Privacy Policy

This policy describes how Vendyr LLC (“Vendyr,” “we,” or “us”) handles information in the current Vendyr web application. It is written from implemented practices, not from a wish list of features. If a practice is not described here, do not assume we do it.

1. Information we collect

• Account identity. Sign-in is Google-only. When you approve Google sign-in, we receive your Google account identifier, name, email address, and profile photo. We do not receive or store your Google password.
• Vendor profile. Business name, product categories, optional bio, Instagram handle, website, and photos you add. During onboarding, a home ZIP code is required so we can localize market discovery. That ZIP (and the city, state, and map point derived from it) is used for your own search experience. It is marked private in the profile editor and is not shown on public vendor profiles.
• Saved markets. Favorites you store to your account.
• Contributions. Market submissions, suggested listing edits, organizer claim requests (including contact email and verification notes you provide), attendance reports, written reviews, private organizer notes, photo suggestions, content flags, and any files you upload as attendance evidence.
• Organizer-provided listing content. If you manage a claimed market, listing details and photos you publish for that market.
• Technical request data. Our host receives ordinary request metadata needed to serve pages (such as IP address, user agent, and, for logged-out visitors, coarse GeoIP coordinates supplied by the host). We use that coarse location only to show nearby markets to people who are not signed in. We do not display that estimate in the interface as “your location.”

2. Signing in with Google

Authentication uses Google OAuth through Supabase Auth. Google’s own terms and privacy policy also apply to the sign-in. You can revoke Vendyr access from your Google account settings. Signing out of Vendyr ends the in-app session; access tokens are not guaranteed to fail immediately after account deletion.

3. Cookies and local storage

We use cookies that are necessary to keep you signed in. Those session cookies are set by Supabase Auth (names typically begin with sb-). We do not currently run an analytics SDK, advertising pixels, or session replay. Blocking all cookies may prevent sign-in from working.

The browser may also hold limited local keys used by the app (for example leftover local profile or favorites keys), which are cleared on logout or account deletion.

4. How public pages differ from private records

Vendyr is a vendor-facing directory. Official listing information (hours, fees, location, application links, and similar market facts) is separate from an individual vendor’s experience report.

• Public written reviews that a vendor chooses to publish may be shown with that vendor’s display name.
• Structured attendance answers — including sales, traffic, logistics, attendance details, and whether the vendor would recommend the market — are not shown as an individual’s responses. Public market intelligence for those answers is aggregate-only and is suppressed until at least five distinct contributors are represented.
• We do not publish individual sales or traffic answers, private organizer notes, moderator notes, ownership identifiers, moderation metadata, report-queue details, or private proof/evidence files on public pages.
• Private organizer notes submitted with an attendance report are visible to the market’s organizer and to Vendyr administrators for pending, needs-review, and approved reports. They are not a public review.
• Market submissions, edits, claims, and reports enter a moderation queue. Approved organizers can maintain their own listing; community contributions are reviewed before they change a public listing. Moderator-only submission notes are not used as the published market description.

5. How we use information

• Operate the directory, accounts, favorites, and search (including ZIP-based nearby sorting).
• Review contributions, organizer claims, photo suggestions, and flags.
• Let approved organizers maintain listings they manage.
• Keep the service running, debug failures, and limit abuse (including server-side rate limits).
• Provide in-app export and account deletion tools.

Vendyr does not process market applications, booth payments, vendor–organizer contracts, or acceptance decisions in the app. Those happen outside Vendyr, through links or contacts the listing provides.

We do not sell personal information, and we do not run advertising on Vendyr.

6. Who receives information

Information is processed by the services that actually host or authenticate the product:

• Supabase — authentication, database, and file storage, including private evidence and public listing photos.
• Vercel — application hosting, content delivery, and operational request logs.
• Google — OAuth sign-in. Browsers may also request Google-hosted profile photos.
• Google Fonts — the app loads Inter and Outfit from Google Fonts stylesheets, which exposes ordinary browser request metadata to Google’s font hosts.
• Remote image hosts, including Unsplash — default market images and any HTTPS images used in listings or profiles are fetched by the visitor’s browser from those hosts.

If you follow an external market, Instagram, or website link, that destination receives whatever your browser sends under our referrer policy. We may also disclose information if required by law, to protect users or the service, or as part of a business transfer.

7. Data retention

Account profile data is kept while the account is active. We do not currently publish a separate timed retention schedule for operational logs, backups, or rejected/superseded proof files.

If you delete your account, we remove the auth user, profile, favorites, private evidence, profile photos, pending or rejected photo suggestions, and other owned contribution rows. We keep legitimately public, market-owned listing assets: organizer listing photos and approved community listing photos. Approved photo-suggestion records that back those public copies are kept and anonymized (the contributor label becomes “Deleted contributor” and the user id is cleared). Private original suggestion files are deleted. Merged market listing facts may remain as directory information without your account attached.

8. Deleting your account

You can delete your account from your profile. Deletion cannot be undone. Public market listing photos that belong to a market stay in the directory without your name, as described above.

9. Exporting your data

You can download a machine-readable export of data Vendyr holds about your account from your profile. The export covers your profile and owned contribution records that the current export path reads.

10. Choices we actually provide

In the current product you can edit your profile, export your data, and delete your account while signed in. We do not currently operate a separate privacy-request portal. If applicable law gives you additional rights, use the privacy contact below when a working address has been published. We may need to verify that a request comes from the account holder.

11. Children

Vendyr is intended for adults exploring or running vendor businesses. It is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe a child has created an account, contact us using the privacy contact below when it is published and we will delete the account.

12. Where information is processed

Vendyr is operated from the United States. Supabase, Vercel, and Google may process information in the United States and in other countries where they operate. We do not currently publish a separate list of subprocessors beyond the destinations in section 6.

13. Changes

If we change this policy, we will update the “Last updated” date. Material changes may also be noted in the product. Continued use after an update means the revised policy applies to later use.

14. Contact

Privacy questions: privacy@vendyr.app Support: support@vendyr.app See also our Terms of Service.