Privacy Policy

GrubScout (“we”, “us”, “our”) operates the GrubScout web application and related services that help users discover food trucks and breweries in San Diego County. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using GrubScout, you agree to the collection and use of information in accordance with this policy.

Account information. When you create an account we collect your email address and, depending on sign-up method, your name, profile photo, and (for phone sign-in) your phone number.

Location. If you grant permission, we use your device location to show food trucks and breweries near you. You can revoke this at any time in your browser or device settings.

Usage data. We collect basic usage data — pages viewed, features used, follows, favorites, and notification preferences — to operate and improve the service.

Operator information. If you list a food truck or brewery, we collect business details (name, address, contact info, hours, menu, photos) and payment information processed by Stripe.

Communications. If you send us email, SMS, or push notification responses, we keep records of those communications.

• To provide and operate the GrubScout service
• To show you relevant trucks and breweries based on location and preferences
• To send notifications you’ve opted into (push notifications, SMS, email)
• To process subscription billing and one-time purchases via Stripe
• To respond to support requests
• To detect and prevent fraud, abuse, or illegal activity
• To comply with legal obligations

We use the following third-party services to operate GrubScout. Each receives only the data necessary to perform its function:

• Supabase — database, authentication, file storage
• Stripe — payment processing for operator subscriptions and commissions
• Twilio — SMS delivery for phone sign-in and operator outreach
• Firebase Cloud Messaging — push notifications
• SendGrid — transactional and notification emails
• Mapbox — map tiles and geocoding
• Vercel — application hosting
• Google & Apple — federated sign-in (only if you choose those methods)

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

GrubScout uses cookies and browser local storage to keep you signed in, remember your preferences, and cache map data for performance. You can clear these from your browser at any time, but doing so will sign you out and reset your preferences.

We retain account data for as long as your account is active. If you delete your account, we delete your personal information within 30 days, except where retention is required by law (e.g., payment records for tax purposes) or necessary to resolve disputes.

You can:

• Access and update your account information from your account settings
• Delete your account by contacting support
• Opt out of marketing emails using the unsubscribe link
• Disable push notifications in your device settings
• Revoke location permission in your browser or device settings

California residents have additional rights under the CCPA, including the right to know what personal information we have collected and the right to request deletion. Email privacy@getgrubscout.com to exercise these rights.

GrubScout is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

We use industry-standard security measures including TLS encryption in transit, encryption at rest for sensitive fields, and access controls on our infrastructure. No system is perfectly secure, but we work to protect your information.

We may update this policy from time to time. The “Last updated” date at the top reflects when it was most recently revised. Material changes will be notified via the app or email.

Questions about this policy or your data: privacy@getgrubscout.com