Privacy notice

The short version

• No tracking cookies. No advertising network. No fingerprinting.
• No accounts for visitors. Browsing collects no personal data.
• We collect a contact email only when you submit an event, report an issue (optional), or sign in as an admin.
• We use a handful of named third parties (listed below) for hosting, email, and AI text extraction.
• We don't sell or rent personal data. Not now, not later.

What we collect, and when

Browsing

Cloudflare (our hosting provider) writes short-lived server logs for security and abuse prevention: IP addresses, user-agent strings, request paths. We use Cloudflare Web Analytics to count page views; it does not use cookies and does not fingerprint visitors. No tracking pixel, no analytics SDK, no third-party advertising tags.

Submitting an event

The submission form collects event details (title, dates, venue, producer, etc.), a contact email, and optionally a submitter name. You may also attach a poster image. We store these in our Cloudflare D1 (database) and R2 (object storage) instances for the purpose of reviewing and publishing the listing. Contact email is shown on the public event page only when the submitter or producer asked us to.

Uploading a poster

When you upload a poster image, we send the image to Anthropic's Claude API for automated text extraction. Anthropic processes the image to identify event details and returns them to us. Per Anthropic's API terms, inputs are not used to train their models. We retain the poster image in our own storage for display on the event page.

Reporting an issue

The "Report issue" button on each event page collects an issue type, a free-text message, and an optional email so we can follow up. Reports go to our admin inbox via email; we don't retain a separate database of reports in v1.

Admin sign-in

Site operators sign in with a one-time link emailed to a pre-authorized address. We store a hashed token (15-minute lifetime, single use) and a session id (30-day sliding) tied to the operator's email. No passwords, no third-party identity provider.

Third parties we share data with

We use the following processors strictly to run the site:

• Cloudflare: Pages hosting, D1 database, R2 storage, Web Analytics. Receives all requests by virtue of being our edge network.
• Cloudflare Email Service: sends transactional emails (submission confirmations, decision notices, admin magic links, issue-report notifications). Receives the recipient's email address and the message body.
• Anthropic: Claude Vision API processes poster images you upload, to extract event text. Receives the image and a fixed extraction prompt; returns structured event data. Per Anthropic's API terms, inputs are not used to train their models.
• Unsplash: supplies generic hero background photos (not user uploads). Image URLs are loaded directly from Unsplash by your browser; Unsplash sees the request as a normal CDN fetch.

We do not use any analytics SDK, advertising network, retargeting service, or social tracking pixel.

How long we keep things

• Server logs: retained per Cloudflare's default retention (typically days, not months).
• Submissions and approved event listings: retained indefinitely as part of the directory record. You can request deletion (below).
• Poster images: kept while the associated event is listed; removed when the listing is removed.
• Admin sessions: 30 days sliding; magic-link tokens: 15 minutes, single-use.

Your choices

• Remove a submission tied to your email. Email [email protected] from the address you used to submit. We typically act within a few business days.
• Correct a listing. Use the Report issue button on the event page, or email us directly.
• Opt out of transactional email. We only email you in response to something you sent us (submitting an event, requesting an admin link). There is no marketing list.

Children

The directory lists youth and junior rodeo events, but RodeoList is not directed at children under 13 and does not knowingly collect personal information from them. Submissions about junior events are made by adults (producers, parents, organizers).

Changes

We'll update the "Last updated" date at the top when this notice changes. Substantive changes will be called out on the page.

Contact

Privacy questions, data deletion requests, or anything else: [email protected].