Skip to main content
Todo Nuevo México

Privacy Policy

Version 1.9.2 · Last updated July 1, 2026

This Privacy Policy explains how Darell Trujillo LLC (“we,” “us”) handles information in connection with Todo Nuevo México (the “Service”). Todo Nuevo México and XolvedAI are both brands operating under Darell Trujillo LLC. We aim to collect as little personal information as possible.

Information we collect

  • Account email. If you sign in, we collect your email address to send a one-time sign-in link and to associate your saved itineraries with your account. We use passwordless sign-in — we never set or store a password.
  • Social sign-in (optional). If you choose to sign in with Google or Facebook, we receive only your name and email address from that provider to create the same passwordless account. We never receive your password, friends list, or posting permissions, and we never post on your behalf. Signing in with email remains available to everyone.
  • Itineraries you create. The activities, events, days, and notes you add to your adventures, stored so you can return to them.
  • Trip-planner inputs. The preferences you submit to the AI planner (such as region, activity types, and free-text notes) to generate a suggested itinerary.
  • Privacy-respecting analytics. We run our own first-party, cookielessanalytics on our own infrastructure to understand which pages and features are used — pageviews, key actions (such as generating a plan or running a search), and Core Web Vitals performance. It sets no analytics cookies and does not fingerprint you; it stores no raw IP address (only a salted, daily-rotating session hash that cannot be traced back to you) and records no session replay. We also keep aggregate, non-identifying counters of how AI crawlers and referrers reach the Service, plus the basic session data needed to keep you signed in.

How we use information

We use information to operate and secure the Service, to authenticate you, to save and email your itineraries when you ask, to generate trip suggestions, and to understand aggregate usage so we can improve. We do not sell your personal information, and we do not use it for third-party advertising.

Service providers

We rely on a small number of processors who handle data only to provide their service to us:
  • Supabase — database, authentication, and hosting of your account and itineraries.
  • Railway — application and background-worker hosting.
  • Resend — delivery of sign-in links and itinerary emails.
  • xAI — the AI trip planner; your planner inputs and candidate place names are sent to generate a suggestion. We do not send your email address or account identity.
  • OpenFreeMap — OpenStreetMap-based map tiles for the maps you view.
  • Stay22 — embedded lodging/travel search. The Stay22 map loads only after you choose to open it; affiliate booking links are plain outbound redirects.

Affiliate links

Some lodging and travel links on the Service are affiliate links provided by our partner Stay22. If you book through them, we may earn a commission at no additional cost to you. Affiliate relationships never influence our editorial recommendations or cultural-protocol guidance.

Cookies and sessions

We use only the cookies necessary to keep you signed in and to operate the Service. Our analytics are cookieless. We do not use third-party advertising, analytics, or cross-site tracking cookies. Our own pages set no third-party cookies; the optional Stay22 lodging map is third-party content that loads only when you choose to open it, and any cookies it then sets are governed by Stay22’s own policy.

Data retention and your choices

We keep your account and itineraries until you ask us to delete them. You can request access to, correction of, or deletion of your personal information at any time by emailing us; we will honor verified requests as required by applicable law. See Delete your data below for step-by-step instructions.

Delete your data

You can have your account and all associated personal data deleted at any time — this covers accounts created with an email sign-in link and accounts created by signing in with Google or Facebook:
  1. Email [email protected] with the subject “Delete my data” from the email address on your account (for social sign-in, the address of your Google or Facebook account).
  2. We verify the request and delete your account, saved events, itineraries, and profile — including any name and email received from a social sign-in provider — within 30 days, and confirm by reply.
  3. If you signed in with Facebook, you can also remove Todo Nuevo México from Facebook’s Apps and Websites settings — that revokes our access on Facebook’s side; emailing us (step 1) deletes the copy we hold.
Public, non-personal content (such as event listings aggregated from official sources) is not tied to your account and is unaffected by account deletion.

Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them.

Security

We use reasonable technical and organizational measures to protect information, including row-level access controls that scope saved data to its owner. No method of transmission or storage is perfectly secure.

Changes

We may update this Policy from time to time; the “last updated” date above reflects the latest revision.

Disclaimer

XolvedAI and Todo Nuevo México are independent platforms, which use the Grok API and xAI technology. We are not affiliated with, endorsed by, or a partner of xAI or X Corp. All trademarks belong to their respective owners.

Contact

Questions, or a data request? Email [email protected], the single contact address for both Todo Nuevo México and XolvedAI.

See also our Terms of Service.