Privacy policy

Cosmic Crumb is a small home bakery in Washington. This page explains, in plain words, what we know about you, why, who helps us handle it, and how to have it deleted. The short version: we keep what we need to bake and hand over your cookies, we never see your card number, and we never sell your information.

What we collect

• Your account: your email address, and your name and phone number if you add them. If you set a password, we store only a scrambled version of it that can't be turned back into the password. If you sign in with Google or Apple, they tell us your email address and an ID for your account with them. If you use a passkey, your device keeps the secret part and we store only the public part.
• Signing in: each time you sign in, we note the IP address and browser you used, to help keep your account safe.
• Your orders and subscription: what you ordered, your box picks, the pickup or delivery time you chose, skipped and paused months, what you paid, and any refunds. If you cancel a subscription, the reason you give. Your account page shows your order history.
• Allergies and diet: only if you add them on your account page: the allergens you avoid, which tree nuts, fish or shellfish you mean, and a short note about your diet. This is health information, so we treat it with extra care (see below).
• Delivery addresses: only when you choose delivery. We keep the street address, city, ZIP code, phone number and any delivery notes you give us, and roughly how far it is from the bakery.
• Gifts: when you buy a gift, the recipient's name and email address and your message, so we can send it to them.
• Our email list: if you sign up for news, your email address, your ZIP code if you give it, where on the site you signed up, and when and to what wording you agreed.
• Push notifications: if you turn them on, the address your browser gives us for sending notifications, and which ones you want (reveals, drops or both). It's linked to your account if you're signed in.

Cookies

We use one cookie to keep you signed in, and another that holds your cart, keeps forms secure and remembers where you were going while you sign in. The second goes away when you close your browser. If you turn on push notifications, your browser also remembers that it did. That's all: there are no advertising cookies, no tracking pixels and no analytics tools on this site.

How we use it

To run your account, take payment, bake your order and get it to you, and to send the emails that go with an order: confirmations, reminders before your box locks and before your pickup or delivery, payment problems and refunds. News about reveals and drops goes only to people who asked for it, by email or push.

Your allergies and diet

We use what you tell us about your allergies and diet for one thing: to warn you before you pick, buy or receive a cookie that contains something you avoid, and so the person baking and packing your order can check it. It's shown only to you and to the people who run the bakery, never to other customers, and we never use it for marketing. The reminder email before your box locks may mention one of your allergens, so it passes through our email service like any other email. We can't promise any cookie is free of an allergen: everything is made in one home kitchen, and the warnings are only as good as what you've told us.

Who helps us

We don't sell or rent your information, and we don't share it for advertising. A few services help us run the bakery:

• Stripe takes payments. When you pay or save a card, you type your card details on Stripe's own page, and they go straight to Stripe. We never see or store your card number. We give Stripe your email address and name so your payments are kept together. Stripe tells us whether a payment went through, and with it sends payment details we keep, such as your name, email address and billing ZIP code, and the card's brand, last four digits and expiry date.
• Mailgun sends our emails, so it handles your email address and what each email says.
• Sentry tells us when something on the site breaks. Error reports are set up to leave out cookies, IP addresses and account details, and email addresses are masked before a report is sent.
• Heroku hosts the site and its database.
• Your browser's push service (from Apple, Google, Microsoft or Mozilla, depending on your browser) delivers push notifications if you turn them on. They only ever say which flavors were revealed or which drop has opened.
• Google Maps: when we plan a delivery route, we open the stops in Google Maps for directions, so your delivery address goes to Google.
• Google and Apple, only if you choose to sign in with them.

We'd also share information if the law required it.

Your choices

• Every news email has a one-click unsubscribe link, and you can also join our email list from your account page. Order emails keep coming while you have orders, since they're about your cookies.
• Turn push notifications off, or choose which ones you get, from your account page or your browser's settings.
• See and change your name, email address and phone number on your account page.
• See, change or clear your allergies and diet notes on your account page at any time.

How long we keep it

We keep your account, addresses and order history while you have an account. If you unsubscribe from our emails, we keep a note that you did, so we don't email you news again. Push addresses that stop working are deleted automatically. We keep sales records for as long as Washington's tax and cottage food rules require.

Deleting your account

To have your account deleted, reply to any email we've sent you from the address on your account. We'll take you off our email list and push notifications, delete your allergies and diet notes, and delete or blank out your account details. Orders you've placed, with the details on them and the payment details Stripe sent us, are sales records the law requires us to keep, so those stay. Stripe keeps its own records of payments, under Stripe's privacy policy.

Keeping it safe

The site only works over a secure (HTTPS) connection, passwords are stored scrambled, and only the people who run the bakery can see customer details.

Children

This site isn't meant for children under 13, and we don't knowingly collect information from them.

Changes and questions

If we change this policy, we'll update it here and change the date at the top. For any question about your information, reply to any email we've sent you.