Privacy Policy

1. Who we are

Street Eats is a software product owned and operated by Buhrn Technologies LLC, a Texas limited liability company headquartered in Houston, Texas (“Street Eats,” “we,” “our,” or “us”). Street Eats connects people with participating food trucks and mobile vendors through a live map, vendor-published locations, menus, and, when available, privacy-conscious demand signals. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have, wherever in the United States you use Street Eats.

2. Scope

This policy covers the Street Eats mobile applications, the eatonthestreets.com website, and communications you send us through either channel we operate. It does not cover independent businesses you discover through Street Eats. Vendors, venues, and event organizers handle any information you give them directly under their own practices. Messages you send through Instagram, Facebook, or other third-party apps are also governed by those platforms’ terms and privacy policies, not solely by this policy.

3. Information we collect

• Account information: email address, authentication details, profile, saved favorites, and account preferences.
• Location: location while you use the map; truck owners may choose to broadcast a truck’s live location while serving.
• Ping-a-Truck requests: when Ping a Truck is available, an approximate request area, preferences, and response status. Active pings expire automatically. The live map works without this feature.
• Mobile-vendor information: business profile, vehicle or cart details, menus, images, organization roles, and licensing information you provide.
• Purchases: subscription and entitlement information from Apple, Google, RevenueCat, or Stripe for Street Eats Official on the App Store and Google Play. Street Eats does not receive full payment-card numbers.
• Bookings: when Bookings is available, the booking details you enter (event date, time window, headcount, event address or map pin, requested amount, quotes, and the Food host’s cancellation preset), the messages between user and Food host in the booking thread, ratings and notes either side leaves, dispute and problem reports, and a payment record (amounts, status, refunds, and Stripe reference ids). Card details for booking payments are entered on Stripe’s checkout page and processed by Stripe under the Stripe Privacy Policy; Street Eats never sees your card number. User identity verification: before you can send a booking request, message a Food host, or pay, you complete Stripe Identity (a government-issued photo ID and a matching selfie) on Stripe’s hosted page. Stripe collects and checks those documents under the Stripe Privacy Policy and the Stripe Identity Terms. Street Eats receives only a verification status locked to your signed-in account (verified, checking, or not verified) and a Stripe session id. We do not store ID images, document numbers, or selfie files, and we never collect them in the Street Eats app. Verification is not shared with other Street Eats accounts and is not transferable. Food hosts that turn on Bookings give Stripe identity and bank information directly for payouts and tax reporting.
• Notifications: device push tokens and delivery status for service messages you enable.
• Website analytics: only after you allow optional analytics, we collect page, referral hostname (never the referring path or query), campaign, device, approximate country, region, city, and postal area, plus selected actions such as social-profile, partner-profile, directions, signup, city-request, FAQ, and product-link interactions. We use random first-party browser and session identifiers to estimate repeat devices and sessions; these counts do not identify a known person and reset if site storage is cleared. For abuse prevention, the server keeps a salted request hash that rotates daily and expires after a short period. We do not store the website visitor’s raw IP address or collect precise GPS location through the marketing website.
• Launch-city requests: the ZIP code you submit and the city and state resolved from it. The ZIP is sent to a lookup provider, then stored with its resolved city and state so we can measure local demand. No email is required, public reporting is aggregate only, and the raw IP address is not stored.
• Email signups: the email address and interest you give us for launch updates, the newsletter or press announcements, plus optional campaign labels from the page you used. Media subscriptions also keep confirmation, consent and delivery records so we can honor your choices. A name or phone number is not required for those forms.
• Contact requests: the role, topic, name, email address, optional organization, subject derived from the topic you select, and message you submit through the website contact form. We do not request a phone number, attachment, payment information, credentials, or precise location through that form. Referral-host and campaign labels may accompany the request. The application database does not store your raw IP address. Do not submit another person’s personal information unless you have a lawful basis to do so.

4. How we use information

We use information to operate discovery, live maps, menus, authentication, customer support, notifications, and payments; when Bookings is available, to run the request, quote, payment, refund, rating, and dispute steps of a booking between a user and a Food host, including confirming that the user has completed Stripe Identity before a request, message, or payment; when Ping a Truck and Hot Spots are available, to show aggregated demand; to keep the service secure and prevent fraud, spam, and abuse; to understand aggregate usage so we can improve Street Eats; to respond when you contact us; and to satisfy legal obligations. Submitting a contact request authorizes us to use the details you provide only to evaluate and reply to that request and related follow-up. It does not create a paid engagement, attorney-client relationship, or guaranteed response time. We do not use your personal information for third-party behavioral advertising, and we do not sell it.

5. How Ping-a-Truck protects location

When Ping a Truck is live, a customer ping is reduced to an approximate area and shown to mobile vendors only as aggregated demand. Vendors see the Hot Spot and active request count, not the identities or raw locations of the people inside it. A more precise meeting point is shared only when a user chooses to provide it after a truck responds. The live map does not require a ping.

