Privacy Policy

1. Introduction

Welcome to millajepr.com ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience on our website. This Privacy Policy explains our practices regarding the collection, use, and disclosure of your information.

2. Information We Collect

Most mileage calculator activity runs in your browser. While signed out, calculator choices and trip history exist only while the current page stays open and are cleared on reload, navigation, or a new tab. If you sign in, account preferences replace guest preferences; trips from the current page are synchronized only if you explicitly choose to import them. If you use the optional feedback form or contact form, or when optional analytics are enabled in a given deployment, additional limited information is processed as described below.

• Browser storage (cookies, local storage, and session storage): Guest origin, rate, auto-calculate, language, theme, and recent calculations are not stored in cookies, local storage, or session storage. They remain only in the current page’s memory and are cleared on reload, navigation, or a new tab. Cookie-consent choices, onboarding state, and the browser-generated client identifier remain in local storage. Pending passwordless sign-in information expires after 30 minutes. When you sign in, account preferences take precedence; current-page trips are imported only after your explicit choice.
• Voluntary feedback: If you submit feedback, we collect your rating, any comments you type, the page path, a browser-generated client identifier, and an optional email address if you provide one. Optional email is personal information you choose to share. These submissions are transmitted to our servers and stored using Google Cloud / Firebase (Firestore) to operate and improve the Service.
• Voluntary contact submissions: If you submit a message through the contact form, we collect your email address, message content, and a browser-generated client identifier. These submissions are stored using Firebase (Firestore) and transmitted to our administrators via secure email (utilizing Resend / Firebase delivery infrastructure) to respond to your inquiry.
• What's New: When you open What's New, your browser keeps the list of announcements you have already seen in local storage, so the menu only marks newer ones. If you are signed in, we instead store that list with your account in Google Cloud / Firebase (Firestore), together with any notices about your account shown in What's New (for example, that trips were moved to your archive) and whether you have seen them. It contains no trip details, and it is kept until you delete your account (in My account) or ask us to delete it.
• Anti-abuse and security: To limit spam and automated abuse, we maintain short-lived technical records (including one-way hashed values derived from network information and your client identifier) and duplicate-detection data. When enabled, Cloudflare Turnstile may process minimal challenge-related data to assess whether a submission is likely automated.
• Usage data: When enabled for the production deployment, Google Analytics (through Firebase Analytics) is on by default and may process usage events such as feature interactions, language changes, sharing actions, and calculation parameters including origin, destination, distance, trip mode, and rate per mile. After you sign in, it may also receive your Firebase user ID. You can turn analytics off at any time from Customize on the cookie notice or in Cookie Settings, and we honor Global Privacy Control signals as an opt-out. Analytics is not used to sell personal information, and Google signals and ad personalization are turned off. How Google uses data when you use our partners' sites or apps · Cookie Settings
• Authentication and account session: When authentication is available and you choose to sign in, we process identity and session information through Firebase Authentication. This may include your email address, display name, profile image, user ID, authentication provider, and account-session information. We maintain an HTTP-only session cookie to support authenticated features. 'Remember me' is disabled by default. If you explicitly select it, the session may persist for up to five days, subject to expiration, logout, and security controls. After it expires, your browser may keep the cookie for up to seven more days so we can tell you your session ended; it can no longer be used to access your account. If you do not select it, the session cookie is intended to expire when the browser session ends and has a shorter server-enforced lifetime. Account-backed preferences may include calculator settings, recent calculation history (up to 100 entries), eligible historical date entries (up to 2 years in the past), onboarding state, language/theme choices, and synchronization timestamps. Upon first sign-in, the Service also records an authentication event and generates a secure administrative notification containing your name, email address, user ID, and authentication provider. Trips beyond the recent-history limit are moved to an archive stored with your account in Firebase instead of being deleted. Archived trips are kept until you delete your account (in My account) or ask us to delete it, and you can download them, together with your recent trips, as a CSV file.
• Email sign-in: If you choose to sign in with your email, we send you an email with a sign-in link and a 6-digit code. To check them, we store your email address, your language, whether you chose 'Remember me', hashed copies of the link and the code (never the code itself), the number of attempts, and when you asked. Each request expires after 15 minutes and works once, and expired requests are deleted automatically. The email names the browser, device type and time of the request so you can recognize it; we don't store those browser details. To limit how often sign-in emails can be requested, we keep counters keyed to a one-way hash of your IP address and email address.
• Trip purpose: When you're signed in, you can write an optional purpose for each trip (for example, "Client visit in Ponce"), up to 100 characters. We store it with the trip so it shows in your Recents and in your trip download, and so we can suggest your recent purposes. We never send its text to analytics; we only record general facts about it, such as whether a trip has one and its approximate length. You can change or clear it at any time by editing the trip, and it is deleted with the trip or with your account. A cleared or deleted purpose may remain in our encrypted backups for up to 98 days until those backups expire; it is not restored or used in the meantime. Please don't include personal, financial or health information.
• Account deletion: You can delete your account at any time from My account → Delete my account in the menu. Before deleting, you can download your trips as a CSV file. For your security, deletion requires a recent sign-in and typing a confirmation word. Deletion happens immediately and can't be undone. It removes your Firebase Authentication account, your recent and archived trips, your preferences, your What's New list and notices, your sign-in and authentication records, and any email-update subscription linked to your account, and it signs you out on every device. Feedback and contact messages you sent are kept so we can keep improving the Service, but we remove your email address from them. We keep a short record that the deletion happened, which contains no name or email: a one-way hashed identifier, the date, and the number of items deleted. We keep it no longer than necessary to show that your request was completed. Deleted data may remain in our encrypted backups for up to 98 days until those backups expire; it is not restored or used in the meantime. Usage events already sent to Firebase Analytics are kept according to its retention settings and aren't linked to your deleted account. If you create a new account later with the same email, it starts empty and is not linked to the deleted one.

