Privacy Policy

Last updated: 6 August 2026

StreetEats is a live street food discovery app for the UK. It shows customers a map of street food vendors and lets vendors share their location, status and schedule. This policy explains what personal data the app handles, why, and your rights. It applies to the StreetEats iOS app and any future versions.

StreetEats is operated from the United Kingdom. Contact for anything in this policy: streeteats.support@gmail.com.

1. If you browse the map (customers)

You do not need an account to use StreetEats as a customer, and we do not ask you for your name, email address, or any other identifying details.

• Device location — if you grant location permission, the app uses your position to centre the map near you and to show your distance from each vendor. This happens on your device. Your location is not stored on our servers and is not shared with vendors or other users. Location permission is optional; the map works without it.
• Map tiles — the map is provided by Mapbox. When the map loads, your device requests map imagery from Mapbox's servers, which involves your IP address and the map area you are viewing, and the Mapbox SDK may collect limited usage telemetry. See the Mapbox Privacy Policy.
• Vendor data — the pins, statuses and profiles you see are read from our database (Google Firebase). Requests to it include your IP address, as with any internet service, but we do not build profiles of customers or use advertising or analytics trackers.

2. If you register as a vendor

Vendor accounts are currently invite-only. When you create and use a vendor account we collect and store:

• Account details — email address and password. Passwords are handled by Firebase Authentication; we never see or store your plain-text password.
• Business profile — business name, food category, description, and optionally a phone number, website or social link, and a profile photo. This information is published in the app for customers to see.
• Location and status — your pin location (your live trading position when you go live, and a default location you choose), your trading status, trading hours, and scheduled appearances. These are published on the public map — that is the purpose of the app. When you set your status to Closed, your pin is returned to your chosen default location so your live position does not linger.
• Private notes — notes you attach to a scheduled appearance are private to your account and never shown to customers.
• Timestamps — when your account was created and when you last updated your status, used to show customers how fresh a pin is and to mark long-dormant accounts as inactive.

Your business phone number and email are used only to display your public profile and to run your account. We do not sell or share vendor data with third parties for marketing.

3. Where your data lives

Data is stored in Google Firebase (Firestore, Authentication, and Cloud Storage for profile photos) in Google's London region (europe-west2). Google acts as our data processor — see the Firebase privacy documentation. We use no advertising networks and no third-party analytics.

4. Legal bases

Under UK GDPR we rely on: contract for running your vendor account (storing your profile and publishing your pin is the service itself); consent for customer device location (the iOS permission prompt); and legitimate interests for basic service operation and security, such as processing IP addresses to deliver the app.

5. Retention and deletion

Vendor data is kept while your account exists. Past appearances remain in your schedule history. To delete your account and its data, email streeteats.support@gmail.com from your registered address and we will remove your account, profile, photo and appearance history within 30 days. We hold no customer data to delete.

6. Your rights

You have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict our processing of it. Contact us at the email above. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

7. Children

StreetEats is not directed at children under 13 and we do not knowingly collect data from them. Vendor accounts are for business operators aged 18 or over.

8. Changes to this policy

If we change this policy — for example when push notifications or customer favourites launch — we will update this page and the date at the top. Significant changes affecting vendors will also be announced by email.