6. When we share information

We share personal information only in these circumstances:

• Service providers: vendors that process data on our behalf under contract, including Supabase (hosting and database), AWS Amplify (website hosting), Apple, Google, RevenueCat, and Stripe (purchases), Expo notification services, Cloudflare (form abuse prevention), Resend (delivery of contact notifications and opt-in media email), our coarse website geolocation provider, and a ZIP lookup provider for launch-city requests.
• Legal and safety: when reasonably necessary to comply with law, enforce our Terms, protect the rights, property, or safety of users, the public, or Street Eats, or respond to lawful requests from authorities.
• Business transfers: as part of a merger, acquisition, financing, or sale of assets, subject to this policy’s commitments.
• With your direction: when you ask us to share something, for example, choosing to reveal a meeting point to a responding vendor.
• Between the parties to a booking: when Bookings is available, the Food host you book sees your name, the event address or pin, headcount, messages, and payment status for that booking, and you see the Food host’s business details and crew names. The Food host does not receive your government ID, selfie, or Stripe Identity documents. Ratings are revealed to the other side only after both have rated or the rating window closes. If a booking is disputed, we may share the thread and payment records with Stripe or the card issuer as evidence.

When you choose an external Instagram, Facebook, Google Maps, partner, or research link, the destination receives the request under its own privacy terms. Street Eats records only a controlled destination label for first-party reporting, not the content of your activity after you leave the site.

7. Cookies and analytics

The marketing website uses first-party analytics only. We do not use Google Analytics, Meta Pixel, or other third-party advertising trackers, and we do not run cross-site tracking. Random first-party identifiers stored in your browser support approximate visitor and session counts and reset when you clear site data. Optional analytics remain off unless you choose “Allow analytics.” You can change that choice at any time with the accessible Privacy choices control shown on every page.

8. Retention

We retain information only as reasonably needed to provide the service, satisfy legal obligations, resolve disputes, and prevent abuse. Contact-form submissions are ordinarily deleted after 12 months unless the conversation becomes part of an active business, support, legal, or safety relationship that reasonably requires longer retention. Short-lived salted contact-form abuse counters are deleted after seven days. Expired pings are removed from active use automatically. Backup copies may persist for a limited period after deletion until overwritten in the ordinary course of operations. Marketing page visits and controlled action events are ordinarily deleted after 13 months. Anonymous launch-city request identifiers and submitted ZIP values are deleted after 90 days. Launch-notification and newsletter signups are ordinarily deleted after 24 months unless you unsubscribe sooner or an active business or legal hold applies. We keep confirmed media subscriptions while you remain subscribed. Unconfirmed requests expire after 24 hours and are removed after 30 days. Media delivery records are removed after 90 days; unsubscribed records are kept for up to 24 months to honor the unsubscribe. Booking records, payment and refund history, and dispute reports are kept for as long as tax, payment-network, and record-keeping rules require, typically up to seven years after the booking, because they document a sale made by the Food host through Stripe. Booking messages and ratings are kept with the booking they belong to. Bookings identity verification status stays on your account so you do not repeat Stripe Identity for later bookings; Stripe retains the underlying ID and selfie under Stripe’s retention rules. Deleting your account removes your profile, but booking and payment records needed for those obligations are retained in a form limited to what the rules require.

9. Security

We use administrative, technical, and organizational safeguards appropriate to the nature of the data, including encryption in transit, access controls that restrict stored contact submissions to authorized service operations, verification challenges to block automated abuse, and salted hashing in place of stored IP addresses. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; we work to protect information commensurate with its sensitivity. You are responsible for keeping any account credentials confidential.

10. Your choices

You may turn off location or notifications in device settings at any time. You may delete your Street Eats Official account in the app or from the delete-account page. Deleting an Official account does not cancel App Store or Google Play billing by itself. You may clear an active ping in the app when that feature is available. Clearing browser site data resets the random identifiers used for approximate website visitor and session counts. You may decline to provide optional information; some features that depend on it may not work. You can change website analytics at any time with Privacy choices. You may unsubscribe from launch or newsletter email by contacting us. Media announcement emails include an unsubscribe link; joining the media list requires email confirmation.

11. U.S. state privacy rights

Depending on where you live, including under the California Consumer Privacy Act as amended, the Texas Data Privacy and Security Act, and similar laws in Colorado, Connecticut, Virginia, Utah, Oregon, Montana, and other states, you may have the right to:

• Know and access the personal information we hold about you, including a portable copy.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions.
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, and certain profiling. Street Eats does not sell personal information or share it for cross-context behavioral advertising.
• Not receive discriminatory treatment for exercising these rights.

To exercise any right, contact us using the details in Section 15. We will verify your request using information associated with your account or submission and respond within the time required by your state’s law. We may decline requests that we cannot verify, that are unfounded or excessive, or that conflict with a legal obligation or permitted exception. If we decline a request, you may appeal by replying to our decision, and we will explain the outcome. Authorized agents may submit requests where state law provides for them.

12. Do Not Track and opt-out signals

We honor browser Do Not Track and Global Privacy Control signals by disabling optional first-party analytics and removing our analytics identifiers from browser storage. These signals do not prevent a form you deliberately submit from being processed, or strictly necessary abuse-prevention and security controls from operating.

13. Children

Street Eats is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it consistent with the Children’s Online Privacy Protection Act. If you are between 13 and the age of majority where you live, you may use Street Eats only with a parent or guardian’s permission where required.

14. Where data is processed

Street Eats is operated from the United States. Information may be processed in the United States and other locations where our service providers operate, subject to appropriate safeguards.

15. Changes and how to reach us

We may update this policy as Street Eats develops. The effective date above will change when material revisions are published, and we will take reasonable steps to highlight significant changes. Continued use of Street Eats after a posted update means you accept the revised policy, except where applicable law requires additional notice or consent. For privacy questions, access, correction, deletion, or appeal requests, contact Buhrn Technologies LLC, a Texas limited liability company headquartered in Houston, Texas, by email at socials@eatonthestreets.com or through the contact form using the “Privacy” topic.