We use industry-standard security measures to protect your information, including encrypted connections (HTTPS), secure session management, JWT-based authentication, and access controls. However, no method of electronic transmission or storage is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law.
The App is not directed to children under the age of 13 (or under 16 in the EEA/UK, or under 14 in South Korea). We do not knowingly collect personal information from children below these age thresholds. In the EEA and UK, where processing of children's data requires parental or guardian consent under GDPR Article 8, we will not process such data without verifiable consent. In Canada, we comply with PIPEDA's requirements for meaningful consent for minors. If we become aware that we have collected personal information from a child below the applicable age threshold, we will take prompt steps to delete it. If you believe we have inadvertently collected information from a child, please contact us immediately.
California (CCPA/CPRA): If you are a California resident, you have the right to:
Other U.S. States: Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with consumer privacy laws have similar rights to access, correct, delete, and opt out of the processing of personal data. To exercise these rights, contact us at the email address below.
If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR:
We will respond to your request within 30 days, as required by law.
Data Protection Contact: If you have questions about how we process your data or wish to exercise your GDPR rights, please contact our data protection team at support@exumasecrets.com. As Exuma Secrets is based in The Bahamas (a non-EEA/UK country), we are committed to responding to your inquiries promptly and in accordance with GDPR requirements. If we are required to appoint a representative in the EEA or UK under GDPR Article 27, we will update this policy with their contact details.
If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (such as Quebec's Law 25, Alberta's PIPA, and British Columbia's PIPA) grant you the following rights:
We will only collect, use, or disclose your personal information with your knowledge and consent, except where permitted or required by law.
Japan (APPI): If you are a resident of Japan, the Act on the Protection of Personal Information (APPI) provides you with the right to request disclosure, correction, cessation of use, or deletion of your personal information. We will handle your personal data in accordance with APPI requirements, including obtaining your consent before providing personal data to third parties or transferring it internationally.
South Korea (PIPA): If you are a resident of South Korea, the Personal Information Protection Act (PIPA) grants you rights to access, correct, delete, and suspend processing of your personal data. We process personal data in accordance with PIPA, and you may contact us or the Personal Information Protection Commission (PIPC) with any concerns.
Australia (Privacy Act 1988): If you are an Australian resident, the Privacy Act 1988 and the Australian Privacy Principles (APPs) grant you the right to access and correct your personal information. You may file a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been violated.
Singapore (PDPA): If you are a resident of Singapore, the Personal Data Protection Act (PDPA) provides you with rights to access and correct your personal data, and to withdraw consent for data collection and use. You may contact the Personal Data Protection Commission (PDPC) with any complaints.
Other Jurisdictions: If you reside in a country with data protection laws not specifically listed above, we will honor your rights under your local law to the extent applicable. Please contact us to exercise any applicable rights.
The App may integrate with or contain links to the following types of third-party services, each governed by their own privacy policies:
We encourage you to review their privacy policies before interacting with them.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page, updating the "Last updated" date, and where appropriate, sending you a notification through the App. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy. Where required by law (e.g., GDPR), we will obtain your consent before making material changes to how we process your data.
If you have questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about how we handle your data, please contact us at:
Exuma Secrets
Email: support@exumasecrets.com
Website: https://exumasecretsapp.com
If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.