Privacy Policy

We use your data only for the following purposes:

• To provide the Feedhood service: process orders, route deliveries, settle payouts, send notifications.
• To keep the marketplace trustworthy: verify food-safety certificates, review feeder + driver applications.
• To respond to customer support requests.
• To prevent fraud and abuse (account takeover, payment fraud, fake reviews).
• To improve the product (aggregated, anonymized analytics).
• To send transactional emails (order confirmations, password resets). We do not send marketing emails unless you opt in.

We do not sell your personal information to anyone, and we do not use it for targeted advertising.

We share the minimum necessary data with:

• Feeders + drivers involved in your order: the feeder sees your name, delivery address, order contents, and special instructions. The driver sees your name and delivery address while delivering. They do not see your email or full profile.
• Stripe: for payment processing and feeder payouts. Stripe's privacy policy applies.
• Supabase: our cloud infrastructure provider. Data is hosted in their Canada (Toronto) region where available.
• Google Maps + Places: to geocode the address you enter. Google receives the address text only.
• Service providers we engage from time to time (email delivery, error logging), bound by confidentiality agreements.
• Law enforcement when legally compelled (court order, subpoena). We will notify you unless prohibited by law.
• Successor entities in case of merger, acquisition, or sale, your data is treated as protected under this policy by the acquirer.

Order + financial records: kept for at least 6 years to comply with the Canada Revenue Agency's record-keeping rules. Even if you delete your account, the order rows persist in anonymized form (your name becomes "Deleted user", PII is scrubbed).

Account profile, addresses, favorites, push tokens: deleted immediately when you request account deletion. See "Your Rights" below.

Driver GPS location: retained for 90 days after the delivery completes (for dispute resolution), then deleted.

Support tickets + reviews: retained for as long as your account is active, then 3 years after deletion.

• All traffic between your device and our servers uses TLS 1.2+.
• Passwords are hashed by Supabase Auth using bcrypt.
• Database access is gated by Row Level Security policies, buyers can't see other buyers' orders, feeders can't see other feeders' menus, etc.
• Card numbers + CVV are never stored by us. Stripe (PCI-DSS Level 1 certified) handles all card data.
• Sensitive documents (food-safety certificates, driver licenses) are stored in private Supabase Storage buckets accessible only via short-lived signed URLs.
• Our team's access to your data is logged internally.

No internet service is 100% secure. We follow industry best practices but cannot guarantee absolute security.

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information in your profile (do this directly in the app).
• Delete your account (Profile → Delete my account). PII is scrubbed immediately; financial records are retained anonymously.
• Export your data in a portable format, email hello@feedhood.app.
• Withdraw consent for any optional processing at any time.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada or the BC Privacy Commissioner.

If you are in the EU/UK or California, GDPR and CCPA give you additional rights (right to object, right to data portability, etc.). Email us to exercise any of these.

Dine-in lets a buyer reserve a seat to eat in person at a feeder's place (a restaurant, or a home cook hosting guests). To make a booking work, we share what's needed between the two of you: the feeder receives the buyer's booking name, party size, and a contact phone for the reservation, and the buyer may see the feeder's address and contact details the feeder has chosen to publish.

A dine-in then happens in person and off the platform. Any information you exchange face-to-face, and anything that happens during the meeting, is outside Feedhood's systems and outside our control. We can't protect personal information you choose to share in person, and we are not responsible for in-person dine-in interactions. Please see the dine-in section of our Terms of Service for how responsibility works, and only share what you're comfortable sharing.

Feedhood is not intended for users under 13. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

Our mobile app does not use cookies. Our website uses session cookies for authentication and a small number of analytics cookies (e.g. to count page views). We do not use third-party advertising or cross-site tracking cookies.

We host data in Canada when possible. Some service providers (Stripe, Google) process data in the US, your data is protected under their respective privacy frameworks (Stripe is GDPR-compliant; Google is Privacy Shield-certified).

If we make material changes, we'll notify you in-app and update the "Last updated" date above. Continued use of Feedhood after the effective date means you accept the revised policy.

Privacy questions, data requests, or complaints: hello@feedhood.app

Feedhood, Vancouver, British Columbia, Canada