Privacy Policy — Pour Trail

1. Overview

Pour Trail ("we", "us") is a wine festival directory at pourtrail.com. This Privacy Policy explains what personal information we collect, how we use it, and the rights you have to control it. If anything is unclear, email us at [email protected].

2. Information We Collect

2.1 Information you provide

Account sign-in: When you sign in with Google or Apple, we receive your email address, display name, a stable provider user ID, and (for Google) a profile avatar URL. We never see your Google or Apple password.
Newsletter sign-up: Your email address if you subscribe to The Pour newsletter.
Contact form: Your name, email, and message when you contact us.
Festival submissions: Festival details you submit via our submission form. If you are signed in, we link the submission to your account.
Reviews (future): Ratings, text, photos, and visit dates if you leave a review on a festival page.

2.2 Information collected automatically

Usage data (analytics): If you consent to analytics, we collect pages visited, time on page, referring URL, device / browser type, and coarse geographic region via Google Analytics 4 and Google Tag Manager. See our Cookie Policy for the full list of cookies and how to opt out.
Authentication session: When you sign in we set a session cookie (pt_session) that is required for the site to remember you. This is a strictly-necessary cookie and is not used for tracking or advertising.
Security / abuse prevention: Cloudflare, our hosting provider, processes IP addresses and request metadata to protect the site against DDoS attacks, bots, and other abuse.

3. How We Use Your Information

To authenticate you and keep you signed in across pages.
To send you the newsletter you subscribed to.
To respond to your contact form or festival submission.
To display and moderate reviews you leave.
To understand aggregate usage patterns and improve the site (analytics — only with your consent).
To protect against abuse, spam, and fraudulent activity.

We do not sell or rent your personal information to anyone. We do not use your data for cross-site behavioral advertising.

4. Legal Basis (GDPR)

If you are in the EEA or UK, we rely on the following legal bases under the General Data Protection Regulation:

Consent — for analytics cookies, marketing cookies, and newsletter subscriptions. You can withdraw consent at any time from the link in the footer, or by unsubscribing from the newsletter.
Contract / service provision — for account sign-in, session cookies, and responding to your form submissions.
Legitimate interests — for basic site security, abuse prevention, and internal record-keeping.

5. Third-Party Services

The following third parties process data on our behalf:

Cloudflare — hosting, CDN, DDoS protection, and the D1 database where user accounts and festivals are stored. Cloudflare Privacy Policy.
Google (Sign In with Google, Google Analytics 4, Google Tag Manager) — authentication and (with your consent) analytics. Google Privacy Policy.
Apple (Sign in with Apple) — authentication. Apple may hide your real email from us via their Private Relay feature. Apple Privacy Policy.
Beehiiv — powers The Pour newsletter. When you subscribe, your email address is shared with Beehiiv. Beehiiv Privacy Policy.
Resend — sends transactional emails (account confirmations, contact form replies). Resend Privacy Policy.
Eventbrite and other ticket platforms — festival pages may link to Eventbrite. When you click those links you are subject to those platforms' own privacy policies.

6. International Data Transfers

Pour Trail is hosted on Cloudflare's global network, which processes data in the United States and other countries. By using the site you acknowledge that your data may be transferred to and stored in the US. Where required by law (e.g., EEA / UK), we rely on Standard Contractual Clauses with Cloudflare and other US-based processors.

7. Data Retention

Account data: Retained while your account is active and for 12 months after you stop using the site, unless you request earlier deletion.
Newsletter subscription: Retained until you unsubscribe.
Contact form submissions: Retained for up to 12 months.
Analytics data: Retained per our Google Analytics 4 configuration (default: 14 months).
Session cookies: Expire after 30 days of inactivity or when you sign out.

8. Your Rights

8.1 All visitors

Access / portability: Request a copy of the data we hold about you.
Correction: Ask us to correct inaccurate data.
Deletion: Ask us to delete your account and associated data.
Withdraw consent: Change your cookie preferences via the link in the footer.

8.2 California residents (CCPA / CPRA)

Right to know what personal information we collect.
Right to delete your personal information.
Right to correct inaccurate information.
Right to opt out of the "sale" or "sharing" of personal information. We do not sell data — see Do Not Sell or Share My Personal Information.
Right to limit use of sensitive personal information.
Right to non-discrimination for exercising these rights.

We honor the Global Privacy Control (GPC) signal as a valid opt-out of sale/sharing.

8.3 EEA / UK residents (GDPR / UK GDPR)

Right of access to your personal data.
Right to rectification.
Right to erasure ("right to be forgotten").
Right to restriction of processing.
Right to object to processing based on legitimate interests.
Right to data portability.
Right to lodge a complaint with your local supervisory authority if you believe we have mishandled your data.

To exercise any of these rights, email [email protected] from the address associated with your account. We respond within 30 days.

9. Security

We use HTTPS everywhere, scoped httpOnly cookies, rotating encrypted secrets, and Cloudflare's DDoS / WAF protection. No system is perfectly secure, but we take reasonable steps to protect your data.

10. Children's Privacy

Pour Trail is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make meaningful changes we revise the "Last updated" date above and, if required, re-prompt visitors for consent via the cookie banner.

12. Contact Us

Questions, requests, or concerns? Contact us at:

Email: [email protected]
Contact form: pourtrail.com/contact