Privacy Policy

This Privacy Policy explains how ForkStar ("we", "us") collects, uses, and protects information when you use forkstar.io and related services (the "Service"). ForkStar helps restaurants request reviews from their guests and collect private feedback.

Information we collect

Account information. When a restaurant owner signs up, we collect an email address, password (stored hashed by our authentication provider), and restaurant details such as name, review page address, and Google review link.

Guest information provided by restaurants. Restaurants may upload or enter guest details — name, email address, phone number, and visit dates — to send review requests. Restaurants may also import point-of-sale transaction records to measure returning visits. We process this information on behalf of the restaurant.

Feedback and activity. When a guest uses a ForkStar review page, we record their rating and any feedback they choose to submit, and whether they followed the link to leave a public review.

How we use information

• To operate the Service: sending review requests, delivering private feedback to the restaurant, and showing restaurants their own analytics.
• To send transactional emails such as account confirmation and password resets.
• To maintain security, prevent abuse, and comply with legal obligations.

We do not sell personal information. We do not use guest information for advertising or share it with anyone other than the restaurant that provided it.

Guest rights and opt-out

Guests may opt out of review requests at any time using the opt-out link in messages, and the restaurant is responsible for honoring opt-outs going forward. Negative feedback submitted through a ForkStar review page is shared only with the restaurant and is never published publicly by us.

Service providers

We rely on a small number of processors to run the Service: Supabase (database and authentication, hosted in the United States), Vercel (application hosting), and Postmark (email delivery). Each processes data only as needed to provide their service to us.

Cookies

We only use cookies and browser storage that are strictly necessary to operate the Service — keeping you signed in and remembering that you dismissed our cookie notice. We do not use analytics, tracking, or advertising cookies.

Data retention and deletion

We keep information for as long as the restaurant's account is active. Restaurants can delete guest records at any time from their dashboard, and can permanently delete their entire account — including all guest data — from the dashboard's account settings. Deletion is immediate and irreversible. Guests whose information was uploaded by a restaurant may also request deletion by contacting us at the address below; we will complete such requests within 30 days.

Security

All data is encrypted in transit (HTTPS) and at rest. Access to guest data is restricted to the restaurant that provided it through row-level database access controls.

Children

The Service is not directed to children under 16, and we do not knowingly collect their information.

Changes

We may update this policy from time to time. Material changes will be announced to account holders by email. The "Last updated" date above reflects the current version.

Contact

Questions or data requests: privacy@forkstar.io