Privacy policy

Effective October 11, 2026

VendorBook is made by SoloFive LLC. It helps food trucks, carts and stands find where to sell, get booked and keep track of what pays. This page says what we collect, why, who else handles it, and how to get it deleted. Questions: support@vendorbook.app.

The short version: we collect only what the app needs to work, we never sell your information, and we don't use ad trackers.

What we collect and why

When you sign up to hear about the launch

Your email, whether you run a truck or a venue, and the name, city and ZIP code if you give them. We use these only to tell you when VendorBook launches near you, and the ZIP code to see where people want it next. If you're a truck outside the areas we serve yet, your sign-up waits here until we open in your area. The launch email, sent through Postmark on a separate stream for bulk mail, says how to stop emails from us: reply STOP, or use its unsubscribe link. We also keep a scrambled (one-way hashed) version of your internet address to stop spam sign-ups.

Your account

Your email address: from the sign-in code we email you, or from Apple or Google if you sign in with them. If you sign in with Apple, we keep a token from Apple so that deleting your account also disconnects VendorBook from your Apple ID. If you run a truck, also your truck's name and home ZIP code (or home city), which tells us your area: what's near you and your time zone. If you're looking for a truck for an event, your city. We keep a scrambled copy of an email (not the email itself) that has used the free week, so the free week is once per email. We keep a short log of sign-in code emails and wrong-code tries for each address to stop abuse (see how long below). When someone asks for a sign-in code on the website, or uses Book us on a truck's page, we also keep a scrambled (one-way, salted) copy of their internet address, never the address itself, only to limit how many codes can be sent. It's deleted after 1 day.

Truck subscriptions

If you subscribe, we keep your subscription status, where it's through (Apple, Google or our website), the product and when it renews. This comes to us through RevenueCat. In the app, Apple or Google handles the payment. On our website, RevenueCat runs the checkout and Stripe handles the card, so your email and card go to them; we never see your card details. Deleting your account cancels a subscription bought on our website.

Event requests

If you ask trucks to cater an event, we keep what you enter: the type of event, date and time, number of guests, the event address, foods, budget and notes, and your phone number if you add one. Trucks you ask see the event details and your city only. The truck you choose also gets your email, phone and event address, so you can settle the menu. We get a notification of each request so we can help if a truck can't be reached.

Reports and blocks

If you report a request, answer or fill-in, we keep who reported, what was reported, the reason (spam, abuse, fake or other) and anything you add. We review reports. If you block someone, we keep who you blocked so you don't see them. Neither is shown to the other person.

If you send us a message from Help & feedback (in the app or on the support page), we keep what you wrote, the topic, the email to reply to, your account if you're signed in, the app version, phone system and screen you sent it from, and a scrambled copy of your internet address to stop spam. It's also emailed to us so a person can reply.

What you add in the app

• Stops you log: where and when, whether it was slow, OK or busy, and your sales and the venue's fee if you enter them.
• Booking requests: the venue, the day, how you asked and the email or phone you sent it to. The message itself goes from your own email or phone; we don't read it.
• Paperwork: the permits you add, when they run out, and your notes.
• Fill-ins: the booking you offer and the contact you choose to share.
• Reminders: the events whose application deadlines you asked us to remind you about.
• Directory listings: the truck or venue details you submit and a contact so we can confirm it, plus a scrambled (one-way, salted) copy of your internet address to limit spam. We blank that after 30 days.
• My page: what you add to your truck's page: a headline, About, menu, colors, the phone, email and social links you choose to show, and photos (a truck photo, a logo, food photos and dish photos). Photos are stored with Supabase. All of it is public on your truck's page, and photo links can be opened by anyone who has them.
• Reading a menu photo: if you ask us to read your menu from a photo, the photo goes to Anthropic, our AI provider, to pull out the dishes and prices for you to check. We don't keep that photo. For each AI request we keep a short record: which feature, your account, when, how much it used, whether it worked, and whether you kept the result. Not the photo or what it wrote. We use it for daily limits and to see what the feature costs.

When a venue posts an opening

If you post an opening for trucks on our Venues page (no account needed), we keep what you enter: the venue, its address and city, the date and time, how many trucks, the fee, your notes, your name if you give it, and the email or phone you give for trucks to reach you. We check each opening before it shows. Once we approve it, the opening, with your name and that contact, is shown to trucks in the app and in the Monday text, and on our public map of where trucks will be, so trucks can reach you directly. We also keep a scrambled (one-way, salted) copy of your internet address to limit spam posts, and blank it after 30 days.

