Legal
Privacy policy
What we collect, why, who sees it and how long we keep it. We don’t sell personal information and we don’t show ads.
Effective January 12, 2027.
What this policy covers
This policy covers doughdate.com, the bakery shops that run on Doughdate (on a Doughdate web address or the bakery’s own domain), and the emails Doughdate sends. “Doughdate,” “we” and “us” mean Epik LLC, a Michigan limited liability company, doing business as Anchor Apps, which runs Doughdate. Words like “bakery” and “customer” mean the same as in our terms of service.
Bakeries and Doughdate
When you order from a bakery, the bakery decides what to do with your order and your details: it’s the bakery’s customer list, not ours. Doughdate stores and processes that information for the bakery, as its service provider, so the bakery can take and fill your order. We don’t use a bakery’s customers’ information for our own marketing, and we don’t share one bakery’s customers with another bakery.
Each bakery is a separate business with its own practices. For questions about how a bakery uses your information, contact the bakery. You can also contact us and we’ll pass your request on.
What we collect
Bakers and their teams
- Your name and email address, and your role in the shop (owner or team member).
- Your shop’s details: its name, description, logo and photos, menu and prices, bake days and limits, pickup area and pickup address, delivery areas, payment instructions (which may include a phone number or Zelle details), reply-to and notification email addresses, and web addresses.
- A record of actions in the shop, such as who confirmed or changed an order.
- If you accept cards: the details that link your shop to your own Stripe account. Stripe collects what it needs to open and run that account.
- When billing starts: billing contact details and invoices. Card details are collected and stored by Stripe, not by Doughdate.
Customers who order from a bakery
- Your name, email address and, if you give it, your phone number.
- For delivery, your street address, city and ZIP code.
- Your order: what you ordered, the day and time, prices and fees, how you plan to pay, any note you add, and the order’s history (for example confirmed, ready or cancelled).
- The date your email was confirmed with a 6-digit code.
- Sometimes a bakery enters an order for you, for example one you placed by phone or message. Then the bakery types in your details.
There are no customer accounts or passwords. If you pay by card, your card details go to Stripe, which processes the payment for the bakery. Doughdate doesn’t see or store your full card number.
“Tell me” requests
If you ask a bakery to email you when orders open or when a full day has room again, we keep your email address, the day, and the item or cart you were looking at, so we can send that one email.
Messages to a bakery
If you message a bakery from its shop, we keep your name, email address, your phone number if you ask for a call, your messages and the bakery’s replies, which order or product it was about, and the IP address the first message came from. The bakery and its team can read the conversation, and we email each side when the other writes.
Early-access sign-ups
If you sign up for early access on doughdate.com, we keep your name, email address, bakery name, city and state, what you bake, how you take orders today, roughly how many orders you get each week, and your Instagram or website if you give it. We also keep your referral code, who referred you, and the IP address the sign-up came from.
Everyone who visits
- When you send a code, place an order, sign up or make a “tell me” request, we record the IP address it came from, to limit abuse.
- Like most websites, our servers keep logs of requests, which include IP addresses, the pages requested, and browser details. We use them to keep Doughdate running and secure.
- We may use Cloudflare Web Analytics to count visits to pages. It doesn’t use cookies and doesn’t track you across sites.
How we use it
- To run the shops: take orders, check a bakery’s limits, show orders to the bakery, and keep everyone up to date.
- To send emails you need or asked for (see below).
- To sign bakers in and keep shops secure, including stopping spam and fake orders.
- To run the early-access list: confirm your email, keep your place in line, invite you, and send launch updates.
- To take card payments for bakeries that accept them, through Stripe, including the service fee on card orders.
- To bill bakeries for service fees, once billing starts.
- To support bakeries, fix problems, and understand how Doughdate is used so we can improve it.
- To follow the law and enforce our terms.
We don’t sell personal information, share it for advertising, or use it to build advertising profiles.
Emails
- Customers get emails about their orders: the 6-digit code, the order request, confirmation or decline, changes, a reminder before pickup or delivery, and any “tell me” alert they asked for. They come from Doughdate’s address with the bakery’s name (“Bakery via Doughdate”), and replies go to the bakery. Each “tell me” email has a link to stop them.
- Bakers get sign-in codes, new order alerts, reminders about orders waiting for a reply, and a morning summary of the day’s bakes, which the owner can turn off.
- Early-access sign-ups get a confirmation code, a welcome email, occasional launch updates and their invite. Every update has a one-tap link to stop them.
Who we share it with
We share information only as needed to run Doughdate:
- The bakery you order from sees your order and contact details. Once it confirms your order, you see its pickup address.
- Hetzner hosts our servers and database, in a data center in Nuremberg, Germany.
- Cloudflare sits in front of our servers to deliver pages and block attacks, runs the Turnstile check that tells people from bots on some forms (it sees your IP address and browser details), stores our encrypted backups in Cloudflare R2, and may provide page analytics.
- An email provider sends our emails. It receives each email’s recipient, subject and content.
