Privacy

You can use this app — browse restaurants, save favorites, plan meals, RSVP to other people's plans — without giving us any personal information. Email is purely optional. We never sell or share what we collect.

If you want everything you create to follow you across devices, you can add an email and we'll send a personal portal link. You can delete your data at any time.

The first time you visit the site, our server quietly issues a long-lived cookie called attendee_token. That cookie is just a random ID — it doesn't contain anything about you. Once you do something that needs persistence (favoriting a restaurant, creating a plan, RSVP'ing), we create a row in our database tied to that ID.

We record:

• Restaurants you favorite
• Dinner plans you create or RSVP to (with the first name you supply)
• The date of your last visit, so we can clean up inactive accounts

We do not record IP addresses, device fingerprints, or browsing history beyond the actions above.

Adding an email — through the homepage CTA, the "Add an email" card on your account page, or pre-registration — lets us:

• Send you your personal portal link so your favorites and plans follow you across devices.
• Send you up to three optional pre-convention emails about new partner restaurants, with your link, in the weeks before July 3-5.
• If you opt in, send one post-convention email with one-click review links for the spots you visited.

Both email opt-ins are toggleable on /my-account. Setting them to off stops emails immediately.

When you RSVP to a dinner plan, the plan's public page shows your first name and your guest count to anyone with the share link. Your email is never shown to other attendees, even on plans you create.

Plan share pages (/plans/<token>) are public — anyone with the link can view and RSVP. Don't share a plan link more widely than you're comfortable with.

Convention recruiters can see attendee data inside the admin portal: emails where given, registration source, regions, days attending, favorite counts, and dinner-plan participation. They use this to plan partner outreach, capacity, and follow-up. Recruiters do not share this data outside the convention team.

We use a small set of providers to run the app. Each one only sees the data it needs to do its job:

• Vercel hosts the website. Standard request logs (URL, time) apply.
• Neon stores our database. Your favorites, plans, and emails live there.
• Resend delivers transactional emails (welcome, recovery, list-share, plan-share, pre-convention updates). They see only the email address and message content of mails we send to you.
• OpenStreetMap (Nominatim) geocodes restaurant addresses for the map. We never send personal data — only public restaurant addresses.

We don't use any third-party analytics, ad networks, or tracking pixels.

We set one functional cookie (attendee_token) that ties your browser to your account. It lasts a year and is HttpOnly + SameSite=Lax. We don't use marketing or analytics cookies.

Recruiter accounts (used by the convention team) get a separate session cookie from our auth provider while signed in.

Go to /my-account and tap Delete my data. This permanently removes:

• Your account and email
• Your favorites
• Your RSVPs

Plans you created stay online — so people who already RSVP'd don't lose their spot — but your name is replaced with "A convention attendee". If you want a plan deleted entirely, message the convention team and we'll handle it manually.

The app is for convention attendees and isn't intended for anyone under 13. We don't knowingly collect data from children.

If we make material changes to how data is handled, we'll update the date at the top and (for anyone who's given us an email) send a heads-up before the change takes effect.

Email infovolservices@albanyconvention.org with privacy questions. We'll get back to you.