Who we are
Only Local Co. is a Texas limited liability company operating a community platform for the local food economy. We are the data controller for the information described here.
Post: Only Local Co., 2726 Bissonnet St, Ste 240 #2187, Houston, TX 77005, United States.
Email: privacy@onlylocalco.com
What we collect, and why
We hold different information depending on whether you shop, sell, or drive.
Everyone with an account
| What | Why |
|---|---|
| Name and email address | To create your account, sign you in, and contact you about your orders. |
| Password | Stored only as a one-way hash. We cannot read it, and neither can anyone who obtains a copy of our database. |
| Phone number, where you give one | So a driver or seller can reach you about an order in progress. |
| Your chosen market or city | To show you producers near you. |
If you buy something
| What | Why |
|---|---|
| Delivery address | To get your order to you. Shared with the seller and with the driver assigned to your order, and with nobody else. |
| Order contents and history | To fulfil the order, handle refunds and disputes, and meet our tax and record-keeping obligations. |
| Payment details | We never see or store your card number. Payments are handled entirely by Stripe. We receive only a token, the last four digits, and whether the payment succeeded. |
| Reviews, ratings and community posts you write | To show them publicly, attributed to your first name and last initial. |
If you sell
| What | Why |
|---|---|
| Business details, your storefront copy and photographs | To publish your storefront. |
| Compliance documents — licences, permits, certificates of insurance, food handler cards, government ID | To verify you may lawfully sell and deliver what you are selling. Stored in private storage that only you and our reviewers can reach. Never public. |
| Payout details | Held by Stripe under their own agreement with you, not by us. |
If you drive
| What | Why |
|---|---|
| Driving licence, vehicle registration, vehicle insurance | Legal requirement before you may accept a delivery. |
| Precise location | Collected only while you are on an active delivery, so the customer can see their order approaching and so we can pay you for the distance you actually drove. Not collected when you are offline, and not collected in the background when you are not delivering. |
| Earnings records | To pay you and to produce your tax documents. |
What we do not do
- We do not sell your personal information. Not to advertisers, not to data brokers, not to anyone.
- We do not share it for cross-context behavioural advertising.
- There is no advertising SDK and no analytics tracker in the app. No Facebook SDK, no Google Analytics, no attribution or fingerprinting library.
- We do not track you across other companies' apps or websites.
- We do not use your data to train machine-learning models.
Who else receives your information
Only these, and only for the purpose named.
| Who | What they get | Why |
|---|---|---|
| Stripe | Payment and payout information | To process payments and pay sellers and drivers. Stripe is the controller of your card data, not us. |
| Supabase | Our database and file storage | They host the data on our behalf and do not use it for their own purposes. |
| Sentry | Crash reports and error diagnostics | To find and fix bugs. Configured not to attach your order contents or payment details. |
| The seller on your order | Your name, the order, and your delivery address if you chose delivery | They cannot pack it otherwise. |
| The driver on your order | Your name, delivery address and phone number, for that delivery only | They cannot deliver it otherwise. Access ends when the delivery completes. |
We will also disclose information where the law requires it — a subpoena, a court order, or a lawful regulatory request — and where it is necessary to investigate fraud or protect someone's safety.
How long we keep it
- Account information: while your account is open.
- Order records: seven years after the order, because tax and business-record law requires it.
- Compliance documents: for the life of the seller or driver account plus the retention period the relevant food-safety or transport authority requires.
- Driver location history: ninety days, then deleted.
- Crash reports: ninety days.
Deleting your account
Open the app, go to Profile → Delete my account, and type DELETE to confirm. You do not need to email us and we will not try to talk you out of it.
Your profile, addresses, phone number, reviews and posts are removed. Order records are anonymised rather than erased — they are detached from you but the transaction itself is kept, because we are required to keep financial records and because a seller's and a driver's own earnings history is bound up in it.
Deletion is refused only while you have an order in progress or money owed to you, and the app tells you which. Settle those and it goes through.
Your rights
Wherever you live, you may ask us to show you what we hold, correct it, delete it, or send you a copy in a portable format. Email privacy@onlylocalco.com. We will answer within thirty days and we will not charge you.
If you are in California
Under the CCPA and CPRA you have the right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of — but the right exists and we will confirm it in writing if you ask. We will not discriminate against you for exercising any of these rights.
If you are in Oregon
The Oregon Consumer Privacy Act gives you rights to access, correct, delete and port your data, and to obtain a list of the specific third parties we have disclosed it to. Ask and we will provide it. You may appeal a refusal, and if we refuse the appeal you may complain to the Oregon Department of Justice.
If you are in Texas
The Texas Data Privacy and Security Act gives you rights to access, correct, delete and port your data, and to opt out of targeted advertising, sale, and profiling. We do none of those three.
Children
Only Local Co. is not intended for anyone under 13 and we do not knowingly collect information from children. If you believe a child has given us information, email privacy@onlylocalco.com and we will delete it.
Security
Traffic is encrypted in transit. Passwords are hashed, never stored in a readable form. Compliance documents live in private storage buckets that are unreadable without an authenticated request from the account that owns them or from a reviewer. Access rules are enforced by the database itself rather than by the app, so hiding a button is never what protects your data.
No system is perfectly secure. If we discover a breach affecting your personal information we will tell you and the relevant authorities as the law requires.
Changes
If we change this policy materially we will say so in the app before the change takes effect, rather than quietly updating the date at the bottom.