Privacy policy.

Who we are

The San Diego List is an independent editorial publisher covering San Diego County. In this policy “we,” “us,” and “our” mean The San Diego List. For privacy law purposes we are the business (CCPA/CPRA) and the data controller (UK/EU GDPR) for information collected through this site. Reach us any time at hello@thesandiegolist.com.

What we collect

Newsletter subscriptions. If you join The Shortlist we store the email address you enter, the page you signed up from, and the version of the consent language you agreed to. We use it to manage your subscription, understand which signup placements work, and send the newsletter. Every email includes a one-click unsubscribe link, and you can leave at any time.

Analytics. If you accept analytics cookies, Google Analytics and Vercel Analytics record pages viewed, approximate location derived from IP address, referring site, device and browser type, and general interaction data. We use this in aggregate to see which guides get read. We have IP anonymisation enabled in Google Analytics.

Advertising. If you accept advertising cookies, the Meta Pixel records your visit and page views and reports them to Meta so we can measure and target ads. Meta may match this to an existing Meta account. If you decline, the pixel is never loaded.

Your saved list. Anything you save with the star icon is stored in your own browser using local storage. It never reaches our servers, and clearing your browser data deletes it.

Server and security logs. Our hosting provider processes standard request data, including IP address and user agent, to serve pages, balance load, and defend against abuse. This is necessary to run the site and happens regardless of cookie choices.

Messages you send us. If you email a correction, tip, invitation, or rights request, we keep that correspondence so we can act on it and maintain a record of editorial decisions.

We do not knowingly collect payment details, government identifiers, precise geolocation, biometric data, or any other category of sensitive personal information.

Cookies and similar technologies

We group them into three categories:

• Strictly necessary — security, load balancing, remembering your cookie choice, and your saved list. Always active, because the site cannot work without them.
• Analytics — Google Analytics and Vercel Analytics. Off until you opt in.
• Advertising — Meta Pixel. Off until you opt in.

Nothing in the analytics or advertising categories loads before you choose. You can change or withdraw your choice at any time using Cookie & privacy choices in the footer of every page, and withdrawing is as easy as consenting. We also honour Global Privacy Control signals: if your browser sends one, we treat it as a standing opt-out and never show you a banner.

Why we are allowed to use it

If you are in the UK or EU, our legal bases are: consent for analytics and advertising cookies and for newsletter emails; legitimate interests for running, securing, and improving the site and for responding to correspondence; and legal obligation where we must retain records. Where we rely on consent, you can withdraw it at any time without affecting processing that already happened.

Who we share it with

We do not sell your personal information for money. We share it only with the service providers who help us operate:

• Resend — processes and stores newsletter subscriptions on our behalf.
• Vercel — hosts the site, provides aggregate analytics, and screens signup forms for automated abuse.
• Google — provides Google Analytics, if you accept analytics cookies.
• Meta Platforms — receives Meta Pixel data, if you accept advertising cookies.

We may also disclose information if the law requires it, to enforce our Terms of Use, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets — in which case we will post notice here before your information becomes subject to a different policy.

A note on “selling” and “sharing.” California law defines those terms broadly. Allowing the Meta Pixel to run is treated as sharing personal information for cross-context behavioural advertising. Declining advertising cookies, or sending a Global Privacy Control signal, opts you out.

International transfers

We operate from the United States and our providers may process data in the U.S. and elsewhere. Where personal information moves out of the UK or EEA, our providers rely on transfer mechanisms such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep it

Newsletter subscriptions are kept until you unsubscribe or ask us to delete them, plus a short suppression record so we do not accidentally re-add you. Analytics data follows each provider’s retention settings — currently a maximum of 14 months in Google Analytics. Correspondence is kept as long as it is editorially useful. Security logs are kept for a short operational period.

Your rights

Everyone. Email hello@thesandiegolist.com and we will delete your subscription and any correspondence on request. Every newsletter has a one-click unsubscribe.

California residents (CCPA/CPRA). You have the right to know what we collect and why, to request deletion, to request correction, to opt out of the sale or sharing of personal information, to limit use of sensitive personal information (we do not collect any), and not to be discriminated against for exercising any of these. We never charge different prices or degrade the site based on your privacy choices.

UK and EU residents (GDPR). You additionally have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority.

To exercise any of these, email hello@thesandiegolist.com with the subject “Privacy request.” We will respond within the timeframe the applicable law requires — 45 days in California, one month under GDPR — and may need to verify your request by replying to the email address on file. An authorised agent may submit a request on your behalf with written proof of authorisation.

Children

This site is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

Security

The site is served over HTTPS and subscription data sits with established providers under contract. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we keep the amount of data we hold deliberately small, which is the most effective protection available to us.

Do Not Track

Browsers send “Do Not Track” signals inconsistently and there is no agreed standard for honouring them, so we do not respond to DNT. We do honour Global Privacy Control, which is a recognised opt-out signal under California law.

Changes

If we change this policy we will update the effective date above. Material changes that affect how we use information already collected will be announced on this page before they take effect, and where the law requires it we will ask for fresh consent.

Contact

Questions, deletion requests, or anything else: hello@thesandiegolist.com. You can also reach us through our contact page.