Legal
Privacy Policy
Effective date: July 10, 2026
Last updated: July 10, 2026
Summary
This Policy explains how the Rodeo Finder website and progressive web app (the “Service”), operated under the name Rodeo Finder, handles information. We use account and planning data to provide requested features; ask for device location only when you choose it; review event submissions and correction reports; and rely on service providers to host, authenticate, map, and optionally deliver email. We do not currently operate product analytics, advertising pixels, or targeted-advertising integrations, and we do not sell personal information.
Information we handle and why
| Category and source | Examples and purposes | Current storage or exposure |
|---|---|---|
| Account and authentication | Name, email, user ID, provider, role, sign-in time, authentication tokens, and account metadata supplied by you, Supabase Auth, or Google when selected. Used to create, authenticate, recover, and secure accounts. | Supabase Auth and cookies; a signed 30-day HttpOnly app-session cookie; and a browser-local current-user copy. The signed app-session payload is not encrypted. |
| Planning and preferences | Saved event IDs, follows and frequencies, saved searches including typed location and radius, reminder settings, and notification records created by your use. Used for saved account features and requested preferences. | Signed-in state can sync to Supabase account_states. Optimistic or fallback copies can remain in localStorage on the device. |
| Optional communications | Alert or reminder preferences, recipient address, message content, status, timestamps, errors, and provider IDs. Used to record preferences and deliver already-queued email when enabled. | Supabase account state, localStorage fallback, and Resend only if email delivery is configured. Automatic matching is not part of the normal current runtime. |
| Submissions and reports | Authenticated event submissions can include event, location, source, notes, submitter, and contact fields. Correction reports may be anonymous and can include free text, proof URL, and optional contact. Used for admin review, verification, corrections, and abuse prevention. | Stored in Supabase review records and available to authorized admins. Only approved event facts may later be public; contact and review payloads are not intended to be public. |
| Location and map inputs | A city, region, or country that Vercel estimates from the request IP; browser-provided coordinates after a location-button click; typed city/region/postal search terms; radius; and public venue addresses or coordinates. Used to suggest a coarse search area, choose a nearby live area on the device, center maps, filter events, and publish venue locations. | An IP-derived suggestion is not separately saved merely because the homepage loads. Raw device coordinates remain in memory on the device and are not sent, placed in URLs, saved, or synced by Rodeo Finder. Typed or coarse location text can be in URLs and explicit saved searches. Venue coordinates can be stored and published separately. |
| Device and PWA data | Cookies, localStorage entries, service-worker cache entries, browser permissions, and install state. Used for sign-in continuity, preferences, optimistic behavior, and a limited app shell. | Stored in your browser or device until cleared, removed, or replaced. |
| Technical and operational data | Infrastructure providers may process public IP and request data, derive approximate geography, and create request, device, network, error, security, or abuse-prevention logs to deliver and protect the Service. Exact production fields and retention depend on provider configuration and are not defined by this repository. | Potentially processed by Vercel, Supabase, and configured infrastructure. |
| Public event and source data | Event facts, venues, coordinates, organizations, official links, attribution, and provenance from operator-supplied captured public pages and approved submissions. Used for discovery, verification, attribution, and corrections. | Published catalog, venue, source, calendar, and attribution information can be public and shared. |
Location and maps
On the homepage, Rodeo Finder may use a city, region, or country that Vercel estimates from your public IP address to suggest an approximate search area. This does not request browser device-location permission, can be wrong when you use a VPN, relay, proxy, or mobile network, and is not used to verify identity or eligibility. Rodeo Finder does not separately save that suggestion merely because the page loads. Vercel and other infrastructure providers may process network and request data as described under Technical and operational data.
Your browser or operating system may provide precise device coordinates only after you activate a “Use my location” or “Use my exact location” control. Rodeo Finder uses those coordinates in memory on your device to choose a nearby supported search area on the homepage or center the Discover map. In current code, raw device coordinates are not sent to Rodeo Finder servers, placed in URLs, saved or synced as a saved search, or otherwise persisted by Rodeo Finder. Your browser or operating system controls and may remember the permission. You can decline or revoke it and enter a location manually.
A submitted city, region, country, or postal search is approximate and different from raw device coordinates. Its text and radius can appear in the page URL, browser history, copied links, same-origin referrer information, and infrastructure logs and—only if you choose Save this search—localStorage and your synced account state. Public venue addresses are a separate flow: operator-run imports may send them to Geocodio or Geoapify when configured, then store and publish the returned venue coordinates.
Discover map tiles pass through a Rodeo Finder/Vercel proxy to OpenStreetMap. Event pages can load an OpenStreetMap iframe directly. Google receives a venue or destination request only if you click the Google Maps directions link.
Cookies, local storage, URLs, and PWA cache
- Supabase cookies support authentication and token continuity.
- The signed app-session cookie lasts up to 30 days and is HttpOnly, SameSite=Lax, and Secure in production. Signing out clears it and the browser current-user record.
- localStorage can contain the current-user copy plus saves, follows, searches, reminders, and notification data for optimistic or fallback behavior. Feature controls can remove individual entries; browser site-data controls can clear the rest.
- The PWA service worker caches the home app shell and navigation resources. It does not make saved event data or event detail pages reliably available offline. Clearing site data or uninstalling the PWA can remove device cache entries.
- Typed search terms in URLs may remain in browser history, copied links, and operational logs according to browser and provider settings.