- Stripe processes card payments for bakeries that accept cards. When a customer pays by card, Stripe receives the card details and the order payment details it needs to process the payment and any refund. Stripe will also handle card payments for bakery billing once it starts, and receives the bakery’s billing details.
- The law: we may share information if the law requires it, or to protect people from harm or fraud.
- A change of ownership: if Doughdate is sold or merged, information would pass to the new owner under this policy.
These providers may use the information only to provide their service to us. A small number of Doughdate staff can see shop data when needed to support bakeries, fix problems or keep Doughdate secure.
Where it’s stored
Doughdate is for people in the United States, but our servers are in Germany, so your information is stored and processed there and by our providers in the United States and other countries. By using Doughdate you understand your information will be handled there.
Cookies and storage on your device
We use only cookies needed for Doughdate to work. We don’t use advertising or tracking cookies.
| Name | What it does | How long |
|---|---|---|
| dd_verified | Remembers your confirmed email at a bakery so your next order doesn’t need a new code. You can clear it by signing out of the shop. | 90 days |
| dd_admin | Keeps a bakery owner or team member signed in to their shop. | 90 days, or until you sign out |
| dd_platform | Keeps Doughdate staff signed in to our own console. | 14 days, or until sign out |
| dd_look_preview | Lets a bakery owner preview a new look for their shop before publishing it. | Until the preview ends or the browser closes |
Bakery shops also save your cart and the details you’ve typed at checkout in your browser’s own storage, so they aren’t lost if the page reloads (for example inside Instagram’s browser). That stays on your device; you can clear it in your browser settings. When Turnstile appears on a form, Cloudflare may set its own cookies needed for the check.
How long we keep it
| Information | How long |
|---|---|
| 6-digit email codes | Deleted a day after they expire (codes expire within 15 minutes) |
| Copies of emails we send | 7 days after sending; 30 days at most for emails that couldn’t be sent |
| “Tell me” requests | Deleted once the day has passed; for a whole shop’s opening, 30 days after the email goes out, or after a year if it never does |
| Messages to a bakery | Deleted a year after the last message in the conversation |
| Early-access sign-ups | Unconfirmed sign-ups are deleted after 7 days, and declined ones 90 days after the decision. Others, including the IP address they came from, are kept until the bakery joins or you ask us to delete it. If we decide not to open Doughdate to the public, we delete the list |
| Sign-in sessions | Deleted when they expire |
| Team invitations | Deleted 30 days after they expire, are accepted or are withdrawn |
| Abuse-prevention records (such as IP addresses used to limit requests) | 1 day, or 30 days for a request to stop “tell me” emails, which is kept in a scrambled (hashed) form |
| Photos a bakery replaced or removed | Deleted after about a week |
| Server logs | 90 days |
| Orders, customers and shop details | For as long as the bakery uses Doughdate, so it can see its order history; they aren’t deleted on a timer. When a bakery closes its shop or asks us to, we delete them within 30 days, except records we must keep by law. A customer can ask the bakery, or us, to delete their details from a shop |
| Billing records | As long as tax and accounting laws require |
| Backups | Encrypted backups let us recover from mistakes or a failure. Deleted information can stay in them for up to 30 days: 7 days for point-in-time backups and 30 days for nightly backups |
How we protect it
- Every connection to Doughdate is encrypted.
- Each bakery’s data is kept separate, and every request is checked so one shop can’t see another’s.
- There are no passwords to steal. Sign-in codes, links and session cookies are stored only in a scrambled (hashed) form, and codes expire quickly.
- Backups are encrypted before they leave our server.
- Access to our servers is limited to a few people.
No system is perfectly secure. If a breach affects your information, we’ll tell the people affected and the bakeries involved as the law requires.
Your choices and rights
- Customers: to see, correct or delete your information at a bakery, contact the bakery, or contact us and we’ll work with the bakery. You can stop “tell me” emails with the link in them, and clear the remembered email by signing out of the shop.
- Bakers: you can change your shop details in your admin at any time, export your menu, and ask us for a copy of your shop’s data or to close your shop and delete it.
- Early-access sign-ups: use the link in any update to stop updates, or ask us to remove you from the list.
To make a request, contact us using the details below. We may need to confirm it’s you, usually by email. We won’t treat you differently for making a request.
California residents
If California privacy law applies to us, California residents have the right to know what personal information we collect, use and share; to ask for a copy of it; to ask us to correct or delete it; and not to be treated differently for using these rights. The categories we collect are listed above under “What we collect,” and the ways we use and share them under “How we use it” and “Who we share it with.” We don’t sell personal information or share it for cross-context behavioral advertising, and we don’t use sensitive personal information to infer things about you. Where we hold information for a bakery as its service provider, we may pass your request to that bakery. You can make a request yourself or through someone you authorize.
Children
Doughdate isn’t meant for children under 13, and we don’t knowingly collect information from them. Bakery owners must be at least 18. If you think a child under 13 has given us information, contact us and we’ll delete it.
Changes to this policy
If we change this policy, we’ll post the new version here with a new date. If a change is significant, we’ll also email bakeries and post a notice on this site before it takes effect.
Contact
Questions or requests about your privacy? Email [email protected]. We answer within 30 days.