Privacy Policy

Welcome to Burritista (available at burritista.com and www.burritista.com). We are a community-driven guide dedicated to reviewing and rating burrito and Mexican food restaurants.

We respect your privacy and believe in being completely transparent about what data we collect, how we use it, and how we protect it. This Privacy Policy is written in plain English to help you understand our practices.

1. Information We Collect and How We Use It

We only collect the information necessary to provide and secure our website. You can browse Burritista entirely without an account. If you choose to interact with us, we may collect the following:

• User Accounts: Creating an account is optional. If you register, we collect your first name, last name, username, email address, and password. Your password is securely hashed (bcrypt); we never store or see your password in plain text. We use this information to maintain your account and allow you to log in.
• Session Tokens: When you log in, the site stores JWT (JSON Web Token) session tokens — an access token and a refresh token — in your browser's local storage. These tokens exist only to keep you signed in as you navigate the site. Logging out removes them.
• Community Reviews: When we enable the review feature, registered users can submit restaurant reviews, including star ratings, written text, and optional photos. This content is held for staff approval before being published on the site.
• Contact Form: If you reach out to us via our public contact form, we collect your name, email address, subject, and message. Each submission is stored in our database and copied to our staff by email so we can respond to your inquiry. Contact messages are never published on the site.
• Newsletter: If you sign up for our newsletter, we collect your email address. Your subscription only becomes active after you click the link in a confirmation email we send you (a "double opt-in"), so your address can only join the list through an action taken by the box's owner. Every newsletter email includes a working one-click unsubscribe link that takes effect immediately. We use your address only to send you the newsletter - never for anything else, and never to anyone else. We keep a record of your email, when you signed up, and when (if) you unsubscribed, so we can prove your consent and honor your removal. No account is required to subscribe, and nothing else about you is collected for the newsletter.

2. Analytics and Third-Party Services

We rely on a few trusted services to keep Burritista fast, secure, and functional. Here is exactly what they do and what data they might see:

• Plausible Analytics: We use a self-hosted instance of Plausible Community Edition to understand how many people visit our site and which pages are popular. Plausible is cookieless and privacy-friendly. However, it does store visitor IP addresses alongside page views to accurately count unique visitors. We do not use any third-party analytics or cross-site tracking.
• Cloudflare: Our site is fronted by Cloudflare, which acts as our Content Delivery Network (CDN) and Web Application Firewall (WAF). Cloudflare processes visitor IP addresses and other standard network traffic data to serve the website quickly and protect it from malicious attacks.
• Cloudflare Turnstile: To prevent bot abuse and spam, we use Cloudflare Turnstile on our registration, login, and contact forms. Turnstile verifies that you are a real human without invasive tracking.
• OpenStreetMap: Our map page displays its map using Leaflet, which loads map tiles from OpenStreetMap. Your browser sends standard requests (including your IP address) to OpenStreetMap's tile servers when you view the map. We do not use any GPS location tracking on our end.
• Google Geocoding: When staff add or update a restaurant, the site may send that restaurant's address to Google's Geocoding API (server-side, not from your browser) to obtain map coordinates. No information about you or your visits is sent to Google for this purpose.
• Email Sending: Outbound emails (staff notifications, account verification and reset links, newsletter confirmations, and the newsletter itself) are routed via the Cloudflare Email Sending API. The newsletter is opt-in only: your address is added after you click a confirmation link (double opt-in), every email includes a working one-click unsubscribe link honored immediately, and every email includes our mailing address as required by US law (CAN-SPAM). We never send promotional email to addresses that did not sign up for the newsletter.
• Hosting: Our site is securely hosted on a single United States-based cloud server provided by DigitalOcean, and all traffic is encrypted (TLS) via Let's Encrypt.

3. No Data Selling or Advertising

We have strict boundaries regarding your data. We do not sell your personal data. We do not share your information with data brokers. We do not display advertisements, and we do not participate in any ad-tracking networks.

4. Data Retention

We keep your information only as long as necessary:

• Account and Review Data: Retained for as long as your account exists. When you ask us to delete your account, we promptly delete your account and the data associated with it.
• Contact Form Messages: Retained for as long as necessary to respond to and follow up on your inquiry, after which they are deleted.
• Newsletter Subscriptions: Your email address is used only for as long as your subscription is active - clicking the unsubscribe link in any email removes you immediately. The minimal consent record (your email, signup date, and unsubscribe date if you leave) is kept afterward as evidence of your consent and removal, as required by applicable email law; it is not used for anything else.
• Analytics Data: Our self-hosted Plausible analytics events (including associated IP addresses) are retained for as long as necessary to understand how the site is used, after which they are deleted.

5. Your Rights

You have the right to access, correct, or delete the personal information we hold about you. You can update your email address, name, and password directly in your account settings. To leave the newsletter, use the unsubscribe link in any email we send you - it takes effect immediately, no request needed. If you wish to permanently delete your account, remove your published reviews, or exercise any other data rights, please email us at hello@burritista.com. We will promptly fulfill your request.

6. Children's Privacy

Burritista is intended for a general audience in the United States. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has provided us with personal information, please contact us immediately so we can delete it in compliance with the Children's Online Privacy Protection Act (COPPA).

7. Important Disclaimer

Reviews published on Burritista reflect individual opinions and are not a substitute for official health-department inspection results.

8. Changes to this Policy

We may update this Privacy Policy occasionally to reflect new features or legal requirements. The current effective date is always posted at the top of this page. If we make significant changes, we will notify registered users via email (if we have it on file) or post a prominent notice on the website.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: hello@burritista.com