Privacy policy

Last updated Oct 28, 2026

The Ynez mainly collects Google Analytics data on which pages people read and which links they tap, Microsoft Clarity recordings of how pages get used, our own log of taps on business links and My Trip, saved trips if you make a trip link, your email address and sign-up details if you join the weekend note or ask for trip reminders, and your mobile number and consent record if you sign up for text alerts. In the US, Clarity and Google signals run unless you opt out. In the EEA, UK and Switzerland, nothing optional runs until you accept. Everywhere else, Clarity and Google signals stay off unless you turn them on. To delete your data, email hello@theynez.com.

"We" and "us" means The Ynez, the Santa Ynez Valley guide at theynez.com, edited by Tony Michael in Los Alamos, California. The Ynez is published by Bello Libre Partners LLC in Santa Barbara, California.

Your privacy choices

On your first visit, a notice about cookies appears. Its "Choices" button, or the "Do Not Sell or Share My Personal Information" link in the footer, opens these settings (Essential is always on; the other two are switches):

• Essential. Always on. It keeps the site and your saved trip working.
• Analytics. Google Analytics.
• Sale and sharing. Microsoft Clarity and Google signals. Clarity runs only when Analytics is on too. If your browser sends a Global Privacy Control signal, this stays off and the switch is locked.

Where the switches start depends on where you are. For this, our host, Vercel, works out your country and state from your IP address, and the notice keeps only those two codes, in your browser, for the visit.

• United States. Analytics and Sale and sharing start on. "Do not sell or share" turns Sale and sharing off and leaves Analytics on; switch Analytics off too if you like. "Accept all" also turns on Google's ad personalization settings and Microsoft's advertising cookie. "OK" or closing the notice keeps the starting settings.
• EEA, UK and Switzerland. Both start off, and nothing optional runs until you tap "Accept all" or switch one on and save. "Reject all" or closing the notice keeps them off.
• Everywhere else. Analytics starts on and Sale and sharing starts off. "Reject optional" turns both off.

If we can't tell where you are, we go by your browser's time zone: a European one gets the European settings, any other gets "everywhere else." Your choice is saved in this browser only, so you may need to set it again on another device or after clearing site data.

Google Analytics

We use Google Analytics 4 to see which pages people read and what they tap. It tells us things like the page you viewed, the site or campaign link that sent you, your device and browser type, and your rough location (city level). It also counts these actions:

• how far down a page you scroll (a quarter, half, three quarters, the end);
• taps on a business's website, booking, phone or directions link, with the business name;
• adding or removing a place in My Trip, with the business name and town;
• taps on share and tip buttons, and on items in our This week and new-finds boxes;
• the steps of Ask Jenty, opening "Email me my trip," and signing up for the weekend note;
• whether the sign-up box was shown, closed (and how long it stayed open) or used;
• how fast each page loads, holds still and responds to taps, with the part of the page that was slowest.

From the addresses of the pages you read in a visit, the site also makes a rough guess at the kind of trip you're planning (wine, family, dogs, weddings, luxury, trip planning or events) and sends that label to Google Analytics with your visit, so we can count which kinds of readers we serve.

Google signals is part of "Sale and sharing." In the US it's on unless you opt out; everywhere else it's off unless you turn it on. When it's on and you're signed in to a Google account with ad personalization allowed, Google may link your visit to that account so it can give us aggregated reports on age range, gender and interests. We only see totals, never who you are. We don't run Google ads, and unless you tap "Accept all," we tell Google not to use your visit for personalized ads. You can control this in Google's My Activity and Ad Settings.

Google Analytics doesn't give us your name or email, and Google says it doesn't log or store IP addresses. It keeps this event data for 14 months. With Analytics switched off, it reads and writes no cookies. The tag can still send Google basic measurements without cookies (the page address, the time, your browser type, the page that sent you and a random number that changes with every page), which Google uses for basic counts and modeling. In the EEA, UK and Switzerland we hold those back too until you accept, once your location or your browser's time zone shows you're there; the short link pages under /go/ can still send one before you choose. Google handles the data under its own privacy policy. To keep your visits out of Google Analytics completely, install Google's Analytics opt-out add-on.

Microsoft Clarity

Microsoft Clarity records how people use our pages (clicks, taps, scrolls and what the page shows) as session replays and heatmaps. It runs when both Analytics and "Sale and sharing" are on: in the US unless you opt out, everywhere else only after you accept or turn them on. It never runs when your browser sends Global Privacy Control. When it runs, we partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps and session replay, so we can improve the site. Website usage data is captured using first- and third-party cookies and other tracking technologies.

