Privacy Policy

Last updated: May 25, 2026

Buford is a live event map for art festivals. We built it to help artists connect with each other and let patrons find the art they love. We collect only what we need to make that work, we don't sell your data, and we don't show ads.

1. Who We Are

Buford is operated by Joe Hiltabidel, a working artist who travels the US selling photography at art and craft festivals — and the person who built this app because he wanted to stay connected with the people around him at every show. You can reach us at jhiltabidel@duck.com.

2. Information We Collect

Information you provide directly:

Your name and email address when you create an account
Your artist bio, artistic mediums, and profile photo (optional)
Your booth number and event schedule when you check in or add shows
Reviews, tips, and recommendations you write
Feature suggestions you submit

Information collected automatically:

Location data — when you check in, we record your GPS coordinates so other artists and patrons can find you on the live map. Your static location is only collected at the moment you use a location-based feature — we do not track your location in the background, and location is never accessed without your permission.
Basic usage information such as which screens you visit, collected through our hosting and backend provider.

3. Messaging

Buford includes a messaging feature that allows approved artists and organizers to communicate directly with one another. The following applies to all messages sent through Buford:

What we collect
We store the content of messages, the sender and recipient identities, and the date and time each message was sent. This data is stored securely in our database.

How messages are used
Messages are used solely to deliver communications between users. We do not read, sell, or share the content of private messages except as described below.

Retention
Messages are retained in our systems indefinitely, even if a user deletes a conversation from their view. Retention allows us to investigate abuse reports, respond to legal requests, and maintain platform safety.

Safety and moderation
Users may report conversations they believe contain harassment, inappropriate content, or spam. Reported conversations are reviewed by Buford administrators. Users who violate our community standards may have their accounts suspended or terminated.

Blocking
Users may block other users at any time. Blocked users cannot initiate new conversations and will not appear in messaging search results.

Legal disclosure
We may disclose message content to law enforcement or other authorities if required by law, court order, or to protect the safety of our users or the public.

Who can message whom
Messaging is available to approved artists and organizers only. Patron accounts do not have access to the messaging feature.

4. How We Use Your Information

To display your artist profile and check-in location on the live festival map
To show your upcoming show schedule to other users
To send you transactional emails (account approval, invitations)
To allow patrons to find and favorite artists
To show weather forecasts for your upcoming shows (your show location coordinates are sent to Open-Meteo, a free public weather API)
To improve the app based on usage patterns and your direct feedback

We do not use your information for advertising, and we do not sell or share your personal data with third parties for their marketing purposes.

5. Who Can See Your Information

Artists: Your name, bio, mediums, profile photo, and portfolio are visible to all Buford users. Your booth location and check-in status are visible on the live map when you are actively checked in and have patron visibility enabled. Your email address is visible only to the app administrator.

Patrons: Your name and favorite artists list are not publicly displayed. Your account is private.

Organizers: Your event details and any map pins or announcements you post are visible to all users at your event.

6. Data Storage and Security

Your data is stored securely using Supabase, a PostgreSQL-based backend hosted on AWS infrastructure. Passwords are hashed and never stored in plain text. All data is transmitted over HTTPS.

Profile photos are stored using Supabase Storage. We take reasonable technical measures to protect your data, but no system is perfectly secure.

7. Data Retention

Your account and associated data are retained as long as your account is active. Check-in records expire automatically at the end of each event. If you would like your account and data deleted, contact us at jhiltabidel@duck.com and we will remove it promptly.

8. Third-Party Services

Buford uses the following third-party services:

Supabase — database, authentication, and file storage (privacy policy)
Vercel — web hosting (privacy policy)
Resend — transactional email delivery (privacy policy)
Open-Meteo — weather forecasts, no account required (terms)
OpenStreetMap / Leaflet — map tiles for the live festival map (privacy policy)

9. Children's Privacy

Buford is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Your Rights

You have the right to access, correct, or delete your personal data at any time. To exercise these rights, or if you have any questions about your privacy, please contact us at jhiltabidel@duck.com.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of Buford after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions, concerns, or requests related to your privacy, please reach out:
Joe Hiltabidel
jhiltabidel@duck.com