Your location

Only when you allow it. We use it to rank places near you for that request and don't save it to your account (our hosting provider's request logs may hold it for a few days). If you turn on openings alerts (in the app or on the website), we keep an approximate area, rounded to about a mile, and the distance you choose, so we know which openings to tell you about.

Alerts

If you turn on notifications, we keep the address your browser or phone gives us for sending them.

The Monday text

If you sign up, your phone number, truck name, home city, when you agreed, and the replies you send us (like STOP).

Technical logs

Our hosting and network providers record basic request details, like internet address and browser type, to keep the service running and secure.

What other people can see

• Event requests: trucks you ask see your event details and city. Only the truck you choose gets your email, phone and event address.
• Fill-ins: when another truck takes a fill-in you offered (or you take one), you each see the other's contact so you can sort out the details. We say so before you share.
• Directory: once we approve a listing, its name, food, city, address, website, Instagram and how to book are public, and for a truck, the phone for customers if you give one (in our directory and on our public map). For a truck, the contact you gave us to confirm it stays private; for a venue, the contact you give for booking is shown to trucks.
• Venue openings: once we approve an opening, its details, the name you gave and the contact for trucks are shown to trucks in the app and in the Monday text, and on our public map.
• Busy or slow: how busy a spot was is pooled across trucks without names, so everyone learns which places work. Your sales and fees are never shared. The pooled, nameless information can stay after you delete your account.
• Your public truck page: shows what you add on My page, and your confirmed bookings only if you turn that on.

Information about trucks and venues from public sources

To show where trucks work, we gather public information: venue and event calendars, county health permit lists, business listings from Google, and trucks' public Instagram posts. We hide listings that look like someone's home. If you run a truck or venue and want something corrected or removed, email support@vendorbook.app.

Contacting trucks: we keep a private list of food trucks we may contact. It holds public business contact details we find on trucks' own websites and public listings (Google, county permit lists, Instagram, Facebook and public web searches through Brave Search): the truck's name and city, its business email, phone, website and social links, the owner's name if the truck's website publishes it, and the picture the truck's website shows when it's shared (kept as a small copy). We use these details to tell a truck about an event request a customer sent it, and to email trucks about VendorBook itself, through an email-sending service. The list stays on our own computer, isn't shown in the app, and isn't sold or shared.

Opting out: to stop these emails, reply to any of them and ask us to stop, or write to support@vendorbook.app. We stop, and put the address on our do-not-contact list, so it's never emailed again, even if we find it again later. To have your truck's entry removed from the list altogether, ask in the same way.

Who else handles your information

We use these companies to run VendorBook. They handle information only to provide their service to us:

• Supabase: our database and sign-in.
• Apple and Google: signing in, if you choose Continue with Apple or Continue with Google. They tell us your email address.
• Postmark: emailing sign-in codes and other messages.
• Vercel: hosting the website and the app's server.
• Cloudflare: our domain and our email addresses, and the web addresses of trucks' own pages (name.vendorbook.app), which pass through it. It sees your internet address and browser type, like our hosting provider, and email you send us passes through it on the way to our inbox.
• Twilio: sending and receiving the Monday text.
• RevenueCat: keeping track of truck subscriptions, and the checkout for subscribing on our website.
• Stripe: card payments for subscriptions bought on our website.
• Apple and Google: the app stores, which handle subscription payments and deliver notifications.
• Google: maps, place and address lookups. On iPhone, the map in the app is Apple Maps.
• Apple, Google and Mozilla: delivering website notifications, if you turn them on in your browser.
• OpenStreetMap (Nominatim) and the US Census Bureau: turning addresses into points on the map. They get the address, not who it belongs to.
• OpenStreetMap: the map pictures on our public map page. Your browser loads them straight from OpenStreetMap's tile servers, so OpenStreetMap sees your IP address, your browser type and which part of the map you're looking at, under its own privacy policy (osmfoundation.org/wiki/Privacy_Policy). It doesn't get your account details.
• Anthropic: reading trucks' public Instagram posts to find their schedules, and reading a menu photo when a truck asks for it. It gets the photo, not your email or other account details.
• Brave Search and an email-sending service: finding public contact details for trucks and emailing trucks about VendorBook (see above).

We don't sell or rent your information, share it for advertising, or use advertising trackers. We'll share information if the law requires it.

