Privacy policy

Madtown Trucks is a Madison food-truck map at www.madtowntrucks.com. We are not affiliated with the City of Madison. Contact us through the official Instagram account @madtownfoodtrucks.

Depending on how you use the site, we may collect:

• Public use. Pages you visit, approximate location of the request (from your IP), device and browser details, and basic analytics from our host.
• Reports and sightings. Truck, place, optional note or name, and any photo you attach. These reports are used to update the public board.
• Owner accounts. Email address and password when you create an owner account. Passwords are stored by our auth provider, not in plaintext on this site.
• Truck claims. Which truck you are claiming, the social account listed on that truck, and a one-time claim code. We hash the code before storing it. We never put the plaintext code in webhooks or logs on purpose.
• Instagram, official account only. An administrator can sign the official Madtown Trucks professional Instagram account into this site. We then store that account’s Instagram user ID, username, granted permissions, and an access token so we can read inbound direct messages and send a short automated acknowledgment. Truck owners do not sign in with Instagram.
• Instagram claim messages. When you DM a claim code to @madtownfoodtrucks from the Instagram handle listed on your truck, Meta delivers that message to us (webhook and/or inbox APIs). We read the sender username and message text only to match them to a pending claim. We do not use those DMs for ads or for contacting you about anything else.

• Run the public map, week board, and truck pages.
• Review community reports and owner-submitted listings.
• Verify that a claimant controls the social account already listed on a truck, then let that owner edit the listing.
• Keep the official Instagram connection working (including refreshing its token) and subscribe to message webhooks.
• Secure the site, debug failures, and understand aggregate traffic.

Claim verification uses the Instagram API with Instagram Login. Meta is the source of Instagram account identifiers, usernames, and message contents that we process for claims. Meta’s own policies apply to your use of Instagram. We request only the permissions needed to identify the official account and manage its messages. We do not sell Instagram data. We do not use Instagram data to build advertising profiles.

We share information with services that host and operate the site:

• Supabase, for the database, authentication, and access control.
• Vercel, for hosting, logs, and optional web analytics.
• Meta / Instagram, when an admin connects the official account or when claim DMs are delivered to us.
• Resend, to deliver account and optional owner check-in emails.

We do not sell personal information. We may disclose information if required by law or to protect the service and other people using it.

Signed-in admin and owner sessions use cookies so we can keep you logged in. Instagram Login uses a short-lived cookie to protect the sign-in. Analytics may set its own cookies. The public map does not require an account.

Public board data stays as long as it is useful for the map (for example, a truck listing or a scheduled stop). Live sightings expire on their own. Pending claim codes expire after a few days. Official Instagram tokens are kept until an admin disconnects the account or the token expires. Server logs are kept only as long as our host retains them.

Madtown Trucks is not directed at children under 13, and we do not knowingly collect personal information from them.

• You can use the map without creating an account.
• Owners can ask us, via @madtownfoodtrucks, to close an account or disconnect a claim.
• An administrator can disconnect the official Instagram account at any time, which stops inbox reads and automated replies.

If this policy changes in a material way, we will update this page and the date above. Continued use of the site after an update means you accept the revised policy.