This explains what The Hidden Root collects, why, and what we never share. It describes the site as it actually works today.
Browsing without an account
You don't need an account to browse. We don't ask visitors for a name, email, or phone number to use the map, search, or directions.
Information sellers give us
When a seller signs up we receive their name and email address from the sign-in they choose (including Google sign-in, if they use it). Sellers may add a business name, description, and profile image. For each stand, sellers give us a label, town, hours, products, photos, payment methods, announcements, and the stand's location.
Location privacy — how the three modes work
Sellers choose one privacy mode per stand, and it is enforced on our servers, not just in the display:
- Exact — the stand's precise pin and street address appear publicly.
- Approximate — we publish only a deliberately rounded, less precise coordinate derived on our servers. The exact pin stays private and the street address is not published.
- Directions Only — no public coordinate and no street address at all. Visitors see only the written directions the seller wrote.
The seller's precise coordinates are stored privately and are visible only to that seller and to our administrators. They are not sent to visitors' browsers, not included in the public map data, not included in page metadata or structured data, and not included in the sitemap.
Reviews
When you leave a review we collect the display name you type, your star rating, and your review text. Reviews are held for moderation and only appear publicly after approval. Please don't put personal contact details in a review — anything you write in a review may become public.
Reports
When you report a stand or a review, we collect the category you choose and any detail you write. Reports are visible only to our administrators. We do not tell a seller who reported them, and reporter details are never shown publicly.
Abuse prevention — no raw IP address stored
To stop spam and repeat submissions, when a review or report is submitted we combine your network address and browser identifier with a private server-side secret and store only the resulting one-way hash. We do not store your raw IP address, and that hash is never shown to sellers or to the public.
Payments
Sellers pay their subscription through Stripe. Card numbers never reach us — Stripe collects and processes payment details. We store only what we need to keep a subscription working, such as Stripe's customer and subscription identifiers, the subscription status, and the current period end. Stripe also collects billing address information for tax purposes and handles it under its own privacy policy.
Favorites stay on your device
If you save a stand as a favorite, that list is stored in your own browser only. It isn't sent to us, isn't tied to an account, and isn't shared with sellers. Clearing your browser storage clears it.
Third-party services we use
- Supabase-backed hosting infrastructure — stores our database, files, and seller sign-ins.
- Stripe — subscription payments and tax calculation.
- Google — optional sign-in for sellers.
- OpenFreeMap and MapLibre — map tiles and map rendering; requesting map tiles reveals your network address to the tile provider, as with any online map.
- Google Fonts — typography.
What we never sell or share
We don't sell your personal information. We don't share seller private coordinates, seller email addresses, internal account identifiers, payment identifiers, moderation notes, or abuse-prevention hashes with other users or with advertisers.
How long we keep things
We keep information only as long as reasonably necessary to operate the service, maintain security and moderation records, meet legal and accounting obligations, and resolve disputes.
Your choices
Sellers can edit or archive a stand at any time, change privacy mode, and cancel a subscription. To ask for a copy of your information or for deletion of your account, write to hello@thehiddenroot.com. When we receive a request, we'll use a safe operational process to provide or delete what we can while preserving records that we must legally or operationally retain (for example, billing records, audit logs, or moderation records).
Children
The Hidden Root isn't intended for children under 13, and we don't knowingly collect their information.
Changes
We'll update this page and its “Last updated” date when our practices change.