Privacy policy
Last updated October 11, 2026
This policy explains what WikiTacos collects and why. We collect only what the site needs to work. We do not sell or share your personal information for advertising.
Reading the site
You can read the site without an account. The site is hosted by Cloudflare, which processes standard request information such as IP address and browser type to deliver pages and protect against attacks. WikiTacos does not run advertising trackers or analytics scripts on the site.
Accounts
Sign-in uses Google Firebase Authentication. When you sign in with Google or email we receive your account ID, email address and whether the email is verified. Your email is never shown publicly. You choose a public display name, which appears with your reviews and public check-ins. Your sign-in session is kept in your browser’s local storage until you sign out.
What we store for signed-in members
- Reviews and ratings you submit, and their moderation status.
- Shops you mark “I’ve been here.” This list is private to your account.
- Taco tours you save.
- Receipt check-ins: the receipt image is stored privately, is visible only to moderators and is scheduled for deletion after 30 days. We keep the decision, the purchase date and a one-way fingerprint of the receipt to prevent the same receipt from earning points twice. See community privacy and points.
- Shop claims: the name, role and phone number you give, plus your account email, so we can verify ownership.
Contact form and apparel list
Messages store your name, email, optional organization, topic and message so we can reply. The apparel list stores your name and email to send one notice when the shop opens. To limit abuse, we count submissions per day using a one-way fingerprint of your IP address; those counters are deleted after a few days.
Maps, location and videos
Map images load from OpenStreetMap’s tile servers, which receive your IP address and the map area you view. “Use my location” asks your browser for permission; your location is used in your browser to center the map and is not sent to WikiTacos. Directions open in Google Maps under Google’s terms. YouTube videos load from YouTube only after you choose to play one, using YouTube’s privacy-enhanced mode.
Cookies and browser storage
WikiTacos does not set advertising or tracking cookies. The site uses your browser’s local storage for your sign-in session and for conveniences such as your last map region and current tour. Cloudflare may set strictly necessary security cookies.
Who processes data for us
Google (Firebase Authentication), Cloudflare (hosting, database and private file storage) and OpenStreetMap (map tiles). Each processes data under its own terms.
Your choices and rights
You can change your display name, hide public check-ins, remove visited marks and delete saved tours from My account. To request a copy of your data, a correction or deletion of your account, use the contact form with the topic “Privacy or account request.” We will verify the request comes from the account holder before acting. Depending on where you live, including California, you may have additional rights to know, correct and delete personal information and to not be discriminated against for using them.
Children
The site is not directed to children under 13, and we do not knowingly collect personal information from them.
Security and retention
We use encrypted connections, verified sign-in tokens, private storage for receipts and moderator-only access to submissions. We keep account and community records while your account is active and as needed to run points and prevent abuse.
Changes
We will update this page when our practices change. The date at the top shows the latest version.