Privacy Policy
Last updated: April 22, 2026
FoodTrukt ("we," "us," or "our") operates the FoodTrukt platform, including our website and mobile applications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.
Information We Collect
Account information (name, email, hashed password), optional profile details, location data with permission, usage data (page views, searches, IP, device), payment info processed by Stripe (we never store full card numbers), and user-generated content (reviews, ratings, photos, catering inquiries).
How We Use Your Data
To operate the platform; to display nearby food trucks; to send opt-in push notifications about flavorited trucks, new trucks, and events; to manage accounts and process subscription payments; to detect fraud and abuse; to improve our service through aggregated analytics.
Data Sharing and Third Parties
We do not sell personal information. We share limited data with: Stripe (billing), MapLibre/OpenFreeMap (map tiles), Google Sign-In or Apple Sign-In (only if you choose to use them), Firebase Cloud Messaging (push notifications), Twilio (SMS verification only), and as required by law.
Google Calendar (operators only, optional)
If a food truck operator chooses to connect Google Calendar, FoodTrukt requests the https://www.googleapis.com/auth/calendar.app.created OAuth scope. Under this scope, FoodTrukt can only create and manage a single dedicated calendar that we create on the operator's behalf (named "FoodTrukt — <Truck Name>"). We cannot read, list, modify, or delete any other calendar in the operator's Google account, and we never access the operator's personal events. The dedicated calendar contains only the operator's own published food truck schedule, live location broadcasts, and specials — the same information that is publicly visible on their truck profile. The operator's email address is also collected from Google to display which account is connected.
Limited Use: FoodTrukt's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not share it with third parties except as needed to provide the user-requested feature, do not allow humans to read it (except for security debugging or with the operator's explicit consent), and do not transfer it.
The operator can disconnect at any time from Operator Dashboard → Schedule → Sync with Google Calendar → Disconnect. Disconnecting revokes our access token at Google and removes all stored credentials and event mappings from our database.
Push Notifications and Location Tracking
Both are entirely opt-in. We do not continuously track your location in the background. Location data is used in real-time and not persistently stored on our servers.
Cookies and Local Storage
We use cookies and local storage for authentication, theme preference, and notification preferences. We do not use third-party advertising cookies.
Data Retention
Account data is retained until you delete your account. Reviews may be anonymized rather than deleted to preserve rating integrity. Aggregated analytics retained for up to 24 months. Payment records retained for ~7 years per tax law. Location broadcasts cleared when an operator stops broadcasting.
Your Rights
You may request access, correction, deletion, or export of your personal data by emailing [email protected]. We respond within 30 days. California residents have additional CCPA rights including the right to know and the right to delete. We do not sell personal information.
Children's Privacy
FoodTrukt is not directed at children under 13. We do not knowingly collect personal information from children under 13.
Data Security
We use TLS encryption in transit, hashed password storage, secure API authentication, and regular security reviews. No method of transmission is 100% secure.
Contact Us
Questions about this policy? Email [email protected].
