Privacy Policy

Welcome to Burritista (available at burritista.com and www.burritista.com). We are a community-driven guide dedicated to reviewing and rating burrito and Mexican food restaurants.

We respect your privacy and believe in being completely transparent about what data we collect, how we use it, and how we protect it. This Privacy Policy is written in plain English to help you understand our practices.

1. Information We Collect and How We Use It

We only collect the information necessary to provide and secure our website. You can browse Burritista entirely without an account. If you choose to interact with us, we may collect the following:

• User Accounts: Creating an account is optional. If you register, we collect your first name, last name, username, email address, and password. Your password is securely hashed (bcrypt); we never store or see your password in plain text. We use this information to maintain your account and allow you to log in.
• Session Tokens: When you log in, the site stores JWT (JSON Web Token) session tokens — an access token and a refresh token — in your browser's local storage. These tokens exist only to keep you signed in as you navigate the site. Logging out removes them.
• Community Reviews: When we enable the review feature, registered users can submit restaurant reviews, including star ratings, written text, and optional photos. This content is held for staff approval before being published on the site.
• Contact Form: If you reach out to us via our public contact form, we collect your name, email address, subject, and message. Each submission is stored in our database and copied to our staff by email so we can respond to your inquiry. Contact messages are never published on the site.

2. Analytics and Third-Party Services

We rely on a few trusted services to keep Burritista fast, secure, and functional. Here is exactly what they do and what data they might see:

• Plausible Analytics: We use a self-hosted instance of Plausible Community Edition to understand how many people visit our site and which pages are popular. Plausible is cookieless and privacy-friendly. However, it does store visitor IP addresses alongside page views to accurately count unique visitors. We do not use any third-party analytics or cross-site tracking.
• Cloudflare: Our site is fronted by Cloudflare, which acts as our Content Delivery Network (CDN) and Web Application Firewall (WAF). Cloudflare processes visitor IP addresses and other standard network traffic data to serve the website quickly and protect it from malicious attacks.
• Cloudflare Turnstile: To prevent bot abuse and spam, we use Cloudflare Turnstile on our registration, login, and contact forms. Turnstile verifies that you are a real human without invasive tracking.
• OpenStreetMap: Our map page displays its map using Leaflet, which loads map tiles from OpenStreetMap. Your browser sends standard requests (including your IP address) to OpenStreetMap's tile servers when you view the map. We do not use any GPS location tracking on our end.
• Google Geocoding: When staff add or update a restaurant, the site may send that restaurant's address to Google's Geocoding API (server-side, not from your browser) to obtain map coordinates. No information about you or your visits is sent to Google for this purpose.
• Email Sending: Outbound transactional emails (such as notifications to staff from the contact form, or approval/rejection notices for your reviews) are routed via the Cloudflare Email Sending API. We do not send marketing emails, we do not have a newsletter, and we do not maintain an email list.
• Hosting: Our site is securely hosted on a single United States-based cloud server provided by DigitalOcean, and all traffic is encrypted (TLS) via Let's Encrypt.

3. No Data Selling or Advertising

We have strict boundaries regarding your data. We do not sell your personal data. We do not share your information with data brokers. We do not display advertisements, and we do not participate in any ad-tracking networks.

4. Data Retention

We keep your information only as long as necessary:

• Account and Review Data: Retained for as long as your account exists. When you ask us to delete your account, we promptly delete your account and the data associated with it.
• Contact Form Messages: Retained for as long as necessary to respond to and follow up on your inquiry, after which they are deleted.
• Analytics Data: Our self-hosted Plausible analytics events (including associated IP addresses) are retained for as long as necessary to understand how the site is used, after which they are deleted.

5. Your Rights

You have the right to access, correct, or delete the personal information we hold about you. You can update your email address, name, and password directly in your account settings. If you wish to permanently delete your account, remove your published reviews, or exercise any other data rights, please email us at hello@burritista.com. We will promptly fulfill your request.

6. Children's Privacy

Burritista is intended for a general audience in the United States. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has provided us with personal information, please contact us immediately so we can delete it in compliance with the Children's Online Privacy Protection Act (COPPA).

7. Important Disclaimer

Reviews published on Burritista reflect individual opinions and are not a substitute for official health-department inspection results.

8. Changes to this Policy

We may update this Privacy Policy occasionally to reflect new features or legal requirements. The current effective date is always posted at the top of this page. If we make significant changes, we will notify registered users via email (if we have it on file) or post a prominent notice on the website.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: hello@burritista.com