Snack Quest Privacy Policy

The short version

We built Snack Quest so you could plan your snack adventures without making yet another account. We don't ask for your name, email or password, and we collect as little as we can to keep the site running. This page explains, in plain language, what information is involved when you use Snack Quest at snackquestguide.com and any other domain we use for Snack Quest that links to this policy, and what you can do about it.

When we say "we," "us" or "Snack Quest," we mean Snack Quest, which is operated by an individual. We're responsible for the information described here. You can reach us at [email protected].

Snack Quest is an unofficial fan guide. We're not affiliated with or endorsed by Universal. This policy covers only Snack Quest, not Universal's websites or apps.

What we don't collect

• No accounts. There's no sign-up, login or password.
• No names, emails or phone numbers through the site itself. (If you email us, see "When you email us" below.)
• No analytics or tracking tools. We don't run Google Analytics, Cloudflare Web Analytics or similar tools on the site. Our fonts are hosted on our own site, so loading a page doesn't contact Google or other font services.
• No cookies set by Snack Quest. Our own code doesn't set any cookies.

Your Wish List lives on your device

When you tick an item, your Wish List is saved in your browser's local storage, on your own device. It isn't sent to us unless you choose to share it (see the next section).

To make the site work smoothly, your browser also stores:

• the ID of the shared list you're currently using on this device (one you created or opened from a link), and a copy of it,
• whether the Wish List panel is open or closed, and
• up-to-date details for the items on your list, so they display quickly.

We also use your browser's session storage to remember which parks you've expanded in the sidebar. That's cleared when you close the tab.

We can't see what's in your browser's storage. The only part that ever reaches us is the content of a shared list, when you share or edit it.

You can delete all of this at any time by clearing your browser's site data for Snack Quest, or by using the Clear button on your Wish List. Clearing an unshared Wish List can't be undone, and we can't recover it.

When you share a list

If you tap Save / Share my list, we save a copy of your list in our database (Cloudflare D1) under a long, random ID, and give you a link that contains that ID.

What's stored for a shared list:

• the menu items on it (our item IDs plus a snapshot of each item's menu details, like name, price, description, park, land, restaurant, menu and section),
• when each item was added,
• a version number (so edits from different people don't overwrite each other), and
• when the list was created, last changed and last opened (so we know when it's gone unused for 12 months).

We don't store your name, email or IP address with a shared list, and we don't link lists to people.

Anyone with the link can view and edit the list. Treat the link like a key: share it only with people you trust, and remember that anyone it's forwarded to can see and change it too. Shared lists aren't private or confidential. Don't put anything in a list that you wouldn't want others to see, and be careful where you post the link. If someone has changed a list in a way you didn't want, or added something offensive, email us the link and we'll look at it.

How long shared lists last: a shared list is deleted automatically if nobody opens it for 12 months. Clearing a shared list removes its items, but the (empty) list stays until it's deleted. There's no delete button, so if you'd like a shared list deleted sooner, email us at [email protected] with the link and we'll remove it. Because anyone with the link can already change the list, we treat having the link as enough to ask for deletion. We won't ask for ID. We aim to delete it within 7 days.

We don't make our own backups. Cloudflare, our database provider, automatically keeps recovery history of the database for up to 30 days (7 days on Cloudflare's free plan), after which deleted lists are gone for good. We'd use that history only to recover from a technical failure, and if we ever did, we'd delete again any list that had been deleted.

Keeping the site safe from abuse (rate limiting)

To stop bots from flooding our sharing feature, we limit how often lists can be created (30 per hour) and edited (300 every 10 minutes) from the same network address.

To do this, we don't store your IP address. Instead, when you create or edit a shared list, we turn your IP address (or, for IPv6, the first half of it, which identifies your network rather than your device) into a shortened, one-way code: a salted, truncated SHA-256 hash, made using a secret value (the "salt") that only we know and that isn't stored with the codes. This makes the code much harder to link back to an IP address, but it isn't anonymous: it still relates to your network connection, so we treat it as personal information. We store that code with a counter and the time window it applies to. Counters expire at the end of their window (one hour for creating lists, 10 minutes for edits), and expired counters are cleared out automatically during normal site activity and by a daily cleanup job. We use these codes only to enforce the limits. We don't use them to track you or combine them with anything else.

This only happens when you create or edit a shared list. Just browsing menus doesn't create a counter.

When you email us

If you email us at [email protected], we'll receive your email address, your name if it's in your email, and whatever you write. We use it only to reply, fix corrections and consider your snack tips. Our inbox is hosted by Google (Gmail). We delete ordinary emails (questions, corrections, tips) within 12 months after our conversation ends. We keep emails about privacy or deletion requests for 24 months, so we have a record that we handled them. Please don't send us sensitive information, and if you're under 13, please don't email us.

How we use information

We use the information described on this page only to:

• run the site and show you menus and your Wish List,
• save, show and sync shared lists,
• protect the site from spam and abuse, and
• answer your emails.

We don't sell your information or share it for targeted advertising, and we don't build profiles about you.

