Privacy Policy
This privacy policy applies to the Spice Krewe website (spicekrewe.com) and the Spice Krewe mobile app for Android (Google Play package com.spicekrewe.app) and iOS. The website and the app are the same service: the app shows the Spice Krewe website inside a mobile shell and adds a few device features, described in Mobile app. Everything in this policy applies to both unless a section says otherwise.
Spice Krewe is a verified food rescue network. Caterers, food trucks, venues and event hosts ("donors") request pickups of surplus food; verified shelters, meal programs, community fridges and hubs ("recipients") claim it; and volunteer or paid drivers ("couriers") move it, with temperatures and handoffs recorded for food safety. The same service also books caterers and food trucks for events.
Who we are and how to contact us
The Spice Krewe website and app are operated by Spice Krewe ("Spice Krewe", "we", "us"). For any privacy question or request, email privacy@spicekrewe.com or use our data request form. We respond to verified requests within 30 days.
Information we collect
We collect only what we need to run food pickups and event bookings. What we collect depends on how you use Spice Krewe:
| Information | Examples | When we collect it |
|---|---|---|
| Contact details | Name, email address, phone number, organization name | When you request a pickup, sign up as a partner, sign in, book an event, or contact us |
| Addresses | Pickup site address, a recipient’s delivery address, event address | When you request a pickup, save a site, or register as a recipient |
| Precise location | GPS position (latitude and longitude) and the time it was taken | Only when you choose to: attached to a Rescue Now photo in the app, or when a driver taps “I’m at the pickup / drop-off” |
| Photos | Photos of surplus food; thermometer photos | When you take or choose a photo |
| Food-safety records | Food descriptions and allergens, temperatures, hold times, weights, typed names used as signatures, handoff times | During a pickup, from the donor, courier and recipient |
| Verification documents | Health permits, food handler cards, driver’s licenses, vehicle and insurance certificates, nonprofit determination letters | When a recipient, courier, hub or provider applies to join |
| Account information | Sign-in email, password (stored only as a secure hash by our authentication provider), account role | When you create an account or sign in |
| Preferences and settings | Intake hours, accepted food types, claim radius, text-alert consent, selected city | When you set them |
| Notification identifiers | Push notification tokens for your device or browser | Only if you turn on alerts |
| Payment information | Payment status and Stripe reference IDs. Card details go directly to Stripe; we never see or store full card numbers or security codes | When you buy a paid plan or service |
| Delivery account credentials | API credentials for a donor’s own DoorDash Drive or Uber Direct account, the per-delivery limit they set, and their consent. Stored encrypted; never shown again after saving | When a donor connects a delivery account in the portal |
| Paid courier payment details | A paid courier’s own payment links or handles (Stripe, Square, Venmo, Cash App, PayPal), rates, agreed fares, and when a fare was approved, marked paid and received. We never see or handle the payment itself | When a paid courier sets up payment, and on each paid run |
| Messages and feedback | Contact-form messages, data requests, reviews, pickup feedback | When you send them |
| Technical and security data | IP address, request times, sign-in and security events | Automatically, to keep the service secure and prevent abuse |
We do not collect your contacts, text messages, call logs, microphone audio, a list of your other apps, your advertising ID, or hardware identifiers such as IMEI. We do not use advertising or third-party analytics tools.
How we use information
- Running pickups: routing surplus food, offering it to nearby recipients, offering runs to volunteer drivers, scheduling couriers, and sending the alerts, texts and emails that go with each step.
- Food safety and records: tracking temperatures and the 4-hour clock, stopping food that fails a check, and producing the pickup record that donors, recipients and inspectors rely on.
- Verification: checking that recipients, couriers, hubs and providers are who they say they are and can handle food safely.
- Impact reporting: pounds recovered, estimated meals and estimated avoided emissions (EPA WARM) for donors, recipients and the organizations they report to.
- Event bookings: matching hosts with caterers and food trucks.
- Itemizing food with AI: when you describe food or add a photo, we send the description or photo to our AI provider to list the items, so you don’t have to type them.
- Payments: processing paid plans and services through Stripe.
- Security and support: preventing fraud and abuse, keeping audit logs, answering questions, and handling privacy requests.
We do not sell your personal information, share it for advertising, or use it for purposes unrelated to the service.
Mobile app
The Spice Krewe app for Android and iOS uses the following device features. Each one is used only for the feature described, and only after you allow it in your device’s permission prompt.
| Permission | When it is used | What it is for |
|---|---|---|
| Camera (and photo library) | Only when you tap to take or choose a photo | Photos of surplus food (Rescue Now) and thermometer photos (driver page) |
| Precise location | Only while the app is open, and only after you agree on screen: when you add a Rescue Now photo, or when a driver taps “I’m at the pickup / drop-off” | Recording where a photo was taken or where a driver checked in, as part of the pickup’s food-safety record |
| Notifications | Only if you turn on alerts | Food offers, volunteer runs and pickup updates |
- No background location. The app never collects your location when it is closed or not in use, and never tracks you over time.
