Privacy Policy
Last updated 5 September 2026
The short version
My Burrito Finder has no accounts, no cookies, no analytics, no advertising and no tracking of any kind. It has no server-side code and no database, so there is nowhere for it to keep anything about you.
One thing is saved, and it is saved in your own browser rather than sent anywhere: the last area you searched, so you do not have to retype it. Your location is only ever used if you grant permission, and only for the length of your visit.
The site does have to ask other organisations for maps and place data, and those requests necessarily reveal your IP address and what you searched for. Every one of them is listed below.
Who runs this site
My Burrito Finder is a personal, non-commercial project operated by Andrew Hughes in Oregon, United States. It is not currently a business, sells nothing, and earns no revenue. If that ever changes, the site will be operated by Humanely Coded, and this policy will be updated to say so before any commercial activity begins.
Questions about this policy, or about privacy on this site, can go to privacy@humanelycoded.com.
What this site stores on your device
One value, in your browser's localStorage:
| Name | What it holds | Why | How long |
|---|---|---|---|
mbf.area |
The last area you typed, such as “Portland, OR” | So the search box is already filled in next time | Until you clear it |
This never leaves your browser. It is not transmitted to this site or to anyone else, and it is readable only by this site on this device. You can remove it at any time by clearing site data for myburritofinder.com in your browser settings, and the site will work exactly as before.
No cookies are set by this site, for any purpose, including analytics and advertising. There is no session storage and no other browser storage in use.
Your location
When the page loads, it asks your browser for your location using the standard Geolocation API. Your browser will ask your permission first, and refusing costs you nothing — the site works normally, and you can simply type an area instead.
If you do grant permission, your coordinates are used to:
- centre the map on you and mark where you are;
- search for burrito places near you;
- draw a driving route from you to a place you choose;
- bias search suggestions toward places near you.
Your coordinates are held in your browser's memory for the length of the visit and are discarded when you close the tab. They are not written to storage and are not sent to this site — there is no server here to send them to. They are sent to the map and place services listed in the next section, because finding somewhere near you necessarily means telling something where you are.
You can withdraw permission at any time in your browser's site settings for myburritofinder.com.
What your browser sends to other services
This site is assembled in your browser from several independent services. Your browser contacts each of them directly, so each one can see your IP address, the approximate time of your request, and whatever that particular service is being asked for. None of them receive a name, an email address, or an account, because the site never asks you for any.
| Service | Operated by | Receives | Their policy |
|---|---|---|---|
| Map tiles | OpenStreetMap Foundation | Your IP address and which map squares you view, which reveals roughly where you are looking | Policy |
| Place search (Overpass) | Overpass API community servers | Your IP address and the coordinates you are searching around | Site |
| Search suggestions (Photon) | komoot GmbH | Your IP address and what you type in the search box, as you type it | Policy |
| Driving routes (OSRM) | FOSSGIS e.V. | Your IP address, and the start and end coordinates of a route — only when you ask for one | Policy |
| Map software (Leaflet) | unpkg, served by Cloudflare | Your IP address, when the map library file is downloaded | Policy |
| Web font | Your IP address, when the font file is downloaded | Policy | |
| Web hosting | HostGator | Standard server log entries: IP address, time, page requested, browser version | Policy |
These services are used to deliver the site, not to profile you. This site does not send them any identifier of its own, and does not receive anything back about you from them. What each service does with the request is governed by its own policy, linked above.
What this site does not do
- It does not create accounts or ask for a name, email address or phone number.
- It does not set cookies or use any advertising or analytics tool.
- It does not build a profile of you or track you between visits or across sites.
- It does not sell or share personal data. There is no personal data to sell, and none ever will be sold.
- It does not use your data to train machine learning models.
- It does not keep server-side records of searches, because it has no server-side code.
Your privacy rights
Laws including the Oregon Consumer Privacy Act, the California Consumer Privacy Act, and the UK and EU General Data Protection Regulation give people rights over personal data held about them — typically to know what is held, to get a copy, to correct it, to have it deleted, and to opt out of its sale or of profiling.
This site holds no personal data about you. It has no database, no server-side code and no accounts, and the one value it saves stays in your own browser under your control. So there is no file to send you, nothing to correct, and nothing to delete on request — you can delete everything yourself by clearing site data for myburritofinder.com. There is no sale of personal data to opt out of, and no profiling or targeted advertising takes place.
If you would like to exercise a right, ask what is held about you, or raise a concern, write to privacy@humanelycoded.com and you will get a reply within 30 days. Requests are free. If you are in the EU or UK you also have the right to complain to your national data protection authority; if you are in Oregon you may contact the Oregon Department of Justice.
Data about your visit does reach the third-party services listed above, and rights over that data are exercised with those organisations directly, using the links in that table.
Do Not Track and Global Privacy Control
This site does not track anyone, so a Do Not Track header or a Global Privacy Control signal changes nothing about how it behaves. There is no tracking to switch off and no sale or sharing of data to opt out of.
Children
This site is not directed at children, does not knowingly collect information from anyone, and has no means of collecting information from a child, since it asks for nothing and stores nothing about its visitors.
Security
The site is served over HTTPS. It holds no personal data, so there is no store of it to be breached. The page restricts itself with a Content Security Policy, which limits it to the services listed above and blocks anything else from loading or being contacted.
Changes to this policy
If this policy changes, the date at the top of this page changes with it. If the site ever starts collecting something it does not collect today, or begins operating commercially as Humanely Coded, that will be stated here before the change takes effect.
Contact
Andrew Hughes, Oregon, United States
privacy@humanelycoded.com