Privacy Policy

1. Who we are

Street Eats is a software product owned and operated by Buhrn Technologies LLC, a Texas limited liability company headquartered in Houston, Texas (“Street Eats,” “we,” “our,” or “us”). Street Eats connects people with participating food trucks and mobile vendors through vendor-published locations, menus, and privacy-conscious demand signals. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have, wherever in the United States you use Street Eats.

2. Scope

This policy covers the Street Eats mobile applications, the eatonthestreets.com website, and communications you send us through either channel we operate. It does not cover independent businesses you discover through Street Eats. Vendors, venues, and event organizers handle any information you give them directly under their own practices. Messages you send through Instagram, Facebook, or other third-party apps are also governed by those platforms’ terms and privacy policies, not solely by this policy.

3. Information we collect

• Account information: email address, authentication details, profile, and account preferences.
• Location: location while you use the map; truck owners may choose to broadcast a truck’s live location while serving.
• Ping-a-Truck requests: an approximate request area, preferences, and response status. Active pings expire automatically.
• Mobile-vendor information: business profile, vehicle or cart details, menus, images, organization roles, and licensing information you provide.
• Purchases: subscription and entitlement information from Apple, Google, RevenueCat, or Stripe. Street Eats does not receive full payment-card numbers.
• Notifications: device push tokens and delivery status for service messages you enable.
• Website analytics: only after you allow optional analytics, we collect page, referral hostname (never the referring path or query), campaign, device, approximate country, region, city, and postal area, plus selected actions such as social-profile, partner-profile, directions, signup, city-request, FAQ, and product-link interactions. We use random first-party browser and session identifiers to estimate repeat devices and sessions; these counts do not identify a known person and reset if site storage is cleared. For abuse prevention, the server keeps a salted request hash that rotates daily and expires after a short period. We do not store the website visitor’s raw IP address or collect precise GPS location through the marketing website.
• Launch-city requests: the ZIP code you submit and the city and state resolved from it. The ZIP is sent to a lookup provider, then stored with its resolved city and state so we can measure local demand. No email is required, public reporting is aggregate only, and the raw IP address is not stored.
• Contact requests: the role, topic, name, email address, optional organization, subject derived from the topic you select, and message you submit through the secure contact form. We do not request a phone number, attachment, payment information, credentials, or precise location through the website contact form. Referral-host and campaign labels may accompany the request, but the application database does not store your raw IP address. Do not submit another person’s personal information unless you have a lawful basis to do so.

4. How we use information

We use information to operate discovery, live maps, menus, Hot Spots, authentication, customer support, notifications, and payments; to keep the service secure and prevent fraud, spam, and abuse; to understand aggregate usage so we can improve Street Eats; to respond when you contact us; and to satisfy legal obligations. Submitting a contact request authorizes us to use the details you provide only to evaluate and reply to that request and related follow-up. It does not create a paid engagement, attorney-client relationship, or guaranteed response time. We do not use your personal information for third-party behavioral advertising, and we do not sell it.

5. How Ping-a-Truck protects location

A customer ping is reduced to an approximate area and shown to mobile vendors only as aggregated demand. Vendors see the Hot Spot and active request count, not the identities or raw locations of the people inside it. A more precise meeting point is shared only when a user chooses to provide it after a truck responds.

6. When we share information

We share personal information only in these circumstances:

• Service providers: vendors that process data on our behalf under contract, including Supabase (hosting and database), AWS Amplify (website hosting), Apple, Google, RevenueCat, and Stripe (purchases), Expo notification services, Cloudflare (contact-form abuse prevention), Resend (delivery of contact notifications), our coarse website geolocation provider, and a ZIP lookup provider for launch-city requests.
• Legal and safety: when reasonably necessary to comply with law, enforce our Terms, protect the rights, property, or safety of users, the public, or Street Eats, or respond to lawful requests from authorities.
• Business transfers: as part of a merger, acquisition, financing, or sale of assets, subject to this policy’s commitments.
• With your direction: when you ask us to share something, for example, choosing to reveal a meeting point to a responding vendor.

