Effective 9 September 2026.
Operator and contact
HostelPunk is operated by Ivan Fediunin, an individual based in Santiago, Chile. Email hostelpunk.com@gmail.com for privacy requests. OpenAI and external booking providers have their own privacy policies.
ChatGPT searches
No HostelPunk account is required. We receive the tool arguments ChatGPT sends, such as destinations, hostel identifiers, filters and search words, to answer your request. Do not include sensitive personal information. We do not request your full conversation, password, payment details or identity documents.
Detailed analytics retain structured filters and identifiers, compact result evidence, scores, counts, timings, error categories and response sizes for 90 days. They exclude arbitrary search text, keyword hashes and complete response copies. Results contain derived summaries and aggregates, without raw reviews, reviewer identities or photos.
When OpenAI supplies a pseudonymous user identifier, we convert it to a monthly keyed hash for daily and monthly user counts. We do not retain the original identifier or link these counts to individual queries, website visitors or accounts. Monthly membership records expire seven days after month-end; aggregate counts remain for 13 months. Pseudonymous information is not necessarily anonymous.
Plugin links use a shared source marker. Common boolean cookies remember attribution for 30 minutes of inactivity and privacy mode for the browser session. These journeys count page views and booking clicks without visitor fingerprinting or account tracking.
Website analytics and cookies
We and our delivery providers receive page addresses, referrers, browser and network information to serve pages and investigate errors or abuse. Outside protected plugin journeys, optional analytics use hp_anon_session, a first-party cookie with a 365-day lifetime whose stored identifier is hashed. Events include pages, searches, navigation, shares, outbound clicks, performance and errors. Signed-in activity may be associated with your account.
Optional browser profiling includes browser/device characteristics, screen dimensions, language, time zone, storage and automation signals, and hashes of canvas, fonts and plugin information. Hashing does not make this anonymous. The separate native website companion app can send an installation identifier and version.
Scheduled daily cleanup removes website events, visits and share-arrival details after 90 days. Inactive visitor and app-installation identifiers expire after 90 days without activity. Historical acquisition details and browser profiles on visitor records older than 90 days are cleared daily. Shared links remain usable after their creator associations expire. Website aggregate counts remain for 13 months. Cleanup failures may delay deletion.
Accounts, messages and providers
We use information to operate the service, maintain optional accounts, respond to messages, prevent abuse and understand use. Account information is retained while the account is maintained. Support and feedback messages are retained to handle the request and its follow-up; they do not have automatic 90-day deletion. Contact us to request deletion. Avoid sending sensitive documents.
Hosting, database, security, email and notification providers process information for these purposes. Cloudflare provides website delivery and security; Resend delivers optional account emails. Providers may process data outside Chile. OpenAI receives tool results, and an external booking site receives your browser request when you follow its link.
Origin access logs rotate daily with 14 rotated files retained. Database cleanup does not immediately erase backups, provider logs or email copies; those systems have separate retention and we do not promise a fixed deletion deadline for all copies. Contact us for information about a specific request.
Your choices
Use analytics preferences to turn off optional website analytics. We honor Global Privacy Control and Do Not Track when received. Basic operational request counts and necessary security logging remain. The preference cookie lasts one year. Browser preferences do not propagate into ChatGPT or delete previous records. Disconnect HostelPunk in ChatGPT to stop future tool calls; clearing cookies does not delete server records.
You may have rights to access, correction, deletion, restriction, objection or a complaint to a supervisory authority under applicable law. Email us with an approximate date and relevant page link; we may need proportionate verification. Accountless activity may not be identifiable from your name or email. We update the effective date when this policy changes.