Privacy

What we collect

You can read the directory without an account. If you create one, we keep the email and a password hash (Supabase stores the hash, not the password), or, if you continue with Google, the email, name, account id, and avatar URL Google sends us. You also choose a display name. Onboarding can store markets you care about.

Posts, reviews, your display name, and avatar are public on the site. Saves, listing claims tied to an account, and the last time we emailed you a week plan stay private.

You can claim a hall or stall without signing in. That form sends us your name, email, optional phone, role, business, website or Instagram, and notes. We use a hashed address of the request only to slow repeat sends.

Nearby markets can use your location if you allow it in the browser. Those coordinates stay on your device. We do not send them to our servers.

Cookies, storage, and analytics

Sign-in needs cookies for the session and to remember where to send you after Google or email confirm. Signed-in saves may also sit in this browser so the site feels instant. We use this browser to remember that you dismissed the sign-in slip or home walkthrough. Google sign-in keeps a short handoff in session storage, then drops it.

Most pages load Google Analytics 4 and Vercel Analytics. They see the pages you open, device type, and, for Google, a rough location from IP. Callbacks under /auth are kept out of analytics. Login and signup are measured like the rest of the site. There is no cookie banner. Block tracking in your browser or Google's ads settings if you do not want it.

Maps load tiles from OpenFreeMap. That CDN sees your IP the way any map tile request does.

Mail

Claim notices go to us through Resend. If you ask for this week's markets from a signed-in account, Resend sends that mail to the address on the account. Confirm and password-reset mail goes through Supabase.

Who else sees it

Vercel hosts the site. Supabase holds accounts and the directory. Google handles Analytics and, if you choose it, sign-in. Resend sends the mail above. Those companies may process data outside Canada.

We do not sell personal information. We do not take payments on MarketRegular yet. We may share information if the law requires it, or to stop abuse.

Keeping it, changing it, deleting it

We keep account data while the account exists. On Account you can edit your display name and type delete to close the account. That removes the login, profile, posts, reviews, saves, and claims on our side. If you had claimed a listing, the listing stays and the claim holder is cleared. Copies can linger for a while in email, backups, hashed rate-limit rows, and analytics. You can also write noah@localgovy.com and we will do the same deletion from our side.

Children

MarketRegular is not for children under 13. The feed is public. Do not create an account for someone younger than that.

Your rights

Under PIPEDA you can ask what we hold, ask us to correct it, and ask us to delete it, subject to what the law lets us keep. Start with the account page or noah@localgovy.com. If we cannot resolve it, you can complain to the Office of the Privacy Commissioner of Canada.

Changes

If this policy changes in a way that matters, we will update the date at the top of this page.