Privacy policy

What we collect and why

• On the waitlist: your email address, which of our pages you joined from, whose invite link brought you, if any, and — if you tell us later — what you make. We use it to email you about LocalFit, and to show you how many people have joined through your own link.
• With a vendor account: your email address — and, if you sign in with Google, the name and picture Google shares with us — and the profile you give us: your business name, what you make, the events you are looking for, your city, how far you will travel, the most you would pay for a booth, your gear and permits, your shop link and who buys from you. If you press “Use my current location”, we keep that point too. We use your profile to rank events for you, and we keep what you do in your workspace — the events you save, apply to, go to or hide, your checklists and your recaps — so it is there when you come back.
• What other people see: your public page, the one your booth code opens, shows your business name, what you make, your city, your shop link and the markets you have said you are going to. A recap you write is shown to other vendors without your name — only the kind of thing you make and the month — with what you took and paid rounded to the nearest $10. Who buys from you, your booth budget and your exact location are never shown to anyone.
• When you follow a vendor: the email address or phone number you leave, your name if you give it, what caught your eye, and the market where you scanned their code. It goes to that vendor alone, so they can contact you about their events, and they can keep a private note with it. No other vendor sees it, and we do not use it to contact you ourselves.
• When a booth code is scanned: one more scan for that booth that day. We never record who scanned it, or on what.
• If you run an event: what your own public pages or our organizer form say about it, with your organization’s name and website, which the listing shows. A contact email, from the form or from those pages, is kept so we can check details with you, and is never published.
• When you send feedback: what you tell us, the page you sent it from, your account if you are signed in, and your email address if you leave one, so we can reply.
• To stop abuse: a count of how many times each email address or phone number is used on our forms in a day. The counts expire at midnight, Pacific time.
• Visits: we count page views with Vercel Web Analytics, which uses no cookies and does not follow you to other sites, and record a few steps — joining the waitlist, finishing a profile, opening an event or its application, following a vendor — never with a name, an email address or a phone number. The only cookies we set are the ones that keep a vendor signed in.

Who helps us run it

• Supabase holds our database and runs sign-in.
• Vercel hosts the site and counts its visits.
• Resend delivers our email.
• OpenAI turns the parts of a profile that matching reads — what you make, the events you are looking for, your city and how far you travel, and who buys from you — and the text of each event listing into the numbers we match them by. A profile’s text is sent each time it is saved.
• Google, if you choose to sign in with it.
• Sentry receives reports of errors on the site, without your IP address, your cookies or anything you typed.

Our database and the site are hosted in the United States. We do not sell your information, and we do not use it for advertising.

How long we keep it

• A vendor account stays until you delete it. Deleting it erases your account, your followers, your scans, your statuses, checklists and recaps, unsubscribes your address from the waitlist, and clears what your profile said about who buys from you, your booth budget and your location. Your listing stays, hidden from everyone, with what it says about the business itself — its name, what it makes, the events it looks for, its area, its gear and permits and its shop link — so that the address on your printed booth codes can never be given to someone else.
• A follow stays until the vendor removes it or deletes their account, or you ask us to remove it.
• The waitlist keeps your address until you unsubscribe. After that we keep it marked as unsubscribed, so it is never emailed again, unless you ask us to erase it.
• Feedback and event submissions stay until you ask us to remove them.
• An account whose sign-in link was never opened is deleted within two weeks.
• Backups of the database are encrypted and kept for 30 days, so something deleted can last that long in one.
• Sign-in records: Supabase’s sign-in service keeps its own log of sign-ins and sign-in requests, with the address used. Deleting your account does not clear it; ask us and we will.
• Our providers keep their own records for as long as their own policies say: Resend a log of each email it delivers, OpenAI the requests we send it, and Vercel short-lived request logs.

Your choices

• Unsubscribe with the link at the end of any email we send to the waitlist.
• Delete your vendor account from the account menu, whenever you like.
• Stop hearing from a vendor you followed by replying STOP to their text or emailing them, or ask us to remove the follow.
• Ask us to remove anything else — your waitlist address, a follow, feedback, an event submission or your sign-in records — by writing to hello@localfit.events.

Contact

Questions, or a request about your information: hello@localfit.events. When this policy changes, this page and the date at the top change with it.