3. Compliance with Puerto Rico Privacy Laws (Law 39-2012 & Law 111-2005)

In compliance with Puerto Rico Law 39-2012 (Internet Privacy Policy Notification Act) and Law 111-2005 (Citizens' Information on Data Security Act), we ensure that:

• We provide clear and transparent notice regarding all data collection, storage, and processing practices.
• We do not sell, rent, or trade your personal information. We engage trusted service providers (such as Google Cloud and Resend) solely as needed to operate, secure, and deliver the Service, as described in this Policy.
• We implement reasonable security measures, access controls, and data encryption to protect the integrity of our application and stored records.
• You can delete your account and its data yourself at any time from My account, or ask us to do it by contacting us. You may also request access to or correction of your personal data by contacting us.
• In accordance with Puerto Rico Law 185-2024 and federal COPPA standards, the Service is intended for adults and does not knowingly collect personal data from children under 13.
• Do Not Track: we don't respond to browser Do Not Track signals, because there is no common standard for them. We do honor Global Privacy Control as a request to turn analytics off.

4. Third-Party Services

Our application may contain links to third-party websites (e.g., official government documents). We are not responsible for the privacy practices or content of those third-party sites.

The Service is hosted on infrastructure provided by Google (including Firebase Authentication, Firestore, Google Cloud, and, when enabled, Firebase Analytics). Email notifications and user-requested acknowledgments are transmitted using authorized delivery infrastructure provided by Resend (Resend, Inc.) and Google Firebase. If Cloudflare Turnstile is enabled, Cloudflare processes data needed to run the challenge. Each provider's own privacy notice applies to its processing. Sign-in emails are sent through Resend (Resend, Inc.).

5. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

6. Contact Us

If you have any questions about this Privacy Policy or data handling, or want to request access to, correction of, or deletion of your data, email us at support@millajepr.com or contact us through the form.