Service providers and other recipients
- Vercel hosts and delivers the Service, may process and operationally log public IP and request data, and may derive approximate city, region, or country information from that request data.
- Supabase provides authentication, database, and account-state infrastructure.
- Google processes the sign-in interaction only when you select Google OAuth.
- OpenStreetMap provides map data, proxied tiles, and the direct event-page map iframe.
- Google Maps receives a request if you click a directions link.
- Geocodio and/or Geoapify receive public venue data only when configured for operator-run geocoding.
- Resend receives an email address and message content only if optional email delivery is enabled.
- Official, ticketing, calendar, and other external services receive information when you choose their links or downloads, subject to their own terms and policies.
Rodeo Finder may also disclose information to professional advisers, authorities, or transaction counterparties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business transaction, subject to applicable legal protections.
What may be public
Published event facts, venues, coordinates, source attribution, official links, and calendar-file details are public and shareable. Approved factual fields from a submission may later be published after review. Submitter or reporter email, contact preferences, free-text review material, and internal admin records are not intended for public display. Do not include confidential or unnecessary sensitive information in free-text fields.
Retention, deletion, and your choices
Rodeo Finder currently has no automated retention purge or fixed retention schedule. Account and planning state can remain in Supabase, local device storage, provider systems, logs, and backups until removed through an available feature, a verified manual request, provider controls, or an operational or legal process. Submissions and reports may be retained or anonymized for verification, provenance, correction history, abuse prevention, disputes, or legal obligations.
Sign-out is not account deletion: it clears the current app session and browser current-user record but does not remove the Supabase Auth account, account_states, submissions, reports, provider records, or all local feature state. There is no self-service account export or deletion workflow. You can remove individual saves, follows, and searches; adjust preferences; revoke location permission; clear browser site data; uninstall the PWA; or request account access, correction, closure, or deletion by email. A request may be verified, limited, retained, or denied where applicable law permits.
Analytics, advertising, and tracking signals
The current repository has no product analytics SDK, advertising pixel, behavioral tracking SDK, sale of personal information, or targeted-advertising sharing integration. Infrastructure providers may still create operational or security logs. Do Not Track and Global Privacy Control signals do not currently change Service behavior because the repository does not perform the sale, targeted-advertising sharing, or cross-site behavioral tracking those signals commonly address. Rodeo Finder will reassess and update this Policy and controls before enabling external analytics, advertising, or materially different tracking.
Security and cross-border processing
Rodeo Finder uses technical and organizational measures intended to protect information, including HTTPS expectations, restricted server credentials, database access policies, security headers, and signed session cookies. No system is completely secure, and the signed session payload and browser-local data should not be treated as encrypted storage. If an incident occurs, Rodeo Finder will respond and provide notices as required by applicable law.
Rodeo Finder and its providers may process information in the United States or other countries where they operate. Those places may have different privacy laws. Canadian users should understand that cross-border information may be accessible to courts, law enforcement, and authorities under local law. Provider and regional configurations must be confirmed before production expansion.
Your privacy rights
Depending on where you live, the information involved, and whether applicable law covers Rodeo Finder’s processing, you may have rights to confirm or access personal information, correct it, request deletion, receive a portable copy, withdraw consent for optional processing, object to or restrict processing, appeal a request decision, or use an authorized agent. Applicable law may also protect you from discriminatory treatment for exercising a covered right. These rights are conditional and exceptions may apply; this Policy does not claim that every listed right applies to every user.
To ask whether a right applies or submit a request, email the address below. Rodeo Finder may need to verify your identity and an agent’s authority. There is no automated request portal or promised fixed response period beyond what applicable law requires.
California notice
The categories described above may include identifiers and account information; internet or electronic activity; device or precise location when you affirmatively use the location control; approximate search location; communications and submitted content; and inferences represented by saved preferences. Sources, purposes, recipients, public exposure, and retention criteria are described in this Policy. Rodeo Finder does not claim that it meets the CCPA/CPRA definition or thresholds for a covered “business.” If a California or other state privacy law applies, covered rights and opt-out controls will be honored as required.
Canadian users
If Canadian privacy law applies, you may have rights to access and correct personal information, withdraw consent for optional uses subject to legal or contractual limits, and challenge compliance through the contact below. Essential account or security processing may still be necessary to provide an account. Optional alert consent and unsubscribe operations, launch geography, accountability, and applicable federal or provincial law must be confirmed before Canada-directed production communications.
Children's privacy
Rodeo Finder is a general-audience service and is not directed to children under 13. We do not knowingly seek personal information from children under 13. No technical age gate is currently implemented. If you are a parent or guardian and believe a child under 13 provided personal information, contact us to request review and deletion. The final age posture and any parental-consent process require operational and counsel review before child-directed use.
Changes to this policy
Rodeo Finder may update this Policy as the Service, providers, or law changes. The updated page will show a new date. Material changes will be announced through a prominent in-service notice and/or account email when appropriate. Where law requires consent for a new use or recipient, Rodeo Finder will seek it before beginning that processing; a page edit alone will not retroactively authorize a materially incompatible use.
Contact us
Rodeo Finder is the service and operator name used in this Policy. For privacy questions, concerns, access, correction, deletion, portability, consent withdrawal, appeal, authorized-agent, account-closure, or child-data requests, email privacy@rodeo.directory. A legal entity name, jurisdiction, and mailing address have not been stated because they have not yet been confirmed for publication.
Your use of the Service is also covered by the Terms of Service.