Privacy policy

1. Who we are

Mecavoy is operated by Mecavoy LC, a limited liability company registered in Wyoming, United States, entity ID 2026-002066107, of 5830 E 2nd St, Ste 7000 #38404, Casper, Wyoming 82609, United States. We are the controller of the information described here.

Privacy questions, and any request about your own information, go to privacy@mecavoy.com. Anything else: support@mecavoy.com. A person answers both.

2. What we collect, and why

Only what the mailing list needs. There is no account to open yet, nothing to buy, and no trip to plan, so there is nothing else to collect.

2.1 What you give us

• Your email address. So we can email you. It is the only thing on the form.
• Your consent. The exact wording you saw next to the checkbox, the version of that wording, the time you ticked it, and the fact it was given through a web form with a confirmation step. We keep the wording verbatim so that what you agreed to is a matter of record rather than of memory — including if you later say you never agreed to anything.

2.2 What the request itself carries

• A salted one-way hash of your IP address, taken when you subscribe and again when you click the confirmation link. It lets us spot a machine submitting the form a thousand times. It cannot be reversed into an address, and the address itself is never written to your record.
• Your browser's user agent — the line every browser sends saying what it is. Same purpose.
• Which page you subscribed from, so we know what is working.

2.3 What we add afterwards

Whether you have confirmed, when you did, when we last emailed you, whether the welcome message has gone out, and — if you unsubscribe — that you did. Housekeeping, so that we send you the right thing once and not twice.

2.4 Our web server logs

Separately from all of the above, our content delivery network keeps ordinary web access logs, and those do contain the IP address each request came from. Every website has these. We keep them for 90 days and use them for security and diagnostics — spotting an attack, working out why a page failed. They are never joined to your subscriber record, never used for marketing, and never shared with anyone for theirs.

2.5 What we do not collect

No name, no address, no phone number, no payment details, no location, no advertising identifiers. We do not buy lists and we do not add addresses we were not given directly by the person they belong to.

3. Our legal basis

Your consent, for the emails — given by ticking the box and confirmed by clicking the link we sent. You can withdraw it at any time, and withdrawing it does not undo anything we did while it stood. For the anti-bot signals in 2.2 and the logs in 2.4 we rely on our legitimate interest in keeping the service standing up, which we think is obvious and minor; you can object, and section 6 says how.

4. Who else sees it

We do not sell personal information, and we do not share it for anyone else's marketing. Two companies process it on our behalf, each under contract and only for the purpose named:

Amazon Web Services

Hosts the list, the website and the logs, in the United States.

Mailgun (Sinch)

Delivers the email. It receives your address because that is where the message goes.

Beyond those two: our accountants, lawyers or insurers if they ever need it, and any authority the law obliges us to tell. If Mecavoy or its assets are ever bought, we will tell you before your information becomes subject to a different policy.

5. How long we keep it

Your subscription

Until you unsubscribe or ask us to delete it.

After you unsubscribe

Everything is deleted except your address, which stays on a suppression list.

Web access logs

90 days.

Never confirmed

Deleted after 12 months. An unconfirmed record is not a subscriber.

The suppression list is the one thing we keep indefinitely, and it is worth explaining. If we deleted your address outright we would have no record that you ever asked us to stop, so the next time an old file was imported we would email you again. Keeping the address — and nothing else — is how we make sure we do not.

6. Your rights

Wherever you live in the United States you can ask us to do any of the following, free, and we will not treat you differently for asking. We answer within 30 days, or 45 in California where we may extend once and will tell you if we do.

• See what we hold about you.
• Correct anything wrong.
• Delete it. We will, except the suppression entry explained in 5.
• Take it with you, in a machine-readable file.
• Object to the legitimate-interest processing in section 3.
• Withdraw consent, which unsubscribing does immediately.

Email privacy@mecavoy.com. We may ask you to confirm the request from the address in question, because otherwise anyone could ask us to delete anyone. If you are in California you may also complain to the California Privacy Protection Agency.

We do not sell or share personal information as those words are defined in California law, so there is no "Do Not Sell or Share My Personal Information" link to give you. If that ever changes we will publish one before it does, not after.

7. Cookies, analytics and tracking

This site sets no cookies at all, runs no analytics, and loads nothing from a third party. The two typefaces are served from our own domain rather than a font CDN, precisely so that visiting this page tells nobody but us that you did.

Do Not Track. Because we do not track you across websites, there is nothing for a Do Not Track signal to switch off — but we treat one, and a Global Privacy Control signal, as an objection to any processing you are entitled to object to. No third party collects personally identifiable information about your activity across other sites through this one, over time or at all.

8. Changes to this policy

Any change is posted here with a new effective date and version number. If a change materially affects how we use information about you, we will email you at least 30 days before it takes effect, and where the law requires your consent we will ask for it rather than assume it.

The product launches in January 2027. At that point a fuller policy takes over, covering accounts, trips, bookings and payments — everything a travel platform does that a mailing list does not. We will email you before that happens.

9. Security

Information is encrypted in transit and at rest. Access is limited to the people who need it. Our sending key is held in a managed secret store rather than in configuration, and the list itself is not readable from the public internet.

No system is perfectly secure. If a breach affects your information and creates a real risk to you, we will tell you and the relevant regulator without unreasonable delay.

10. Children

Mecavoy is for adults and we do not knowingly collect information from anyone under 13. If you believe a child has subscribed, tell us at privacy@mecavoy.com and we will delete the record.