Under Clarity's terms, Microsoft isn't only working for us: it can use this data for its own purposes, advertising included. That's why Clarity sits under "Sale and sharing." Microsoft keeps recordings for 30 days and heatmap data for 9 months.

Clarity masks what you type into form fields, including the weekend note sign-up and the whole text alerts form. We label each Clarity session with the kind of page, its category, the town, the business and whether an AI chat tool sent you, and we send Clarity an event naming the business when you tap its phone, directions, booking, affiliate or other outside link. Never your name or email. For more on how Microsoft collects and uses your data, see the Microsoft Privacy Statement.

Link counts

Some taps also go to our own database, whatever your cookie choices: a business's website, booking or reservation, phone, directions, visit, menu, wine club, shop or Instagram link; the paid hotel-rate and tour links (Stay22 and Viator, with the partner named); adding or removing a place in My Trip; and items in our This week and new-finds boxes. For each one our server keeps:

• which business or item, the type of tap, the page you were on and where the link goes;
• a random session ID your browser holds for the visit (in sessionStorage, cleared when you close the tab);
• the campaign tags (source and medium) and the outside website, domain only, that started the visit;
• your rough location (country, region and city), which our host, Vercel, works out from your IP address; the IP address itself isn't stored;
• your browser's user-agent string (the line that says, for example, "Safari on iPhone") and your device type (phone, tablet or computer).

No name, no email. We use the totals to show businesses how many visitors we send them and to count My Trip adds. Links to a business's own site also carry tags naming The Ynez and the page you came from, so the business can see we sent you. Paid links through Stay22 and Viator carry a code naming our page so the partner can credit us; those sites then handle your data under their own policies. More on the disclosure page.

The weekend note

Sign up and we keep:

• your email address, and when you signed up and confirmed;
• the page and spot you signed up from (footer, end of a guide, My trip, Ask Jenty or the sign-up box below), the words on the button you tapped, and what made the sign-up box appear;
• the town, kind of page and places that page (or your saved trip) covers, kept as tags so the weekend note can match what you read;
• how you found us: the page you first landed on and when, the outside website that sent you (domain only), any campaign tags in the link, and any share or forward code;
• a record of your sign-up and your confirmation: which version of the sign-up wording you saw, the time, your browser family (for example "iOS Safari") and a scrambled code made from your IP address with a secret key, not the address itself;
• your saved trip, if you asked us to email it. With a weekend note sign-up we drop the trip once it's sent; a one-off "Email me my trip" request keeps the trip with your address.

Sign-ups are double opt-in. You get one email with a confirmation link, and nothing else arrives until you tap it. Links in our emails carry your own forward code: if a friend signs up from a copy you forwarded, we can see that you sent them, and the code reaches Google Analytics as part of the page address when a link is opened.

Every weekend note has a one-tap unsubscribe link. Once you unsubscribe we keep your address marked "unsubscribed" so we never mail it again. If an email bounces or is reported as spam, we record that and stop mailing the address. Want it gone completely? Email us and we'll delete it. Our consent records then keep only a scrambled code made from the address, not the address itself, as proof of what you agreed to.

Emails go out through Resend, and the list lives in a Supabase database. The site itself runs on Vercel, whose servers keep standard request logs (IP address, browser, time) for a short period. These companies process the data for us and can't use it for their own marketing. Replies to our emails reach Tony directly.

After you have read a page for a while, a small sign-up box can appear once as you head for the top of the page to leave. It shows at most once per visit, never again for 14 days after you close it, never after you've closed it three times, and never after you sign up. To know that, your browser keeps a short note in its own storage (sessionStorage and localStorage, not cookies): whether the box was shown this visit, when you last closed it, how many times you've closed it, and when you signed up or arrived from one of our emails. No page addresses are stored, and it never interferes with your Back button.

My trip

Places you add with "Add to My Trip" stay in your browser's storage (localStorage), on your device, and we never see the list itself unless you save a trip link (below) or ask us to email it to you. Each add or remove on a guide card or the My Trip page is counted, though: Google Analytics gets the business name, town and page, and our link-count log gets the business, the page and your session ID (see Link counts). Clear your browser data and the list is gone.

Saved trips and trip links

Tap Save and get a link on My Trip and we keep a copy of that list on our server, so the link opens on any phone. What we store, and why:

• The trip: the places on your list (name, town, address and our links for directions and booking), plus a title and dates if you add them. The link needs them to show your trip.
• Two random codes: the read-only code in the link, and an edit code that only your browser holds. We store the edit code scrambled (a one-way hash), so it can’t be read back from our database.
• A scrambled form of your IP address, for one day, so we can limit how many trips one connection saves in an hour.
• Your email address, only if you ask for trip reminders (below), with the version of the wording you agreed to and when.

