Privacy Policy

Last updated October 11, 2026

This Privacy Policy explains what information Find A Market ("we," "us," "our," operated by Thomas Frechette, Cincinnati, Ohio) collects, why, and how it's used.

1. Information we collect

What	Why
Email address and password (encrypted), or, if you sign in with Google, the name and email address Google shares with us (we never receive your Google password)	Account creation and login
Search inputs: location, radius, event type	To run your searches and return relevant events
Saved events, notes, reminders, preferences	To power My Events, reminders, and Settings
Subscription status	To apply the correct free/Vendor Plus limits
Basic usage data (e.g. daily search counts)	To enforce fair-use limits per tier
Vendor and visitor ratings, written notes, and any photos you attach to a rating	To power the ratings system and show other vendors what to expect at an event
Public profile info, if you set one up: username, business name, avatar image, bio, and website, shop, or video links. If you also turn on your public schedule, the markets you've marked as accepted (dates and locations) are shown on a public page and a calendar feed anyone with the link can view	To show your reviews and, if you choose, where to find you, under a public identity you create
Market Passport and crews: the markets you check in at and when, whether the visit was verified (by scanning the market's check-in sign, or your coordinates compared with the market's address and not stored), crews you start or join with the name you give them (crew members see the upcoming markets you've tapped "I'm going" on), crew messages, market game play (the bingo squares you mark and when you call bingo, booth trail stamps, People's Choice votes; bingo photos stay on your device and are never uploaded), and pickup requests you send or receive	To show your stamps and badges, run crews and their chat, run market games (a bingo winner's first name, last initial and claim code are shown to the organizer and, name only, on the event page; trail and vote counts are shown as totals), and pass a pickup request (your name and email) to the vendor you chose
Market map pins: if you allow location when you scan a market's check-in sign, one reading of where you're standing, kept with that market and the date only. It is not linked to your name, account, check-in or time of day	To place that market's map pin where shoppers actually find it. Once enough readings agree, the market's pin moves there; readings older than a year are deleted
Organizer registration/claim info, if you register or claim a listing as an event organizer: business name, description, logo, website, and any Google Business, Facebook, or Instagram links you provide as proof	To review and verify your organizer claim, and to power your public organizer page - business name, website, and any listings you've claimed are always shown there; description, logo, and social links only if you choose to make them public
Vendor expense & sales figures you log on an attended event: booth fee paid, supply costs, sales total, sales tax collected, and hours worked. You can type these in, import a sales CSV (the file is read in your browser; we receive only the per-market totals you approve), or connect Square	To power your own private running expense/sales summary, break-even and market scorecard. Your individual figures are never shown to other users or made public, though they may be combined with other vendors' figures into anonymous averages shown only when enough vendors have logged figures. It's separate from the optional, public "was the booth fee worth it" yes/no/unsure field in a vendor rating
How you found us (a link or flyer tag, or the website that referred you) and any referral code you arrived with. If you refer a friend, a record of which friend's Vendor Plus subscription earned you bonus time	To see which channels bring people here, and to credit referral rewards
Square connection, if you connect one: read-only access to your Square order totals and business name, plus the connection token we keep until you disconnect	To import your daily sales into your My Events figures. You can disconnect any time in Settings, which also revokes our access at Square
Paperwork you add, if any: a label (for example, insurance or a permit) and its expiry date. We don't store uploaded documents	To email you renewal reminders 30 and 7 days before it expires
Emails you forward to your private Find A Market address, if you use that feature: the sender, subject, and message text	To read the market name, dates, and accept/decline decision and update your My Events. The email text is processed by Anthropic to do this
Discord details, if you link Discord: your Discord user ID, username, and avatar, and your Discord direct-message preference. If you use our Discord commands, whatever you submit there	To give you roles in our server that reflect your account (vendor, visitor, Vendor Plus member, verified organizer) and to send Discord messages you've opted into, such as reminders and alerts
Event flyers you send us: the picture, and the details printed on it (name, date, place, and any organizer contact details)	To add or fix a listing. The picture is read by Anthropic to pull out the details, is never shown to the public, and is deleted once it has been checked (or after 30 days). If you are a verified organizer on Organizer Plus and upload your own flyer to show on your event page, it is kept until you remove it
An organizer's email address printed on a public event flyer	To send that organizer one invitation to claim their listing. Every invitation has an opt-out link, an opt-out is honored right away (we then keep that address on a do-not-contact list so we never write to it again), and we never say who sent us the flyer
One extra picture on your public profile, if you add one (a vendor's flyer or booth photo, or a shopper's photo)	To show it on your public profile. It is shrunk when you upload it, screened by Sightengine, and deleted when you remove it or close your account
Vendors you follow, markets you tap "I'm going" on, shopping lists, and the perks and sneak peeks you receive	To email you when a vendor you follow is booked near you, remind you before a market and tell you if it is delayed, moved or cancelled, and show organizers and vendors how many people are going or following (counts, not names)
If you are a vendor an organizer works with: the business name and email address the organizer gave us, and a record that we sent you an invitation on their behalf (the date, and whether you signed up or applied afterward)	To send the invitation to apply that the organizer asked us to send, no more than once per listing and not more than once a week from any organizer, with a one-click way to stop receiving them. We skip anyone who has opted out and keep the record so the same invitation is not sent twice
Vendor applications you send to an organizer: your answers, contact details, any product or booth photos you attach, and whether you confirmed paying an organizer's jury fee. If you are an organizer: the questions, templates, payment link, booth map, check-in sign and bingo tile pictures you set up, and messages you send to vendors who follow your event	To pass your application to the organizer you applied to (and no one else), and to run the organizer's tools. Photos you add for applications sit in a private library of up to 8 that only you can see, and each is deleted 90 days after you last sent it with an application (or when you remove it). A photo that went out with an application stays visible to that organizer until 30 days after they decide (or 90 days after you apply, if they never do), then it is deleted. Find A Market does not take or handle the payments between vendors and organizers
Gift codes you buy or redeem, and the time zone your device reports	To deliver a gift and apply it once, and to show dates and send reminders in your own time zone
Security and technical logs: IP addresses used briefly for rate limiting, a one-way hash of your IP and your email domain at signup, an approximate city from your IP to pre-fill search, error logs that may include your account ID, and counts of AI calls with cost totals (no content)	To prevent abuse, fix bugs, and keep the AI features affordable
If you connect Google Calendar (Vendor Plus tier): your connected Google account's name, email, and profile photo; events we create, update, or delete on your Google Calendar for markets you mark applied, accepted, or attended (and a separate "Apply by" reminder event for markets with an application deadline), optionally on a dedicated "Find A Market" calendar Google creates in your account if you turn that on; your calendar's free/busy availability, used only to flag scheduling conflicts with events you're viewing; and, only if you use the optional Business Sheet feature (or, for Organizer Plus, the Organizer Business Sheet), a Google Sheet we create in your Drive and keep updated automatically. It works both ways: numbers you type into it (such as expenses, mileage, sales tax, notes, and hours) are read back into Find A Market	To show which Google account is connected, keep your real calendar in sync with markets you're actually doing, warn you about scheduling conflicts, and let you keep your private expense/sales tracking in a spreadsheet you control. We only ever touch calendar events we created ourselves, and only read or write Business Sheets we created for you (keeping the current one updated; if you start a fresh one, the old one stays in your Drive, renamed, and we stop updating it), never any other file in your Google Drive