How long we keep it

• Your account and what you add: until you delete your account.
• Launch sign-ups: until VendorBook launches in your area, or sooner if you ask us to remove yours. We delete each area's sign-ups within 30 days after we launch there; sign-ups from areas we don't serve yet stay until we open there. A sign-up without a ZIP code we can place counts toward our first area, Southern California.
• Sign-in code, Book us, text sign-up and subscription refresh logs, including the scrambled internet addresses: 1 day.
• Records of AI requests: 1 year. Deleting your account removes your account from them.
• Fill-in take logs (used for the daily limit): 2 days.
• Replies to the Monday text, HELP included: 1 year. We keep a record of STOP and START replies for as long as the number is on file, so we can show it opted out.
• Resolved reports that a place is someone's home or the wrong spot: 90 days.
• The scrambled internet address on a directory listing or a venue opening: 30 days. The listing or opening itself stays until you ask us to remove it.
• Our private list of trucks to contact: until the truck asks us to remove its entry (we do it within 30 days). When we remove an entry, we keep only a scrambled (one-way hashed) copy of the truck's name with its state and county, so it isn't added back, and its emails go on the do-not-contact list below; we also remove it from the email lists we've saved for sending. Daily backup copies of the list are kept for 30 days, so a removed entry is gone from them 30 days after that.
• The do-not-contact list: for good, so we keep honoring the opt-out. We keep it as a scrambled (one-way hashed) copy of each address, never the address itself, plus the reason (for example, opted out, the email bounced, or the truck already has a VendorBook account). We use it only to avoid contacting someone again, and it stays after you delete your account.
• Help & feedback messages: until we've answered them, then 1 year. Messages from your account are deleted with it; for one you sent signed out, email us.
• Your phone's notification token: until you sign out on that phone, delete your account, or Apple or Google tells us the app is gone from the phone.
• The Monday text: until you reply STOP. We keep a record that you opted out so we never text you again.

Your choices

• Delete your account: in the VendorBook app, go to Me, then Delete account; on the website, open Account (trucks: Me, then Account), then Delete account. Or email support@vendorbook.app from your account's email and we'll do it within 30 days. Step by step: vendorbook.app/delete-account. This deletes your account and what's saved to it: your truck or customer details, stops and sales, paperwork, event requests, fill-ins, alerts, reports and blocks, messages to us, sign-in logs, your launch sign-up and your subscription record, and removes your contact from fill-ins you took and directory listings (including a listing's phone for customers). If you're the last account for your truck, it also deletes your truck's My page: its headline, About, menu, contact details and photos.
  What we keep after you delete: a scrambled copy of your email so the free week can't be used twice, and, if your truck was on our list of trucks to contact, a scrambled copy on our do-not-contact list so we don't email you about VendorBook again; the public name, food, city, address, website and Instagram of a directory listing we approved (your contact and the phone for customers are removed); pooled busy-or-slow information without names; nameless records of AI requests (until they're deleted after 1 year); a record that a phone number replied STOP; and messages you sent us while signed out (email us to delete those). Trucks you already chose keep the event details we sent them. Copies in our providers' logs and backups are gone within 45 days. Apple or Google keep their own purchase records.
• See, correct or delete anything else: email support@vendorbook.app from the address on your account, and we'll do it within 30 days.
• Stop texts: reply STOP.
• Location and notifications: turn them off any time in your phone's or browser's settings.

Your rights, wherever you live: you can ask what we hold about you, get a copy, correct it, or delete it. Email support@vendorbook.app from your account's email; we may ask you to confirm it's you. You can have someone act for you with your written permission. We answer within 30 days, and we won't treat you differently for asking. We don't sell or share personal information (as California law defines it) and don't use sensitive information to profile you.

Do Not Track: browsers can send a “Do Not Track” or Global Privacy Control signal. We don't track you across other sites, so there's nothing to turn off, and we honor Global Privacy Control as a request not to sell or share.

Security

Information is sent encrypted, and access is limited to what each part of the service needs. No system is perfect; if something goes wrong that affects you, we'll tell you promptly, as the law requires.

Children

VendorBook is for adults and isn't meant for anyone under 18. We don't knowingly collect information from children. If you think a child gave us information, email support@vendorbook.app and we'll delete it.

Changes

If we change this policy, we'll update the date at the top. For a big change, we'll tell you in the app or by email first.

Need help? Support. Delete your account: how.