Clear boundaries for your BasedBite account.
BasedBite uses an account only for community participation and review access. Public venue data is separate from personal account data.
What we store
Your email address, chosen display name, a password hash, account role, and security timestamps are stored to provide sign-in and protect the service. Passwords are never stored in readable form.
Community notes are linked to your account and venue. Other visitors see your display name, note, and date — not your email, session, or account ID.
Map search data
Venue, area, and map searches normally use BasedBite's stored public records. When you submit an explicit street-shaped search and local venue data does not contain enough road geometry, the server may send that street name to OpenStreetMap's Nominatim service to locate the road.
This lookup is not autocomplete, does not include your account, email, comments, or session data, and is briefly cached only to avoid repeated requests. OpenStreetMap attribution remains visible on the map.
Security controls
Sessions use an opaque, server-side token in an HttpOnly, Secure, SameSite cookie in production. Passwords use memory-hard scrypt hashing. State-changing browser requests require a same-origin JSON request and a session-bound CSRF token.
Admin accounts are separate roles and require a time-based authenticator code before review APIs are available. Admin MFA secrets are encrypted at rest.
Your controls
You can change your display name, view your account data, and delete your account from Account settings. Deletion removes your login, sessions, and venue comments through the database relationship.
Authentication sessions expire automatically for inactivity and after an absolute lifetime. Rate-limit records use keyed digests rather than storing raw email or IP values and are cleaned up after a short window.
Contact
For privacy questions, account help, or venue corrections, contact freya@basedbite.com.
Important launch note
This repository provides the technical controls above, but the deployment operator must still publish the final controller identity, contact method, legal bases, retention schedule, processor list, international-transfer information, and data-subject request procedure before public launch.
The operator must assess GDPR obligations under the actual deployment, including transparency, minimisation, storage limitation, security, access, correction, erasure, restriction, objection, and portability rights.