Access tokens for connected Google and Square accounts are stored encrypted. We don't collect payment card details directly; those go straight to our payment processor, Paddle (see below).

2. Third parties we use

Supabase: hosts our database and handles account authentication.
Anthropic: powers the AI-driven event search (your search location, radius, and event type are sent to run it, and typed locations may be sent for spell-checking) and, if you use acceptance-email forwarding, reads the text of emails you forward to pull out the market name, dates, and decision. Search content is not used to identify you personally.
Resend: sends and receives email on our behalf: deadline and paperwork reminders, the weekly new-event digest, welcome and getting-started emails, occasional check-in emails if you've been away, review and sales nudges, and account verification/login email. It also receives emails you forward to your private Find A Market address. Every optional email includes an unsubscribe link that stops all optional email with one click, and you can manage these in Settings; account, billing, and security emails are always sent. Resend receives your email address and the content of that specific email, not your other account data.
Sightengine: automatically screens photos you upload to a rating for policy violations before they're shown to other users. Sightengine receives only the image being screened.
Nominatim / OpenStreetMap: resolves the locations you search into map coordinates, and provides the map tiles shown on event cards. Receives the location text or coordinates being looked up, not your identity.
National Weather Service (api.weather.gov): provides the weather forecasts shown on event cards. Receives only an event's approximate map coordinates, never anything about you.
Paddle.com Market Limited: our payment processor and Merchant of Record for Market Pass, Vendor Plus and Organizer Plus subscriptions and gifts. Paddle collects and processes your payment details directly; we never see your full card number. See Paddle's Privacy Policy.
Google Sign-In: if you choose "Sign in with Google," Google's sign-in script loads on the login page and Google shares your name and email with us.
NOAA climate data: provides the past-years weather shown in weather history and best-date rankings. Receives only a place's coordinates and dates, never anything about you.
Square: if you connect Square, we get read-only access to your order totals and business name to import daily sales.
Discord: optional. If you link your account, we store your Discord ID, username, and avatar, assign roles in our server that reflect your account type (including Vendor Plus member or verified organizer), and can send you Discord messages you've opted into. New ratings may also be posted, without your name, to a public channel in our server. Discord's own privacy policy applies to the server.
YouTube and TikTok: if a vendor adds video links to their public page, those videos are embedded and load from those services for anyone viewing the page.
Vercel: hosts the application itself, and through Vercel Analytics collects anonymous, aggregate usage data (e.g. which pages are visited) that isn't tied to your name or email.
Google: if you connect Google Calendar, we create, update, and delete events on your Google Calendar for markets you mark applied, accepted, or attended (removing the event again if you decline it or disconnect), and a separate reminder event for markets with an application deadline, optionally on a dedicated "Find A Market" calendar Google creates in your account instead of your primary one, if you turn that on. We only ever touch events we created ourselves; we don't read or modify anything else on your calendar. We also access your calendar's free/busy availability (to check for scheduling conflicts) and your basic Google account profile (name, email, photo), using only the narrow permissions needed for those features. If you use the optional Business Sheet feature, we create a Google Sheet in your Drive and keep it updated automatically, and numbers you type into it (such as expenses, mileage, sales tax, notes, and hours) are read back into Find A Market. If you start a fresh Business Sheet, the old one stays in your Drive, renamed, and we stop updating it. We never see or touch any other file in your Drive. Find A Market's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google Calendar at any time from Settings.

