Privacy.
The short version: we collect as little as we can get away with, we never sell it, and you can have it deleted by sending one email.
If you're just browsing
We set one cookie so we can tell repeat visits apart from new ones. We record which pages were viewed, roughly which region the request came from, and where the visit came from (a search engine, a QR code, a direct link). The region comes from our host's own geo headers — we never store your IP address.
If you tap "use my location", your device gives us coordinates so we can sort stands by distance. That stays in your browser. We only keep a copy on our servers if you have saved a stand and asked for the weekly email, and then only to work out which drops are near you.
If you save a stand or ask for alerts
Saving a stand creates a record tied to that one cookie. There is no account and no password. If you give us an email address we use it for the weekly digest and for saved-search alerts, and nothing else. You have to confirm the address by clicking a link before we will send you anything.
Every email we send carries an unsubscribe link that works from any device without signing in. Using it stops all of it.
If you turn on browser notifications we store the subscription your browser gives us. Turning notifications off in your browser makes it stop; we also delete it automatically once your browser reports it as dead.
If you run a stand
A producer account holds your email address and a hashed password — hashed means we cannot read it, including us. If you claim a stand by text, we store the phone number you texted from so we can recognise you next time. That number is kept private and is never published on your listing; the phone number shown publicly is only ever one you entered yourself as a contact number.
Your stand's name, address, description and product list are public by design — that is the point of a directory.
What we don't do
No advertising networks, no third-party analytics, no tracking pixels, no selling or sharing of personal information. We use a small number of service providers to actually run the thing: Vercel (hosting), Neon (database), Resend (email), Cloudinary (photos), Mapbox (maps) and Twilio (text messages). They process data on our behalf and nothing more.
How long we keep it
Analytics records are kept for two years. A buyer cookie lasts two years unless you clear it. Everything else we keep until you ask us to delete it, or until the account is closed.
Getting your data, or getting rid of it
Email [email protected] and ask. You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. We will do it, and we will not ask you why.
Who we are
Local in Season
[SET NEXT_PUBLIC_MAILING_ADDRESS — required by CASL]
[email protected]
Questions about this page, or anything above, go to the same address. If we change how any of this works we will change this page.