What Surplate knows about you
Plain language, because this matters more than a wall of clauses. Last updated September 2026.
What we store
- Your sign-in. Handled by Firebase Authentication. We never see or store your password; we receive an account id and the email address you signed in with.
- Your organization. Whether you are a restaurant or a food bank, its name, address, neighborhood, and the email address alerts go to. Food banks also give delivery hours and, optionally, delivery instructions and a nonprofit number; restaurants can give a contact name and what they usually have spare.
- Requests and orders. What a food bank asked for, how much, and by when; which restaurant took how much of it; and when each side confirmed the delivery.
- Order messages. The private chat between the restaurant and the food bank on one order.
- Food a restaurant posts. Its saved dishes (ingredients per serving, allergens, any nutrition numbers it typed in), each post (quantity, when it was made, use-by, pickup details), and, when a photo is read, the draft the photo reader suggested next to what the restaurant confirmed. We do not keep the photo.
- Reports. If you report a problem on an order, the reason and anything you wrote, kept so we can follow up.
- A contact phone number, if you add one. Only used so the other side of an order you have agreed can call you. We never text it, and you can remove it any time under your details.
- Phone alerts, if you turn them on. Your browser gives us an address at its own push service (Google, Apple or Mozilla) for that one device, so we can send it a buzz when you get a message or an order changes. Alert text goes through that service, encrypted, and you can turn it off on each device.
Who can see it
A food bank’s requests, with its name, delivery address and delivery hours, are visible to every signed-in restaurant, so any restaurant can help. Other signed-in food banks can see them too, so food banks can see what is needed nearby and share what they have extra. Food a restaurant posts, with its label, address and pickup details, is visible to every signed-in food bank so they can claim it. Nobody who is not signed in sees anything.
Once a restaurant takes an order, the two sides of that order — and only those two — see each other’s email address, phone number if one was given, and the order chat, so they can arrange the delivery. Nobody else can read an order.
Alert emails put every other recipient in bcc, so restaurants on the same alert cannot see each other’s addresses.
What we do with it
Run Surplate, and nothing else. We do not sell it, we do not share it with advertisers, and we do not use it to build a profile of you. Three outside services receive data: the email provider that delivers your alerts; your browser’s own push service (Google, Apple or Mozilla), which carries phone alerts to devices you turned them on for; and, when a restaurant asks for a photo to be read, the AI provider this site is set up with (OpenAI or Google), which receives that photo and the note typed with it, and nothing else.
You can turn email and phone alerts off at any time under the settings menu behind your initials.
How long it stays
Requests and completed orders are kept so both sides have a record of what was delivered, month by month. Order chats are kept with the order.
Deleting your account
Tap your initials, then Delete my account. We remove your organization record, contact details, saved dishes, posted food, phone-alert devices and your messages, and your sign-in. Orders that are already part of another organization’s delivery history are kept with your name removed, so their records stay correct. If you cannot sign in, see Help.
Children
Surplate is for organizations that handle food, not for individual consumers, and it is not directed at children.
Contact
Questions, corrections or deletion requests: support@surplate.app.
Replace that address, and have somebody qualified review this page, before you take real partners’ data.