Privacy Policy

Effective September 20, 2026

1. What we collect

What you give us. Your email and password when you sign up. Your name, shop name, photo, town, radius, bio, craft categories, links, phone and email if you add them. Your pieces, photos, prices, stock counts, descriptions, sales you record, journal entries, events you save or say you’re going to, comments, likes and follows. Photos, flyers, write-ups and sales sheets you give to the AI tools.

What the Service creates. Your credit balance and ledger, membership status, referral code and referral outcomes, push notification subscriptions and preferences, and counts of profile views, link taps and card scans (as counts, not as who).

What comes with using it. Basic server logs (IP address, browser, pages requested, time) kept for security and troubleshooting, and a small number of cookies: one to keep you signed in, and one that remembers a referral code for 30 days after you follow a maker’s link or scan their card.

What we don’t collect. Your card number (Stripe handles payment and we see only the last four digits and the outcome). Your precise location: distances are worked out from the town you type, not from your device. We don’t run advertising trackers.

2. What we use it for

• Running the Service: your account, your page, your season, your calendar.
• Finding fairs near the town you gave us, and showing distances to them.
• Membership, credits, referrals, and receipts.
• Notifications you’ve turned on: likes, comments, follows, event updates, reminders.
• Keeping the Service safe: preventing abuse, fraud and scraping.
• Answering you when you write to us.

We don’t use your content to train AI models, and we don’t use your information for advertising.

3. What is public

When your page is public, anyone with the link can see your shop name, name, photo, town, bio, categories, public pieces and their public prices, links, likes and comments, and any note you post across your page. Anyone who scans your QR code or taps Save contact gets a contact card with your page link, name, shop, town and photo, plus your phone and email only if you have switched them on. The app shows you exactly what a scan shares. Makers who choose to be seen as attending an event are shown by name on that event.

Private by default and never on a public page: your sales, stock counts, journal, planner, credit balance, membership, email address, phone number, and anything you have not made public.

4. Who we share it with

We share information only with the services we need to run the app:

• Supabase hosts the database, sign-in and file storage.
• Vercel hosts the app and serves the pages.
• Stripe handles payments for membership and credits.
• OpenAI processes what you send to the AI tools (a flyer, a photo, a write-up, a sales sheet), for that request only, and does not keep it to train models.
• Tavily runs the web searches that find fairs near you; it receives the search terms (a town, a state, a fair name), not your account.
• Push services (Apple, Google, Mozilla) deliver notifications to your device; they receive the message, not your account.

We don’t sell your information. We may disclose it if the law requires it, to protect someone’s safety, or if Marts & Crafts is ever sold, in which case the buyer takes on this policy.

5. How long we keep it

As long as your account is open. When you close your account, your public page comes down at once and your content and personal information are deleted within 30 days, except for records we must keep (payment records for tax and accounting, kept 7 years) and copies other people already saved, such as a contact card on their phone. Server logs are kept 90 days. Event facts you confirmed stay with the event, without your name.

6. Your choices and rights

• See and change your information any time in Profile.
• Make your page private, or switch off phone and email on your card, at any time.
• Turn notifications off, all or by kind, in Profile → Engagement.
• Ask us for a copy of your information, or to delete your account and everything in it.

Depending on where you live you may have further rights under laws such as the GDPR or California’s CCPA, including to correct, restrict or object to how we use your information, and to complain to a regulator. Write to us and we’ll help.

7. Children

The Service is for adults. We don’t knowingly collect information from anyone under 18; if you think we have, tell us and we’ll delete it.

8. Security

Your data is encrypted in transit and at rest, access is limited by account, and sensitive details (like billing) are kept in separate, restricted storage. No system is perfect; if we learn of a breach affecting you we’ll tell you promptly.

9. Changes

We’ll update this policy when the Service changes. For changes that matter we’ll tell you in the app or by email before they take effect. The date at the top says when it was last changed.

10. Contact

Privacy questions or requests: support@martsandcrafts.app. See also our Terms of Service.