Privacy policy
Last updated: July 2026
This privacy policy explains what information Smakspor collects, why, and what rights you have.
Who is the data controller
Smakspor is the data controller for the personal data described here. Contact us via the email address registered for the project with any questions.
What we collect
Account information (email) when you log in; profile settings; food trucks you follow; a push endpoint if enabled; problem-report content; and virtual-coffee payment details such as amount, status, Stripe identifiers and the payer email returned by Checkout. For abuse prevention, reports, geocoding and checkout requests retain only a one-way hash of the requesting IP address for up to 48 hours — not the raw address.
What we don't collect
We never store your location. Geolocation is used only locally in your browser to center the map, and is never sent to our servers. We don't use tracking or marketing cookies, and no third-party analytics tools that follow you across websites.
Why we process this data
To provide account features (contract), to send notifications you've asked for (consent), and to prevent abuse of the problem-report feature (legitimate interest).
Who we share data with
Supabase (database, authentication, storage — EU region), Resend (email), Mapbox (map services), Stripe (voluntary payments), and Vercel (hosting). These providers process data to deliver their respective service.
Food truck owners' email addresses
A food truck's own data (name, menu, photos, address) is public by nature — it's their advertising. But a truck owner's email address is never shared publicly.
Cookies
We use strictly necessary sign-in cookies. Functional browser storage remembers a dismissed support prompt for seven days and session-only engagement counters; it is not used for advertising or cross-site tracking.
Your rights
You can view, change, and delete your account under "My page" (/me). A food-truck owner must delete the truck first so its public data and files are removed deliberately. Accounting records for completed support payments may be retained where legally required. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).
Changes
We may update this policy. Significant changes will be announced on this page.