Never miss a Portland food week.

1. Using the Service without an account

Most of the Service functions without an account. Browsing menus and maps, marking dishes of interest, planning a route, recording a score out of ten, and scoring a visit to a passport venue all operate without one. Those selections are held in your own browser's local storage on your own device. They are not transmitted to us and are not accessible to us or to anyone else. If you subsequently create an account, they are copied into it.

A passport visit scored without an account holds only scores, a visit date and choices from fixed lists, never written text. It becomes a passport stamp only once it has been copied into an account.

2. Information collected with an account

We collect and store:

• Your email address, which is used to authenticate you and to contact you about your account. The Service holds no passwords; authentication is by one-time code sent to that address.
• A display name of your choosing, which defaults to "New taster" and may be changed at any time.
• Your activity on the Service, comprising the scores you record, any tasting notes you write, the dishes you mark, the venues you mark for a return visit, your personal ranking order, and any routes you plan.
• Your passport stamps, comprising, for each venue you stamp, every visit you record there: the date of the visit if you give one, your scores, your answer as to the food available, what you drank and ate, any descriptive tags you select, and any note you write about it; for a bonus venue with no taproom, café or other public premises of its own, where you had it and how it was served in place of the food answer and tags; and which of the venue's locations you visited if you record them.
• Your passports and starred places: which passports you have added to your profile (a passport is added when you add it yourself or when you first score a venue in it), and the passport venues you have starred as places you want to go.
• Passport sharing: whether you have shared a passport, and the link and code that share uses.
• Corrections you send from a venue's page, together with the account that sent them. They are read only by us, in order to correct the listing, and are never published.

3. Purposes and legal basis

Information is processed only to operate the Service: to authenticate you, to store and display your own activity back to you, to compile the aggregate charts and the totals shown for passport venues, to display content you have elected to make public, to act on corrections you send, and to send the notifications you have requested. It is not used for profiling, advertising, or automated decision-making affecting you.

As the operator, we can see what you store, including notes you keep private, and use it only to run and moderate the Service, for example to remove a note that breaks the rules. We never make public anything you have kept private.

4. What other users can see

By default, nothing. A new account is private, and your scores, notes, marked dishes and passport stamps are visible only to you.

Enabling Share my picks in your profile makes your display name, your scores, and your tasting notes visible to others. Content made public in this way may appear on the chart, on an individual dish's page, on the home screen while an event is running, and, for passport stamps, on a venue's page and its passport's page. For a passport stamp, what is made public is the latest finished visit: its scores, your answer as to the food available, what you drank and ate, and your note, once the stamp is complete. Your earlier visits to the same venue are never shown to anyone else. Those pages are accessible to anyone and may be indexed by search engines. You should not include anything in a note that you would not wish a stranger, or the venue itself, to read. The setting may be disabled at any time, which removes your scores and notes from those pages prospectively.

Whatever that setting, your scores contribute to chart positions, and your complete passport stamps, including the tags you select on them, contribute to the number of stamps and the tags shown for each passport venue and, where the visit is dated, to that passport's chart (a bonus stamp for a venue with no public premises of its own never does). These are aggregate figures and do not identify you.

Your email address is never displayed to other users, irrespective of that setting. Planned routes and marked return visits remain private in all cases, as do the passports you have added, the venues you have starred, the date of a passport visit, the locations you record for it, and, for a bonus stamp, where you had it and how it was served. The tags you select are shown only in those aggregate figures, never with your name.

If you share a list of marked dishes by link or code, the recipients can see the dishes on that list. Revoking the share withdraws it from everyone it was sent to, including recipients who had saved it.

If you share a passport by link or code, anyone who has it can see your display name, your level, and which venues you have stamped, whatever your Share my picks setting. They cannot see your scores, notes, visit dates, locations or tags. Stopping sharing disables the link and the code at once.

5. Notifications, on request only

You may opt in to push notifications or email reminders concerning menu publication, the start of an event, and its final day, and, separately, to Passport News: when a new passport launches, and occasional news of each passport you choose to follow. Push notifications require storing an anonymous endpoint identifying your browser together with the keys necessary to encrypt a message to it. Email reminders require your email address. Each subscription records which of these kinds of message you have chosen. All are disabled unless enabled by you, all may be changed or disabled in Settings, and every email carries an unsubscribe link for its own kind of message. Disabling push or email entirely deletes the associated record.

6. Analytics

The Service uses Vercel Analytics to count page views. It sets no cookies, constructs no profile of you, and does not track you across other websites. It reports that a page was viewed, the approximate region, and the category of device. It cannot report that you viewed it.

There are no advertising trackers, no social media pixels, no Google Analytics, and no third-party cookies on the Service.

7. Processors and third parties

Three providers process information on our behalf, each for a single purpose, and none is permitted to use it for its own:

• Supabase, which hosts the database and provides authentication.
• Vercel, which hosts the Service and provides the analytics described above.
• Brevo, which delivers sign-in codes and reminder emails.

Photographs of dishes are obtained from the publications operating each event, and photographs of passport venues principally from the venues' own websites. All are stored on our own infrastructure. Maps are rendered using OpenStreetMap data. Voluntary contributions are handled by Ko-fi, which processes the payment; we do not receive or store card details or any record of a payment.

No personal information is sold. None is disclosed to any venue. None is provided to data brokers. We may disclose information where required to do so by law.

8. Retention and deletion

You may delete your account at any time from Profile, then Delete account. Deletion removes your scores, notes, rankings, marked dishes, return visits, planned routes, passport stamps and every visit on them, the passports you have added and the venues you have starred, corrections you have sent, shared lists and passports, follows, notification records, and the login itself. It is immediate and irreversible. There is no grace period and no archived copy is retained.

One exception applies by design: a route you were invited to but do not own remains with its owner, less anything you contributed to it. Your name is removed from it.

Encrypted database backups are retained for disaster recovery and expire on a rolling schedule. A deleted account may persist in a backup until those expire. Deleted accounts are not restored from backups.

9. Children

The Service is not directed to children under 13 and we do not knowingly collect information from them. If you believe a child has created an account, please contact us and it will be deleted.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed. No change will make information you have already provided visible to anyone it was not visible to before without your consent.

11. Requests and contact

Requests to access, correct or delete the information held about you, and any question concerning this policy, may be sent to hello@pdxfoodweeks.app. Requests are read and answered by a person.