Privacy Policy
Effective: September 2026
We are a small bakery, not a data company. This page says exactly what we collect, what we do with it, and who else touches it. Short version: we use your details to bake and hand over your order, we never sell them, and nothing tracks you until you say yes.
What We Collect
- When you order: your name, email, phone number, pickup date and time, any notes you add, and your answer to "how did you hear about us" if you give one.
- Payment details go straight to Stripe. We never see or store your card number.
- When you join our list: your email and, if you give it, your first name.
- Your browser keeps your cart and your cookie choice locally so they survive a refresh. That stays on your device.
How We Use It
- To bake your order and email you the pickup details.
- If you type your email at checkout and leave before paying, we save the cart for 7 days and send up to three reminder emails over that week. Every one has an unsubscribe link.
- After pickup we may email you once to ask for a review.
- If you joined the list, occasional emails about new flavors and what is coming up. Unsubscribe any time.
- We do not send text messages.
We never sell, rent, or trade your information.
The Services That Run The Site
A one-person bakery does not run its own servers. These companies process data on our behalf, only to do the job named here:
- Stripe handles payment and holds your order record.
- Resend sends every email we write to you: receipts, pickup details, reminders, review requests.
- Brevo holds the email list if you join it.
- Upstash stores saved carts (7 days), promo-code usage, and our do-not-email list.
- Vercel hosts the site and keeps standard server request logs.
- Sentry receives technical error reports so we can fix bugs. We strip emails and tokens from those reports.
- Google Maps draws the pickup map on the pickup, contact, and how-it-works pages. Loading that map sends your IP address and the page address to Google.
Cookies & Tracking
When you first visit, a banner asks. Nothing below loads until you press Accept. Press Decline and both stay off. Change your mind any time with the Cookie Settings link in the footer, or by turning on Global Privacy Control in your browser, which we treat as a decline.
- PostHog analytics: which pages get visited and how people move through the site, under a random identifier rather than your name. Separately, if we send you a reminder email, we log that send against your email address so we do not send it twice.
- Meta Pixel: tells us whether our Facebook and Instagram ads brought you here. Meta may use that data to show you ads. You can opt out of that at facebook.com/adpreferences.
- Email opens: Brevo and Resend may record whether an email was opened or a link clicked.
How Long We Keep It
- Order records: for as long as the business operates, because we need them for taxes and for you if something goes wrong.
- Saved carts: 7 days, then deleted automatically.
- Unsubscribed addresses: kept on a do-not-email list so we never email you again by mistake.
Your Choices
Want to see what we have on you, fix it, or delete it? Email hello@1cookieco.com and a person will handle it. Every marketing email has an unsubscribe link that works in one click.
Changes
If this page changes in a way that matters, we update the date at the top. Keep using the site and you are agreeing to the current version.