Desert Diner — Privacy Policy

Last updated: June 23, 2026 Effective date: June 23, 2026

This Privacy Policy explains how Aaron Poindexter (doing business as "Desert Diner") ("Desert Diner," "we," "us," or "our") collects, uses, and shares information about you when you use the Desert Diner mobile application, our website at https://desertdiner.app, and related services (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Who we are

Desert Diner is a marketplace that connects food-truck and mobile-food vendors with customers and event organizers. The Service lets vendors publish listings and menus, lets customers discover nearby vendors, and lets users message one another, post events/flyers, request and accept bookings, and leave reviews.

Data controller / contact:

• Aaron Poindexter (doing business as "Desert Diner")
• 6505 West Magnolia Street, Phoenix, AZ 85043, USA
• Email: [email protected]

2. Information we collect

2.1 Information you provide

2.2 Information collected automatically

2.3 Information we do not collect

• Payment / card information. Desert Diner does not process payments inside the app. Any payment for food, services, or bookings happens directly between the customer and the vendor, off-platform. We never see your card or bank details.
• We do not knowingly collect data from children (see Section 9).

3. How we use your information

We use the information above to:

• Create and manage your account and authenticate you;
• Operate core features: discovery, listings, menus, events, bookings, messaging, reviews, favorites;
• Show vendors and events near your location;
• Send transactional and activity push notifications (e.g., a new message or booking request);
• Maintain safety and integrity, prevent fraud and abuse, and enforce our Terms of Service and Community Guidelines;
• Debug, monitor, and improve the Service;
• Communicate with you about the Service, including early-access updates if you joined the waitlist;
• Comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party cross-context behavioral advertising.

4. How information is shared

We share information only as described here:

• With other users, by design. Your name, profile photo, vendor listings, menus, events, reviews, and accepted public event bookings are visible to other users of the Service. Messages are visible to the people in that conversation. Do not post anything you want to keep private.
• Service providers (processors) who host and operate the Service on our behalf:
• Supabase — database, authentication, and file storage hosting. (https://supabase.com/privacy)
• Expo — push-notification delivery and app build/update tooling. (https://expo.dev/privacy)
• Apple App Store / Google Play — app distribution and, where applicable, account/device signals. (Apple, Google)
• Cloudflare — hosting (Cloudflare Pages) and DNS for our marketing/waitlist website. (https://www.cloudflare.com/privacypolicy/)
• Legal and safety: when required by law, subpoena, or to protect the rights, safety, or property of Desert Diner, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5. Location data — details

• Location is requested only when you use a feature that needs it (discovering nearby trucks, setting a listing location, or tagging an event).
• We request "while in use" permission only. We do not collect background location.
• You can deny or revoke location permission at any time in your device settings; the app will fall back to a default region (Phoenix, AZ) for discovery, and location-dependent features will be limited.

6. Data retention

• We keep account information for as long as your account is active.
• Content you post (listings, reviews, messages, events) persists until you or the other party deletes it, or until your account is deleted.
• Waitlist entries are retained until launch outreach is complete or you ask us to remove you.
• After account deletion, we delete or de-identify your personal information within 30 days, except where we must retain it to comply with law, resolve disputes, or enforce agreements. Backups are purged on their normal rotation.

7. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information (you can edit most profile data in-app);
• Delete your account and associated personal information;
• Object to or restrict certain processing;
• Port your data to another service;
• Withdraw consent (e.g., turn off location or push notifications).

To exercise these rights, email [email protected]. We will verify your request and respond within the time required by applicable law. We will not discriminate against you for exercising your rights.

In-app controls:

• Edit profile data in the app.
• Turn off push notifications in your device settings.
• Revoke location permission in your device settings.
• Request account deletion via the in-app Settings screen (Settings → "Delete my account"), which permanently removes your account, listings, messages, reviews, bookings, and events. (Apple and Google require apps that support account creation to also offer in-app account deletion.)

California (CCPA/CPRA)

California residents may request the categories and specific pieces of personal information collected, the purposes, and the third parties with whom it is shared, and may request deletion or correction. We do not sell or "share" (for cross-context behavioral advertising) personal information.

EEA/UK (GDPR)

If you are in the EEA or UK, our legal bases for processing are: performance of a contract (operating your account and the Service), consent (location, push notifications, waitlist), legitimate interests (security, fraud prevention, improving the Service), and legal obligation. You may lodge a complaint with your local supervisory authority.

8. Security

We use industry-standard measures to protect your information, including encryption in transit (HTTPS), hashed passwords, and database-level Row-Level Security so users can access only the data they are authorized to see. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children's privacy

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact [email protected] and we will delete it.

10. International users

We operate the Service from the United States. If you access it from outside the U.S., your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country.

11. Third-party links and content

Listings, events, and messages may contain links or references to third-party sites or services we do not control. This Policy does not apply to them; review their privacy policies separately.

12. Changes to this Policy

We may update this Policy from time to time. We will post the new version with a revised "Last updated" date and, for material changes, provide notice in the app or by email. Continued use after changes take effect constitutes acceptance.

13. Contact us

Questions or requests? Contact:

• Aaron Poindexter (doing business as "Desert Diner")
• [email protected]
• 6505 West Magnolia Street, Phoenix, AZ 85043, USA

This document is a template prepared to reflect how the Desert Diner app currently works. It is not legal advice. Have it reviewed by a qualified attorney for your jurisdiction before you publish or launch.