Anyone you send the link to can see the list but can’t change it. Trip pages are kept out of search engines, and the page takes the code out of the address bar before Google Analytics or Microsoft Clarity load, so neither one gets it. Google Analytics counts saving, opening, sharing, copying, emailing and deleting a trip and turning on reminders, without the code, the trip or your address. Like any web address, the trip page's address (with the read-only code) appears in our hosting provider's request logs, which Vercel keeps for a short time.

How long we keep it. A trip with dates is deleted 90 days after its last day. A trip without dates is deleted 180 days after you last changed it; opening the link doesn’t count as a change. Our server checks for expired trips every hour and deletes them. Deleted trips can stay in our encrypted backups for up to 30 more days, then they’re gone.

Deleting it sooner. Open your trip link on the phone or browser you saved it from and tap Delete this trip. It’s gone for everyone with the link, right away. Lost that phone? Email us the link and we’ll delete it by hand.

Your browser keeps the link and its edit code in localStorage next to your My Trip list, and remembers the last trip link you opened in that tab (sessionStorage) so a refresh still shows it.

Trip reminders

If you tick Email me reminders for this trip and then tap the confirm link we send, we email you at most twice about that one trip: 2 days before, only if a stop takes bookings or our guides list it as closed on your trip, and the day before, with your plan and the route. Nothing goes out until you confirm. The confirm link stops working after 7 days, and a request nobody confirms is deleted then.

We keep your address with that trip only for these emails. It doesn’t sign you up for the weekend note, and we never ask for, or email, anyone else’s address: to share a trip, you send the link yourself. Every reminder has a one-tap link to stop them, and stopping removes your address from the trip. If one of your two emails has already been sent, we keep a one-way fingerprint of your address (not the address) and a note of which emails were sent, until the trip is deleted, so that asking again can’t earn a third email. Clearing the trip’s dates or deleting the trip removes your row completely. If your address is on our do-not-mail list (you unsubscribed, an email bounced, or one was marked as spam), no reminders go out. Reminders are sent through Resend, like the weekend note.

Ask Jenty

When you use Ask Jenty, your quiz answers (town, day, trip length, who's coming, interests and pace) go to our server and to Anthropic's Claude API to put the plan together. No name or email goes with them. We keep each plan with a scrambled form of your IP address, so a permanent link works and so we can limit how many plans one connection makes in an hour. If you ask us to email the plan, that works like "Email me my trip" above.

Maps

The maps on our guides use Google Maps. When a map is about to come into view, your browser asks Google for the map pictures and the copyright line under them. Google gets what any website gets from a request like that: your IP address, your browser details and our site's address (not the page you're on). We send no cookies and nothing about you with those requests.

Google handles what it gets under the Google Privacy Policy, and using the maps is subject to the Google Maps Additional Terms of Service. To keep the map settings for your visit, sessionStorage holds the short code Google gives them, and it clears when you close the tab. If Google's map can't load, you see our own map instead. Our terms page says the same and links Google's Maps Platform terms.

Our own map is drawn from OpenStreetMap data in a file on our server. On browsers that can't draw that file, the map pictures come from OpenStreetMap's servers, which then get your IP address and browser details too.

Cookies

Google Analytics sets cookies named _ga and _ga_ plus an ID, only while Analytics is on; with Google signals on, the Google tag can also use Google's advertising cookies. Microsoft Clarity sets first-party cookies such as _clck and _clsk whenever it runs, and Microsoft's third-party MUID cookie only after you tap "Accept all." They tell a return visit from a new one. We don't place social media pixels. The site works fine with cookies blocked.

The site also keeps a few notes in your browser's own storage, not cookies: your privacy choices, your My Trip list and its trip link (see Saved trips), the sign-up box note above, and, for up to 90 days, how you first reached the site (landing page and time, the full address of the outside page that sent you and any campaign tags), which reaches us only if you sign up. For each visit, sessionStorage holds the random session ID, that visit's campaign tags, the trip-type guess and the country and state codes the privacy notice uses, plus the Google map code described under Maps; it clears when you close the tab.

Selling and sharing

We don't sell your information for money, rent the list, or hand it to advertisers or the businesses we write about. Two tools can still count as a "sale" or "sharing" under California law, because the companies behind them can use what they collect for their own purposes, ads included: Microsoft Clarity and Google signals. What they get is the kind of thing listed above: cookie and device IDs, browser and device details, rough location and how you use our pages. In the US both run unless you opt out; everywhere else they stay off unless you turn them on. We don't knowingly sell or share the information of anyone under 16. If we're ever asked to by law, we'll only give what the law requires.