We don't sell your personal information to anyone.

3. Cookies

We use cookies to keep you logged in and to remember your light/dark setting. We also set a few short-lived cookies that remember (a) the approximate city your IP address maps to, used only to pre-fill the search box, (b) which flyer, link, or website sent you here, and (c) a referral code if you arrived through a friend's link. If you sign up, the source and referral code are saved with your account so we can see what's working and credit referrers. We don't use advertising cookies.

4. Data retention

We keep your account data for as long as your account is active. Daily search-history detail clears after 24 hours on Free tier (last 5 searches) and after 7 days on Vendor Plus (last 20 searches); your saved events and preferences persist until you delete them or close your account. Vendor and visitor ratings you've submitted also persist, including after you close your account, since other vendors rely on that content, but closing your account anonymizes them (the content stays, no longer linked to your identity). When you delete your account we also remove your profile and avatar images, application photos, preferences, saved events, financial entries, paperwork records, and connection records, and we take back our access to Discord, Square, and Google. Error logs and AI-usage counters are detached from your account, and security logs keep only a hashed identifier. If you'd rather your review content be removed outright instead of anonymized, email us and we'll handle it.

5. How we protect your data

We take care with everything you give us, and extra care with the information we receive from Google: your Google account's name, email address and photo, the calendar events we create for you, your calendar's free/busy availability, and the Business Sheet we create in your Drive. These are the protections in place:

Encryption in transit: traffic between your browser and Find A Market, and between Find A Market and Google, Supabase and our other service providers, is encrypted with HTTPS/TLS, and our site tells browsers to connect only over HTTPS.
Encryption at rest: the access and refresh tokens that let us act for you at Google (and at Square) are encrypted with AES-256-GCM before they are saved, using a key that lives only in our server's protected environment settings and never in the database. Someone who got a copy of the database still could not use them. Our database host also encrypts stored data at rest, and your password is never stored in readable form (our sign-in system keeps only a salted hash).
Access controls: row-level security is turned on for our database tables, so a signed-in user can reach only their own records. The tables that hold Google and Square connection details, including the encrypted tokens, cannot be read from a browser at all, only by our own server code. Administrative access to our database and hosting accounts is limited to the developer.
Minimum access: we request only the Google permissions our features need, we only touch calendar events and Business Sheets that Find A Market created, and we never read your other calendar events or any other file in your Google Drive.
No people reading your Google data: we don't let anyone view data we receive from Google APIs unless you ask us to for support, it is needed to investigate abuse or a security problem, or the law requires it.
No other uses: we don't sell Google user data, use it for advertising, or transfer it to anyone except the hosting and database providers listed in section 2 that store it for us, as needed to provide the features you turned on, or as the law requires. We don't use data received from Google APIs to develop, improve, or train generalized AI or machine-learning models.
Keeping and deleting your data: we keep your Google connection details (tokens, account name, email and photo) only while Google Calendar is connected. When you choose Disconnect in Settings, we revoke our access at Google and delete the stored tokens and connection record right away. Closing your account does the same (see section 4). You can also remove Find A Market's access at any time from the third-party access page of your Google Account, or email contact@find-a-market.com and we'll delete your Google connection data.
If something goes wrong: if we learn of a security incident that affects your personal information, we will tell the people affected, and any authorities, as the law requires.

No online service can promise perfect security, but we review these protections as Find A Market grows.

6. Your rights

You can review and edit your saved events, preferences, and public profile directly in the app, and delete your account yourself from Settings. To request a copy of your data, or for help with anything account-deletion doesn't cover, email contact@find-a-market.com and we'll handle it promptly.

7. Children's privacy

Find A Market is not directed at children, and we don't knowingly collect information from anyone under 18.

8. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by updating the date above.

9. Contact

Questions about this policy: contact@find-a-market.com.