When you choose an external Instagram, Facebook, Google Maps, partner, or research link, the destination receives the request under its own privacy terms. Street Eats records only a controlled destination label for first-party reporting, not the content of your activity after you leave the site.

7. Cookies and analytics

The marketing website uses first-party analytics only. We do not use Google Analytics, Meta Pixel, or other third-party advertising trackers, and we do not run cross-site tracking. Random first-party identifiers stored in your browser support approximate visitor and session counts and reset when you clear site data. Optional analytics remain off unless you choose “Allow analytics.” You can change that choice at any time with the accessible Privacy choices control shown on every page.

8. Retention

We retain information only as reasonably needed to provide the service, satisfy legal obligations, resolve disputes, and prevent abuse. Contact-form submissions are ordinarily deleted after 12 months unless the conversation becomes part of an active business, support, legal, or safety relationship that reasonably requires longer retention. Short-lived salted contact-form abuse counters are deleted after seven days. Expired pings are removed from active use automatically. Backup copies may persist for a limited period after deletion until overwritten in the ordinary course of operations. Marketing page visits and controlled action events are ordinarily deleted after 13 months. Anonymous launch-city request identifiers and submitted ZIP values are deleted after 90 days. Launch-notification signups are ordinarily deleted after 24 months unless an active business or legal hold applies.

9. Security

We use administrative, technical, and organizational safeguards appropriate to the nature of the data, including encryption in transit, access controls that restrict stored contact submissions to authorized service operations, verification challenges to block automated abuse, and salted hashing in place of stored IP addresses. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; we work to protect information commensurate with its sensitivity. You are responsible for keeping any account credentials confidential.

10. Your choices

You may turn off location or notifications in device settings at any time. You may clear an active ping in the app. Clearing browser site data resets the random identifiers used for approximate website visitor and session counts. You may decline to provide optional information; some features that depend on it may not work.

11. U.S. state privacy rights

Depending on where you live, including under the California Consumer Privacy Act as amended, the Texas Data Privacy and Security Act, and similar laws in Colorado, Connecticut, Virginia, Utah, Oregon, Montana, and other states, you may have the right to:

• Know and access the personal information we hold about you, including a portable copy.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions.
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, and certain profiling. Street Eats does not sell personal information or share it for cross-context behavioral advertising.
• Not receive discriminatory treatment for exercising these rights.

To exercise any right, contact us using the details in Section 15. We will verify your request using information associated with your account or submission and respond within the time required by your state’s law. We may decline requests that we cannot verify, that are unfounded or excessive, or that conflict with a legal obligation or permitted exception. If we decline a request, you may appeal by replying to our decision, and we will explain the outcome. Authorized agents may submit requests where state law provides for them.

12. Do Not Track and opt-out signals

We honor browser Do Not Track and Global Privacy Control signals by disabling optional first-party analytics and removing our analytics identifiers from browser storage. These signals do not prevent a form you deliberately submit from being processed, or strictly necessary abuse-prevention and security controls from operating.

13. Children

Street Eats is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it consistent with the Children’s Online Privacy Protection Act. If you are between 13 and the age of majority where you live, you may use Street Eats only with a parent or guardian’s permission where required.

14. Where data is processed

Street Eats is operated from the United States. Information may be processed in the United States and other locations where our service providers operate, subject to appropriate safeguards.

15. Changes and how to reach us

We may update this policy as Street Eats develops. The effective date above will change when material revisions are published, and we will take reasonable steps to highlight significant changes. Continued use of Street Eats after a posted update means you accept the revised policy, except where applicable law requires additional notice or consent. For privacy questions, access, correction, deletion, or appeal requests, contact Buhrn Technologies LLC, a Texas limited liability company headquartered in Houston, Texas, by email at socials@eatonthestreets.com or through the secure contact form using the “Privacy” topic.