Do Not Sell or Share My Personal Information

You can opt out of that sale and sharing at any time, wherever you live:

• Open your privacy choices and tap "Do not sell or share," or switch off "Sale and sharing" and save. Clarity stops on that page and won't load again, and Google signals goes off.
• Turn on Global Privacy Control in your browser or a privacy extension. We treat it as an opt-out for that browser, every time it's on: the switch stays locked off, Clarity never loads, and the footer link says "Opt-Out Preference Signal Honored." We have no accounts and sell nothing offline, so the signal covers everything we do with your visit.

Your choice is saved in this browser only, so you may need to set it again on another device or after clearing site data. Once you opt out, we won't ask you to opt back in for at least 12 months.

Your California rights

The Ynez is published in California. Under the California Consumer Privacy Act (CCPA, as amended by the CPRA), and wherever you live, you can ask us to:

• Tell you what we have. What personal information we've collected about you, where it came from and who processes it.
• Delete it. We'll remove your address and sign-up details, and ask our processors to do the same. Only the scrambled proof-of-consent code described above stays.
• Correct it. Fix a wrong email address, for example.
• Opt out of sale or sharing. In the US, Clarity and Google signals run until you opt out with the footer link or Global Privacy Control (see above). Ask and we'll confirm it in writing.

Live in another state with a privacy law, such as Colorado, Connecticut, Oregon, Texas or Virginia? You can opt out of targeted advertising and sales the same two ways, and we honor Global Privacy Control as that opt-out wherever you are.

We don't collect sensitive personal information (things like financial details, health data or precise location). Asking about your data won't change how the site or the weekend note works for you.

Email hello@theynez.com with "Privacy request" in the subject. We'll confirm the request comes from the owner of the email address, usually by replying to it, and answer within 45 days. Someone you've authorized can ask for you; we'll need your written permission.

If you're in Europe

In the EEA, UK and Switzerland, we use Google Analytics, Microsoft Clarity and Google signals only with your consent, and you can take it back at any time with the footer link. You can ask us for a copy of your data, or to correct it, delete it or stop using it, by emailing hello@theynez.com, and you can complain to your data protection authority. Google and Microsoft may handle the data outside Europe, including in the US.

Text alerts

The Ynez Text Alerts are opt-in only: you give us your number on the text alerts page, tick the consent box, and reply Y to our one confirmation text. We never add numbers from any other list. Message frequency varies, up to 3 texts a day. Msg & data rates may apply. Reply STOP to any text to opt out, or HELP for help. The full rules are in the SMS terms.

When you sign up we keep:

• your mobile number and the alerts you picked;
• a record of your consent: which version of the consent wording you saw, the page, the time, your browser's user-agent string and a scrambled code made from your IP address with a secret key, not the address itself;
• when we texted you to confirm, when you replied Y, and when you opted out, with the replies that did it;
• a log of each text we send you (what it said, when, and whether your carrier delivered it) and of each text you send us;
• for wine alerts only, which are for people 21 and over: your date of birth, as proof you were old enough when you joined.

We use this to send the alerts you asked for, to stop them when you say stop, to keep to the daily limit, and to prove you agreed if anyone asks. No mobile information is shared with third parties or affiliates for marketing or promotional purposes, and we never sell or share your number or your text opt-in with anyone for their marketing. Texts go out through Telnyx, and the records live in our Supabase database; both process the data only for us. Your carrier also sees the texts it delivers.

How long we keep it: the consent record and the text log stay for 4 years after your last text from us or your opt-out, whichever is later, because that is how long a claim about a text can be brought. If you opt out, we keep that opt-out for at least 10 years so we never text you again by mistake. Ask us to delete your number and we will stop all texts and delete what we can; the opt-out and the consent record stay, as described here, because the law lets us keep proof of what you agreed to.

Children

The Ynez is written for adults planning a trip, and a lot of it is about wine. We don't knowingly collect information from anyone under 13. If you think a child has signed up, email us and we'll delete it.

Keeping it safe

The subscriber list and saved trips sit in a locked-down database that only our server can reach, over encrypted connections. No system is perfect; if something ever goes wrong with your data, we'll tell you.

Changes and contact

When this policy changes, the date at the top changes too. A big change, like starting texts or new kinds of data, gets a note in the weekend note first.

Questions or requests: hello@theynez.com or (310) 719-5790. How we make money and handle partners is on the disclosure page.