- Before we ask. The app explains on screen why it wants your location or notifications before your device shows its permission prompt. Saying “Not now” or denying the permission does not stop you using the app.
- Push notification tokens. If you turn on alerts, your device registers with Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS), and we store the resulting token with your account so we can send you alerts. Turning alerts off in your device settings stops them.
- Data kept on your phone. So the driver page works without signal, temperature readings, thermometer photos and check-ins are saved on your device until they are sent, then removed. The app also keeps the last copy of a driver’s job so it opens offline, your sign-in session, and preferences such as your selected city. Uninstalling the app or clearing its data removes all of it.
- What the app does not access: contacts, text messages, call logs, the microphone, other installed apps, your advertising ID, or hardware identifiers such as IMEI.
- You can change camera, location and notification permissions at any time in your device settings.
Website, cookies and local storage
The website does not use advertising or tracking cookies. It stores a few items in your browser’s local storage to work: your sign-in session, your selected city and display preferences, and (on the driver page) offline readings waiting to be sent. Stripe may set its own cookies on payment pages to prevent fraud. If you turn on browser alerts, your browser’s push service issues a subscription that we store to send you alerts.
How long we keep information
| Information | How long |
|---|---|
| Account and profile information | While your account is open; deleted when you delete your account |
| Saved donor sites and organization memberships | Until you remove them or delete your account |
| A paid courier’s payment links and rates | Until the courier removes them or deletes their account |
| Delivery account credentials | Until the donor disconnects the account, removes the site or deletes their account |
| Verification documents | While you are an active partner; deleted when you delete your account |
| Pickup and food-safety records (times, addresses, food, temperatures, photos, location check-ins, typed signatures) | 7 years, for food-safety and regulatory purposes. If you delete your account, your name, email and phone number are removed from the records you made as a donor |
| Payment records | 7 years, for tax, accounting and fraud prevention |
| Security and audit logs | Up to 7 years |
| Rate-limiting data (IP-based) | About 24 hours |
| Notification history (used to avoid sending the same alert twice) | Until you delete your account |
| Data kept on your phone by the app | Until it is sent, or until you uninstall the app or clear its data |
| Privacy requests | As long as needed to show we handled them |
Deleting your account
You can delete your Spice Krewe account at any time, in the app or on the website: sign in to the portal and choose Delete account. If you can’t sign in, use our account deletion page or email privacy@spicekrewe.com.
When you delete your account we immediately delete your sign-in, profile, preferences, saved sites, connected delivery accounts, organization memberships, notification tokens, notification history and verification documents, and remove your name, email and phone number from the pickups you requested. We do not just deactivate or hide the account.
We keep only what we must for the reasons in How long we keep information: pickup and food-safety records (without your contact details) and payment records. If a pickup of yours is in progress, we ask you to wait until it is finished so the people carrying the food can still reach you.
How we protect information
- All traffic to the website, the app and our service providers is encrypted in transit with HTTPS (TLS).
- Our database and file storage are encrypted at rest by our hosting provider.
- Sensitive tables are closed to direct access and reachable only through our server; verification documents and photos are in private storage, shared only through short-lived signed links.
- Pickup, receipt and driver links use unguessable single-purpose tokens; organization API keys are stored only as hashes.
- Staff access requires multi-factor authentication, and requests are rate-limited and logged to detect abuse.
No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.
Your choices and rights
- Access and portability: ask for a copy of your information (we provide it in a machine-readable format).
- Correction: update most details in the portal, or ask us to correct them.
- Deletion: delete your account as described above.
- Texts and alerts: reply STOP to any text, turn alerts off from any offer link or in your device settings, or ask us to stop.
- Permissions: change camera, location and notification access in your device settings at any time.
To use these rights, email privacy@spicekrewe.com or use the data request form. Depending on where you live (for example in a U.S. state with a privacy law, or the European Economic Area or United Kingdom), you may have additional rights, including the right to complain to a data protection authority. Where the GDPR applies, we rely on performing our service for you, our legitimate interest in running a safe food rescue network, legal obligations, and your consent (for texts, location and notifications, which you can withdraw at any time).
Children
Spice Krewe is for businesses, organizations and adult volunteers. It is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.
Where information is stored
Spice Krewe operates in the United States and stores information with providers in the United States. If you use the service from elsewhere, your information is transferred to and processed in the United States.
Changes to this policy
We update this policy when our practices change and change the effective date at the top. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect.