1. Introduction
Burlington Riverfront Entertainment ("BRE", "we", "our", or "us") operates this authentication service to manage access to BRE products and services. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
2. Information We Collect
We collect the following categories of information:
- •Account information. When you register, we collect your email address and a hashed version of your password. If you sign in with Google, we receive your Google account email and profile information.
- •Profile information. You may optionally provide a display name and other profile details through your account settings.
- •Session data. We store session tokens to keep you signed in across visits. Sessions include your user ID, the time of authentication, and device/browser metadata.
- •Audit logs. We log authentication events (sign-ins, password changes, account updates) for security and troubleshooting purposes.
3. How We Use Your Information
We use the information we collect to:
- •Authenticate your identity and manage your account
- •Enable single sign-on (SSO) access to connected BRE services
- •Send account-related emails such as password reset instructions
- •Detect and prevent unauthorized access or abuse
- •Comply with legal obligations
We do not sell your personal information or use it for advertising.
4. Data Storage and Security
Your data is stored on Cloudflare's infrastructure, including Cloudflare D1 (database) and Cloudflare KV (session storage). Cloudflare operates globally distributed data centers and applies industry-standard security controls.
Passwords are never stored in plain text — they are hashed using a one-way cryptographic function before being saved. Session tokens are signed JWTs and are invalidated when you sign out or when they expire.
5. Third-Party Services
We use the following third-party services that may process your data:
- •Google OAuth. If you choose to sign in with Google, your authentication is handled by Google. Google's use of your data is governed by the Google Privacy Policy.
- •Mailchimp Transactional (Mandrill). We use Mailchimp's transactional email service to send password reset and account notification emails. Only your email address is shared for this purpose.
- •Cloudflare. This service runs on Cloudflare Workers. Cloudflare may process request metadata (IP addresses, headers) as part of its network infrastructure and security services.
6. Data Retention
We retain your account information for as long as your account remains active. Audit log entries are retained for a reasonable period for security purposes. If you delete your account, your personal information will be removed from our systems within a reasonable timeframe, except where retention is required by law.
7. Your Rights
You have the right to:
- •Access the personal information we hold about you
- •Update or correct your account information via your account settings
- •Request deletion of your account and associated data
- •Revoke active sessions at any time from your account settings
To exercise these rights or with any privacy questions, contact us at the address below.
8. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of BRE services after changes take effect constitutes acceptance of the updated policy.
9. Contact
If you have questions about this Privacy Policy or your data, please contact Burlington Riverfront Entertainment at privacy@burlingtonriverfront.com.