Where information is stored

• On your device: your Wish List and display settings (local and session storage).
• With Cloudflare: the site is hosted on Cloudflare Pages, and shared lists and rate-limit counters are stored in a Cloudflare D1 database whose primary location is in eastern North America. Cloudflare runs a global network, so requests may be handled in data centers outside your country.
• With Google: our email inbox (Gmail).

Snack Quest is run from the United States, so information we handle is processed in the US.

Companies that help us run Snack Quest

Cloudflare (hosting). Cloudflare hosts the site, our fonts and our database. Like any web host, Cloudflare processes request data, such as your IP address, browser type and the pages you request, to deliver the site, keep it secure and keep logs. Cloudflare may also ask your browser to report network errors to it. See Cloudflare's Privacy Policy.

Google (email). Gmail hosts our inbox. See Google's Privacy Policy.

We may also share information if the law requires it, or to protect the safety of our visitors or the site. If Snack Quest is ever transferred to someone else (for example, to a company formed to run it), the information described here would go with it, and this policy would continue to apply to it.

Ads and affiliate links

Snack Quest is free, and we plan to keep it that way with ads and affiliate links. Neither is live yet. We'll update this page before they launch.

Cookies and local storage

• Local storage (on your device): your Wish List, the ID of the list you're using, whether the panel is open, and saved item details. Needed for the Wish List to work.
• Session storage (on your device): which parks you've expanded in the sidebar. Cleared when you close the tab.
• Cookies: Snack Quest doesn't set any cookies.

You can clear local storage, session storage and cookies in your browser settings at any time. Clearing them will erase a Wish List that hasn't been shared.

Do Not Track. Browsers' "Do Not Track" setting has no agreed meaning, so we don't respond to it. We do honor Global Privacy Control (see "Your choices and rights"). Snack Quest doesn't track you across sites at all.

Your choices and rights

Because we don't have accounts and don't link information to people, we usually hold very little that can identify you. You can still:

• clear your Wish List and browser storage at any time,
• choose not to share a list,
• ask us to delete a shared list at any time (send us the link; lists nobody opens for 12 months are deleted automatically), and
• ask us to delete emails you've sent us.

Global Privacy Control (GPC). We honor GPC signals from every visitor, wherever you live. We treat a GPC signal from your browser as a request to opt out of the sale or sharing of your personal information and of targeted advertising, for that browser. Snack Quest doesn't sell or share personal information or show targeted ads, so today there's nothing for the signal to switch off, and the site works the same with or without it. Because we don't have accounts, we can't apply your choice to other browsers or devices. To turn on GPC, use a browser or extension that supports it (see globalprivacycontrol.org).

EEA and UK visitors. You may have the right to access, correct, delete or move your personal data, to object to or restrict how we use it, and to complain to your local data protection authority. We rely on our legitimate interests to run and secure the site (hosting and rate limiting), and on providing the service you asked for (shared lists you ask us to create, and replying to your emails).

California, New Jersey and other US states. Depending on where you live, you may have the right to know what personal information we collect, to access or delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information or targeted advertising. We don't sell personal information or share it for targeted advertising, and we honor Global Privacy Control as described above. We won't treat you differently for using your rights. We offer these rights to everyone, whether or not your state's law applies to a site our size.

To make a request, email us at [email protected]. Since we don't have accounts, we may need details (like a shared list link) to find the information you're asking about. We'll reply within 45 days (we may extend once by another 45 days if needed and will tell you why). You can use an authorized agent; we may ask for proof that they're allowed to act for you. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. We'll answer within 45 days, and if we still decline, we'll tell you how to contact your state attorney general (in New Jersey, the Division of Consumer Affairs).

Children

Snack Quest is a general-audience site and isn't directed to children under 13. We don't knowingly collect personal information from children under 13. If you believe a child has sent us personal information (for example, by email), contact us and we'll delete it.

How long we keep information

• Wish List on your device: until you clear it or your browser's site data.
• Shared lists: deleted automatically after 12 months without being opened, or sooner if you email us the link and ask us to delete it.
• Rate-limit counters: they expire after one hour (list creation) or 10 minutes (edits) and are then cleared out automatically.
• Emails: deleted within 12 months after our conversation ends. Privacy and deletion requests are kept for 24 months as a record.
• Hosting logs: kept by Cloudflare under its own policies.

Keeping information secure

The site is served over HTTPS. Shared list IDs are long and randomly generated so they can't realistically be guessed, and we limit how often lists can be created and edited. But no website is perfectly secure, and anyone who has a list's link can view and change it, so treat shared lists as public to anyone who has the link.

Changes to this policy

We'll update this page when our practices change, including before ads or affiliate links go live. We'll change the "Last updated" date at the top, and for significant changes we'll add a notice on the site for at least 30 days. We won't use information we already have in a materially different way without telling you first, and where the law requires it, asking you.

Contact us

Questions about your privacy, or a request to delete a shared list? Email us at [email protected]. To report a shared list that's been vandalized or contains something offensive or infringing, send us the link with "Report list" in the subject.