Privacy policy

Pages load the Google tag, which sends page views and on-site events (for example, which tour you opened and whether you clicked through to Viator) to Google Analytics 4. It also reports a click through to Viator to Google Ads as an “outbound click”. Google sets its own cookies to do this. See how Google uses information from sites that use its services.

Pages also load the Meta Pixel, which reports page views and clicks through to Viator to Meta so that ads can be measured. Meta sets its own cookies.

You can block these with any content blocker, Google's Analytics opt-out add-on, or your ad settings at Google and Meta. The site works the same without them.

tt_sid is a random ID, not derived from anything about you. tt_attrrecords how your visit began: the page you landed on, the referring site's domain (for example google.com, never the full URL), and any campaign tags in the link (utm_ parameters or an ad click ID). Both last 30 days, are first-party, and are readable only by this site's server.

When you click through to Viator, we store one record containing that ID, the tour's product code, which button you used, the campaign details above and the time. We use it to learn which pages and campaigns lead to bookings. It contains no name, email, IP address or device fingerprint.

If you book, you do it on Viator and your booking is governed by Viator's privacy policy. As an affiliate we receive booking records so commissions can be paid. These include the product, travel date and our campaign tag, and we use them only for that accounting.

Our WhatsApp, iMessage, SMS and call links open your own app with an editable draft. If you choose to send it, the message reaches us through that app, not through this website, and the website never sees what you type. The phone, reservation and other buttons for listed restaurants and shops open that app or site directly, and what you send goes to them. We count only that a button was clicked.

This part is about people who post on Instagram, not visitors to this site. You never sign in here with Instagram or Facebook.

We may use third-party discovery services, currently including RecentReborn, to identify recent publicly available Instagram posts tagged at Tamarindo Beach, Playa Tamarindo, Playa Langosta and Playa Grande. RecentReborn is an independent service, not Meta and not an official Instagram API. A scheduled job on our server, hosted by Hostinger, receives each post's link, posting time, caption, hashtags, author name, whether it is a video, and a thumbnail link.

The job reads the caption, hashtags and account name only while processing the post, with fixed rules, and doesn't keep them, to set aside business promotions and old posts. It uses no AI and no face analysis, and makes no guess about anyone's age, gender or other characteristics. It labels the post, not the person.

For 30 days we keep only the post's link, its posting time, the source, which of our sites and which location found it, its label (for example “strong”, “maybe” or “business”) and whether it was sent to our team. We don't store captions, usernames or handles, photos, videos, thumbnails or the service's full response. After 30 days only a keyed one-way code made from the post's link remains, so we don't show the same post twice. At 90 days that is deleted too.

New useful post links go privately to a member of our team by iMessage (through Photon) and Telegram, with a short generic label such as “Beach/vacation post” and no usernames or captions. Our server's copies of those messages are deleted after 30 days. Messages already delivered stay with Apple and Photon and with Telegram, under their own storage, retention and deletion controls. We don't control those copies and can't guarantee their removal there.

A person opens each link on Instagram and may like the post or leave a normal public comment by hand from our Instagram account. Nothing in the system likes, comments on, follows, unfollows, saves or shares any post, or messages or contacts any poster. We don't use these posts to send direct messages or private sales offers.

To have our records of your posts deleted, send the post links in an Instagram message to @tamarindotours, the contact listed on our contact page. We'll delete the records and one-way codes we hold, remove those posts from our server's stored message copies, and confirm within 30 days.

The site is hosted on Vercel, which keeps short-lived server logs (including IP addresses) for security and operations under its own policy.

See the contact page. How we're paid is explained on the affiliate disclosure.