Privacy Policy
How SDBaja collects, uses, and retains account and community data.
Who we are
SDBaja is a community platform operated from San Diego County, California. Contact: contact@sdbaja.com. Minimum age: 18.
Account information
We collect account data you provide: email, username, password hash, display name, preferred language, country/border preference, and similar profile fields. We may store registration IP and last-seen IP for security.
Profiles and UGC
Profile bios, garage/rig info, photos, posts, comments, crew content, ride/event details, RSVPs, and marketplace listings are stored to provide the service and may be visible to other users according to visibility settings.
Messages
Private message content and metadata (thread participants, timestamps, read state, related listing/vehicle links) are stored to deliver messaging.
Photos and media
Uploaded images (posts, marketplace, avatars, galleries) are stored on our hosting environment to display them in the product.
Location
You may optionally provide general area labels such as a city, trail hub, or home-area text. If you type or share a more precise location in posts, rides, events, or messages, that content is stored as you submit it. SDBaja does not currently collect precise GPS coordinates from your device for advertising.
Marketplace, rides, events, crews, RSVPs, reports
We store listings, ride/event records, crew membership, RSVPs, attendance flags, and user-submitted reports (including reason, details, and moderation fields) to operate those features and safety tools.
Technical and security data
We process IP address, browser user-agent, session cookies (including CSRF/session), CAPTCHA challenge state, login/register attempt logs, and admin audit logs for security, abuse prevention, and reliability.
Why we use data
To create and secure accounts; show community content; enable messaging, marketplace, rides, and crews; send transactional email when configured (verification, resets, optional notification prefs); moderate abuse; comply with law; and improve reliability.
When information is public
Public profiles, public posts, public listings, and public ride/event pages are visible to other users and may be indexed by search engines. Private messages and non-public visibility settings are not intended for public display.
Service providers
We use hosting and mail infrastructure to operate the service, store content, and send transactional messages such as email verification and password resets when those features are enabled. We do not use third-party advertising pixels or third-party analytics vendors.
First-party analytics
We measure how the website is used with a small first-party script on SDBaja pages. It assigns a random visitor ID and session ID in first-party cookies (not derived from a browser fingerprint). We record pageviews, sessions, approximate device/browser/OS/language/screen size, referring site, campaign (UTM) parameters, search and filter usage, outbound and major button clicks, and which public content types were viewed (posts, photos, videos, events, rides, rigs, crews, listings). If you are logged in, we may attach your user ID to that traffic. Approximate country, region, and city may be inferred from IP using a local GeoLite2 database or hosting geo headers when available; otherwise location is stored as Unknown. We do not collect exact GPS, street addresses, keystrokes, passwords, private messages, form contents, or uploaded-file contents. We do not permanently store raw IP addresses in analytics tables (we store a rotating salted HMAC only). Raw analytics are kept about 90 days, then deleted; anonymous daily totals may be kept longer. Bots, admin pages, and staff browsing are excluded by default. You can opt out at /analytics-opt-out.php. We honor Global Privacy Control (Sec-GPC) for this analytics measuring.
Legal and safety disclosures
We may disclose information when required by law, to protect rights and safety, to investigate fraud/abuse, or in connection with a legal process. Report submissions are reviewed by staff; we do not notify the reported user who filed a report.
Retention and deletion
We retain account and content data while your account is active and as needed for backups, security, fraud, legal, and moderation. Account deletion requests deactivate the account and remove or obscure ordinary profile identifiers, while security, fraud, legal, and moderation records may be retained for a retention period rather than destroyed immediately. First-party analytics events are deleted after about 90 days; anonymous daily aggregates may remain.
Your controls
You can access and correct profile information in Edit profile / Settings, download a copy of many account records, request deletion (password re-auth required), block users, and manage message privacy and location visibility settings. You can manage first-party analytics in Settings → Privacy & Data when signed in, or under Analytics preferences on this Privacy page when browsing signed out.
California privacy rights
If you are a California resident, you may have rights to know, delete, and correct personal information, and to non-discrimination for exercising those rights, subject to legal exceptions. Contact contact@sdbaja.com to make a request.
Sale of personal information
SDBaja does not sell personal information to data brokers and does not sell precise location for advertising.
Precise-location advertising
SDBaja does not currently use precise-location-based advertising.
Browser privacy signals / DNT
Essential first-party session cookies are not turned off solely because a browser sends a Do Not Track signal. First-party analytics measuring honors Global Privacy Control (Sec-GPC) and the Analytics preferences control.
Security limitations
We use reasonable technical measures (password hashing, CSRF tokens, prepared statements, access controls). No method of transmission or storage is 100% secure.
Children
SDBaja is for users 18+. We do not knowingly allow accounts for anyone under 18.
Contact and dates
Questions: contact@sdbaja.com. Effective and last-updated dates appear at the top of this page.
Analytics preferences
Manage first-party analytics used to improve SDBaja.
Allow SDBaja to use first-party analytics to improve the website.
Status: On
SDBaja does not sell personal information.