My Fantasy Fest

Privacy & browser storage

Last updated: October 11, 2026. My Fantasy Fest is an independent attendee-built guide, not the official festival website.

What we store

When you sign in, we use your email to verify access and send a requested sign-in link or code. Supabase stores your account, display name, saved event choices and ticket checklist, restaurant votes, dish tips and reports. Your event list is private to your account. Infrastructure administrators may need restricted access for support, security or restoration; we do not offer a public itinerary directory.

What other attendees see

Your dish tips and chosen display name are visible to other signed-in attendees. Your email is not displayed. Restaurant vote totals are shared without identifying individual voters. Do not post private contact details, sensitive information about other people, or information you do not have permission to share.

Hosting and service providers

Cloudflare hosts the site and its server endpoints. Supabase provides authentication and database storage. MXroute delivers requested account emails. These services may process request metadata such as IP addresses, timestamps and security logs. Data may be processed in the regions used by these providers. We do not sell account data or use it to subscribe you to marketing.

Cookies and browser storage

Essential session cookies keep you signed in. They are not advertising cookies. The browser also remembers your theme, selected day, welcome dismissal and recent event-list scroll position. Cloudflare Turnstile checks sign-in requests for bots and may process browser and request information for abuse prevention. There are no advertising trackers or analytics integrations in this version. You can clear browser storage or sign out; clearing browser data does not delete an account list stored on the server.

Location

Location is optional and requested only when you choose the nearby feature. The map uses coordinates in the browser to show nearby places; this app does not upload those coordinates to its account database. You can deny or revoke location permission in your browser.

Older saved lists and links

You may explicitly import an older device-only list after signing in. Older shared-list URLs contain readable itinerary data in the URL fragment; anyone with such a link can decode it. They are not encrypted or revocable. Account lists are not published through those links.

Your controls and retention

You can edit your display name, remove saves/votes/tips, sign out, or permanently delete your account from Account. Account information and saved content remain until you remove them or delete your account. Account deletion removes associated live profiles, saves, votes, tips and reports. Moderation audit records may remain, with a deleted administrator’s account reference removed. Abuse-prevention counters use hashed identifiers; expired counters are cleaned up when the next rate-limited action runs. Application request logging is disabled. Cloudflare, Supabase and MXroute may separately retain operational/security records under their own policies; deleting your account does not instantly erase provider records, received emails or third-party copies. No deletion of screenshots can be guaranteed.

Contact and requests

Use the Contact & corrections page for privacy questions or assistance. This guide is intended for adults; do not create an account if you are under 18.