Privacy Policy

Last updated October 1, 2026

Buy Hoosier is a directory of Indiana farms that sell straight to customers, run by Indian Lakes Marketing LLC. This policy says what information we collect, why, who we share it with, and the choices you have. Questions: brett@buyhoosier.com.

1. If you browse the site

You can browse without an account.

Your location, only if you ask. When you tap “Use my location,” your browser asks your permission and gives the page your approximate location (rounded to about 100 meters) to sort farms by distance. We don't save it to our database. The same goes for a ZIP code or town you type.
The map. Maps are drawn by Mapbox, which receives your IP address and the map area you look at.
Basic server records. Our host, Vercel, keeps standard request records (IP address, page requested, browser type, time) to run and protect the site.
No ad tracking. The site has no advertising trackers and no outside analytics tools.
Farm Stand visit counts. When you open a farm's page or tap its Call, Directions or Website button, we count it so the farm can see how many people visit. We don't store your IP address. To count each person once a day, we make a code from your IP address and browser that changes every day and can't be traced back to you. Counts are kept for 13 months.
Browser storage. The farm application saves your answers in your own browser while you fill it in, so a reload doesn't lose them. They are removed when you send the application.

2. If you sign up for the newsletter

We send your email address to Klaviyo, the service that holds our subscriber list and sends the newsletter. You can unsubscribe with the link in any newsletter email.

3. If you contact us or a farm

The contact page sends your name, email, subject and message to Buy Hoosier by email.
A farm's message form sends your name, email and message to that farm by email, with your email address set so the farm can reply to you directly. After that, the conversation is between you and the farm.
For both, we keep a copy of the message and a scrambled (hashed) form of your IP address, to limit how many messages come from one place and to look into problems. A Cloudflare security check runs on both forms (see section 4).

4. If you apply to list a farm

We collect what the application asks for: farm name, your name, email, phone, the farm's address, what you sell, how customers buy, website and social links, up to two photos, and anything you tell us about the farm.

We use it to review the application and, if approved, to create the farm's page. Photos from the application are stored privately and used only for the review.
We look up the farm's address on the map (Mapbox) to place it for distance search. You choose whether the page shows the full address or only the town.
To stop abuse, we keep a scrambled (hashed) form of your IP address to limit how many applications come from one place. It can't be turned back into your IP address.
A security check by Cloudflare Turnstile runs on the form. Cloudflare receives information about your browser to tell people from automated programs.

5. If you claim a farm page

We collect your name, email, your role on the farm and your phone number, and a hashed form of your IP address. If your email matches the farm's email on record, we email you a one-time code. If not, we review the request and may call the farm's listed phone number to confirm. The Cloudflare check also runs on this form.

6. Farmer accounts

Signing in. You can sign in with Google, with your email address and a password, or with a sign-in link we email you. If you use Google, Google tells us your name, your email address and the link to your Google profile photo. Passwords are stored in scrambled form by Supabase, our database and sign-in provider, and we never see them. Signing in sets cookies that keep you signed in; they are needed for the account to work.
What you put on your Farm Stand is public. Your story, photos, products and prices, hours, posts and pickup spots are shown to anyone who visits your page, and search engines may index them. Your email address is never shown on the site.
Photos. When you upload a photo, your browser removes the location (GPS) and camera details before it is stored.
Your team. If you add a family member or farmhand to your farm, they can edit the farm's page.

7. The writing helpers

If you use “Set it up for me” or “Improve this,” the answers or text you give are sent to Anthropic's Claude API, which returns a draft or a suggestion under its terms for business customers. We keep a copy of what was sent and what came back, so we can check a draft's facts and fix problems. The helpers never publish anything; you review every word before it goes live.

8. Farms listed from public information

Some farm pages were started by Buy Hoosier from public information (the farm's own website, social media and public directories), so customers can find farms that sell direct. These pages show only business information: farm name, town and county, phone, website, and what the farm sells. They never show an email address or a street address. The farm can claim the page for free and change it, or ask us to correct or remove it: brett@buyhoosier.com.

9. Email we send

We send sign-in links, application and claim updates, team invites and contact-form messages through Resend, an email delivery service. We keep a record of each email, with sign-in links and codes removed.

10. Who we share information with

Only the services that run the site, each for its own job: Vercel (hosting), Supabase (database, sign-in and photo storage), Resend (email), Klaviyo (newsletter), Mapbox (maps and address lookup), Cloudflare (form security check) and Anthropic (the writing helpers). When you send a farm a message, the farm receives it. When you send an order request, your name, phone and email go to that farm so they can fill it. We don't sell personal information. We may share information if the law requires it.

11. How long we keep it

Declined applications and declined claim requests: deleted 12 months after the decision.
Messages sent through the contact forms: deleted after 12 months.
Order requests: your name, phone, email, delivery address and notes are removed 1 year after the order is done. We keep the count of orders.
Our record of emails the site sends: deleted after 24 months.
Farm Stand visit counts: deleted after 13 months.
Our record of changes made by Buy Hoosier staff: kept as long as the site runs.
Approved applications and claims become part of the farm's account and are kept while the farm is listed.

You can ask us to delete your account and the information tied to it at any time: brett@buyhoosier.com.

12. Your choices

Ask to see, correct or delete your information: brett@buyhoosier.com.
Unsubscribe from the newsletter with the link in any newsletter.
Turn off location sharing in your browser at any time.

13. Children

Buy Hoosier is for adults. We don't knowingly collect information from children under 13.

14. Changes

If we change this policy, we'll post the new version here with a new date. If a change is significant, we'll also email farms that have accounts.