Privacy Policy

• Account info: when you sign up with email or Google, we receive your name, email address, and (for Google) your profile picture. Passwords are handled by our auth provider and never stored by us in plain text.
• Profile: display name, bio, home city, avatar, and any cosmetic items you select.
• FestDash orders: to deliver to you, we collect your order, delivery window, campsite/landmark details, phone number, optional campsite/vehicle photos, and — only if you grant permission — a one-time GPS location to help your runner find you.
• Payments: card payments are processed by Stripe; we do not store full card numbers. We retain order totals, store-credit balances, and referral/commission records.
• Usage: anonymous, privacy-light analytics (page paths, an anonymous browser id, referrer) to understand site traffic. No third-party advertising trackers.

To create and secure your account; operate the marketplace and FestDash deliveries; process payments and escrow; run referrals, store credit, and commission codes; send service and owner notifications; prevent abuse; and improve the site.

• Vendors & runners: for a FestDash order, the assigned vendor and delivery runner receive the details needed to fulfill it (your name, delivery location, contact, and order).
• Service providers: Supabase (database/auth), Stripe (payments), Vercel (hosting/analytics), Google (sign-in), and ntfy (operator notifications). They process data only to provide their service.
• Legal: when required by law or to protect users and the platform.

We do not sell your personal information.

If you sign in with Google, we request only your basic profile (name, email, profile picture). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can edit your profile, and request access to or deletion of your account and associated data at any time from your account settings or by contacting us. Deleting your account removes your profile and personal data, subject to records we must retain for legal or financial reasons.

We keep personal data only as long as needed for the purposes above or as required by law, and we use industry-standard safeguards (encryption in transit, row-level access controls). No system is perfectly secure, but we work to protect your data.

NorthEDM is not directed to children under 13, and we do not knowingly collect their data.

We may update this policy; material changes will be posted here with a new date. Questions? Email support@northedm.com.