Last updated September 1, 2026
Privacy policy
This is written against how the system actually works, not copied from a template. If something here doesn't match what you see on the site, tell us and we'll fix whichever one is wrong.
Who we are
Frostburg Eats is a food ordering and e-bike delivery service for ZIP code 21532, Frostburg, Maryland, operated by Thraxel, LLC. Contact: hello@frostburgeats.com.
What we collect, and why
When you place an order
- Name, mobile number, email address. Required for every order. The name goes on the bag; the number is how the Eats Delivery Driver reaches you if something needs a decision; the email gets your receipt, live status updates and the Eats Delivery Driver's thank-you. Placing an order creates a customer record keyed to your email so your next order and your Eats Delivery Driver tip are quicker.
- What you ordered, from which kitchen, and where you asked us to bring it (the partner venue and the table, room or meet-point you chose). We never collect a home address; the system has no field for one.
- Notes you type (allergies, "no onions", a room number). Shown to the kitchen and the Eats Delivery Driver.
- Your Food News choice. The box is pre-checked; unchecking it is honoured, and unsubscribing later is one click from any email.
When you pay by card
- Card details go directly to Stripe. Our servers never see the card number. We store a label like "Visa ••••4242" and a Stripe token so that, after delivery, you can tip your Eats Delivery Driver in one tap without re-entering the card. You can ask us to delete the saved card at any time.
Automatically
- Your IP address, used to rate-limit ordering and sign-in and recorded in our audit log when a request is blocked. Not used for advertising.
- Page analytics through Vercel Analytics: page views and rough device/browser class. No cookies are set for this, no cross-site tracking, no advertising identifiers.
- A cart stored in your browser's local storage so you can come back to it. It never leaves your device until you check out.
If you're kitchen crew, an Eats Delivery Driver, or a partner
- Your email for passwordless sign-in (a one-time code, no password stored). If you turn on notifications, the push subscription endpoint your phone gives us, so we can buzz you when an order lands.
- Partner applications: the business and contact details you submit.
Who processes it (our subprocessors)
| Service | What they receive | Why |
|---|---|---|
| Stripe | Card details, your email, order amount, order and kitchen identifiers | Payment processing, saved card for the Eats Delivery Driver tip |
| Supabase | Everything above, in our database (US East) | Our system of record and sign-in |
| Resend | Your email address and the contents of the emails we send you | Receipts, status updates, sign-in codes, Food News |
| Vercel | Requests to the site, IP address, page analytics | Hosting and analytics |
| Apple, Google or Mozilla push services | An opaque push endpoint and the notification text | Only for crew, Eats Delivery Drivers and ops who opted in |
We do not sell your data. We do not share it with advertisers. Partner kitchens see the orders placed with them (name, phone, items, notes). Partner venues do not receive your data; the Eats Delivery Driver carries the order in.
How long we keep it
- Orders are business and tax records. We keep them for seven years.
- Your customer record (name, phone, email, preferences) stays until you ask us to delete it.
- Saved card token at Stripe: until you ask us to remove it, or Stripe expires it.
- Audit log and rate-limit records: 12 months.
- Push subscriptions: until you unsubscribe or the endpoint stops working.
Your choices
- Unsubscribe from Food News or from order-status emails with the link in any email. Receipts and the sign-in codes you request are transactional and keep coming.
- See, correct or delete your customer record and saved card: email hello@frostburgeats.com from the address on the account. We answer within 30 days. Order records required by tax law are retained but disconnected from your name where the law allows.
- Notifications for crew and Eats Delivery Drivers can be turned off in your phone's settings.
Children
The service is not directed at anyone under 13. We sell food and non-alcoholic drinks only.
Security
Every price is computed on our servers, never trusted from your browser. Data is encrypted in transit. Sign-in is passwordless by design so there is no password to leak. Database access is default-deny; every write goes through our servers after the caller is verified. If we ever discover a breach affecting you, we will email you.
Changes
When this policy changes we update the date at the top. If a change would let us do something meaningfully new with your data, we'll email customers first.