Privacy Policy

Draft · Last updated July 7, 2026

Sunsugar Market exists so you can order from local farms — not so anyone can mine your data. This policy explains what we collect, why, and who ever sees it. The short version: we collect what it takes to get a tote of produce from a farm stall to your hands, we share it only with the people and services that make that happen, and we never sell it, use it for advertising, or feed it to AI.

1. What we collect

Account: name, email address, a hash of your password (we can’t read the password itself), and an optional phone number. Restaurant and private-chef accounts can add a business name and sourcing notes.
Orders: what you ordered and from which farms, the market event, pickup or delivery choice, delivery address and notes (delivery orders only), fee and refund amounts, pay-it-forward contributions, and how many of our totes are out with you.
Activity you choose: farms you follow, messages you exchange with farms, leftovers you claim.
Payment: handled by Stripe. Your card number goes from your browser to Stripe and never touches our servers; we store only Stripe’s reference IDs and the amounts.
Technical: the session cookie that keeps you signed in, and — when our error monitoring (Sentry) is enabled — error reports that can include request metadata like your IP address and browser type. Your cart lives in your own browser’s storage until checkout.

2. What we don’t do

No selling or renting your data, to anyone, ever.
No advertising networks, ad pixels, or cross-site trackers.
No AI: we don’t use your data to train models, generate content, or build recommendation profiles. Feeds are reverse-chronological; what you see is what farmers posted.

3. How we use your information

Running your orders: farms see your name and what you ordered from them so they can pack it. Our fulfillment team sees pickup rosters and — for delivery orders — your address and delivery notes to run the van route. Farms never see your address.
Email you’d expect: order confirmations, reminders, and status updates; a “what’s fresh” digest and leftover alerts from farms you follow; a note when a farm replies to your message; password resets. Follow-based emails stop when you unfollow the farm.
Keeping the lights on: fixing errors, preventing fraud and abuse, and meeting legal obligations like tax records.

4. Who your information is shared with

Farms you buy from or message: your name, the order contents, and your messages — that’s the marketplace working.
Service providers that run the platform: Supabase (database), Vercel (hosting), Stripe (payments and farm payouts), Resend (email), and Sentry (error monitoring). Each receives only what its job requires and can’t use it for anything else.
Legal: if the law genuinely requires it, or to protect the safety of buyers, farmers, or our team.

5. Retention

Your account data stays as long as your account exists. Order and payment records are kept after that for bookkeeping and tax purposes. Messages stay until deleted. If you want your account gone, email orders@sunsugarmarket.com and we’ll delete it — everything except the order records we’re required to keep.

6. Your choices and rights

You can edit your account details and delivery address any time.
Unfollow a farm to stop its digest and leftover emails.
Email us to request a copy of your data, correct something we got wrong, or delete your account. We honor these requests for everyone, not just where a privacy statute (like the Utah Consumer Privacy Act) technically requires it.

7. Security

Passwords are stored only as salted hashes, traffic is encrypted in transit, and payment details never reach our infrastructure. No system is perfectly secure — if a breach ever affects your data, we’ll tell you promptly and plainly.

8. Children

Sunsugar Market is for adults — you must be 18 to have an account. We don’t knowingly collect information from children; if you believe a child has an account, contact us and we’ll remove it.

9. Changes

If this policy changes materially, we’ll post the update here, change the date at the top, and — for significant changes — email account holders. See also our Terms of Service.

10. Contact

Sunsugar Market · Salt Lake City, Utah · orders@sunsugarmarket.com

Draft · Last updated July 7, 2026

1. What we collect

Account: name, email address, a hash of your password (we can’t read the password itself), and an optional phone number. Restaurant and private-chef accounts can add a business name and sourcing notes.

Orders: what you ordered and from which farms, the market event, pickup or delivery choice, delivery address and notes (delivery orders only), fee and refund amounts, pay-it-forward contributions, and how many of our totes are out with you.

Activity you choose: farms you follow, messages you exchange with farms, leftovers you claim.

Payment: handled by Stripe. Your card number goes from your browser to Stripe and never touches our servers; we store only Stripe’s reference IDs and the amounts.

Technical: the session cookie that keeps you signed in, and — when our error monitoring (Sentry) is enabled — error reports that can include request metadata like your IP address and browser type. Your cart lives in your own browser’s storage until checkout.

3. How we use your information

Running your orders: farms see your name and what you ordered from them so they can pack it. Our fulfillment team sees pickup rosters and — for delivery orders — your address and delivery notes to run the van route. Farms never see your address.

Email you’d expect: order confirmations, reminders, and status updates; a “what’s fresh” digest and leftover alerts from farms you follow; a note when a farm replies to your message; password resets. Follow-based emails stop when you unfollow the farm.

Keeping the lights on: fixing errors, preventing fraud and abuse, and meeting legal obligations like tax records.

4. Who your information is shared with

Farms you buy from or message: your name, the order contents, and your messages — that’s the marketplace working.

Service providers that run the platform: Supabase (database), Vercel (hosting), Stripe (payments and farm payouts), Resend (email), and Sentry (error monitoring). Each receives only what its job requires and can’t use it for anything else.

Legal: if the law genuinely requires it, or to protect the safety of buyers, farmers, or our team.

5. Retention

6. Your choices and rights

You can edit your account details and delivery address any time.

Unfollow a farm to stop its digest and leftover emails.

Email us to request a copy of your data, correct something we got wrong, or delete your account. We honor these requests for everyone, not just where a privacy statute (like the Utah Consumer Privacy Act) technically requires it.