Privacy Policy

Account details. When you create an account with an email address, we store your email, a display name based on it, and your password in hashed form (we can't see your actual password). When you sign in with Google, we receive your name, email address and profile picture from Google.

Orders and tokens. The bread tokens you buy, spend or are given, the loaves you order, your chosen delivery dates and the status of each order. If you set up a standing order, we keep its day, loaves and address to place it each week. Our bakers may add notes to an order to help fill it.

Token gifts. When you gift tokens, we keep the recipient's email address, the amount and any message you add, and send them one email about it. If they don't have an account, that email invites them to sign up with that address to claim the tokens; we don't contact them again, and unclaimed gifts go back to you after 30 days. The recipient sees your name and your message. If either of you deletes your account, your name, email and message are removed from the gift record.

Delivery details. The delivery addresses you save, and any delivery instructions and phone number you add to them, and the address's map location, which we look up to check it's in our delivery area and to plan the delivery route. Each order keeps a copy of the address (and its map location) it was sent to, so changing your saved addresses doesn't change past orders.

Sign-in and security information. When you sign in, we record the IP address and browser type used for that session, to keep your account secure.

Messages. If you email us, we keep the message and your email address so we can reply.

Payments. Card payments are not yet available on the site. When they are, they will be handled by our payment processor, Stripe; we will not see or store your full card number. We will update this policy before that happens.

• To create and secure your account and sign you in.
• To keep track of your token balance and fill and deliver your orders.
• To bring your order to the address you choose, and to call or text you about a delivery if you've given us a phone number.
• To send account emails, such as confirming your email address and resetting your password, and emails about your orders: when you place one, if we cancel one, and when it's delivered.
• To answer your questions and support requests.
• To keep accurate records of token purchases and orders.

We don't use your information for advertising, and we don't send marketing email.

If you choose to sign in with Google, we request only your basic profile (name and profile picture) and email address. We use them only to create your account, sign you in and contact you about your account and orders. We don't sell this information, use it for advertising, or share it except with the service providers listed below that help us run the site.

Local Loaves' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We don't sell or rent your information. We share it only with service providers that help us run the site, and only as much as they need to do so:

• Deno Deploy hosts the website.
• Prisma hosts our database, in the United States.
• Resend sends account emails, such as confirmation and password reset links.
• Cloudflare manages our domain name and forwards email sent to hello@local-loaves.com.
• The US Census Bureau geocoder turns each delivery address you save into map coordinates, so we can check it's within our delivery area. Only the street address, city, state and ZIP code are sent, without your name or other details.
• Google provides "Sign in with Google" (if you use it) and the fonts on our pages. When a page loads, your browser requests the fonts from Google, which receives your IP address.

We may also disclose information if the law requires it, or to protect the rights, property or safety of Local Loaves, our customers or others.

We use only the cookies needed to keep you signed in and to complete sign-in with Google securely. We don't use analytics, advertising or tracking cookies.

We keep your account information for as long as your account is open. Sign-in sessions expire after a week, and email confirmation and password reset links expire after a day or less. Our hosting and email providers keep short-term technical logs.

When you delete your account (from your account page, or by asking us), we remove your sign-in details, saved addresses and other personal information, including the delivery address on each past order. Any unused tokens are lost. We keep a record of token purchases and orders, stripped of your name, email address and delivery details, where we need it for our accounts and bookkeeping.

So we can recover from mistakes or outages, we keep encrypted nightly backups of our database for 30 days. Information you've deleted drops out of them as they expire, within 30 days.

You can delete your account yourself at any time from your account page, on the website or in the app. You can also ask us to show you the information we hold about you, correct it, or delete your account for you. Email hello@local-loaves.com from the address on your account and we'll respond within 30 days. If you signed in with Google, you can also remove Local Loaves' access at any time from your Google Account settings.

The site is served only over HTTPS, passwords are stored hashed, and account links expire. No online service can be perfectly secure, but we work to protect your information and limit who can access it. If we learn of a breach that affects you, we'll let you know.

Local Loaves isn't directed at children under 13, and we don't knowingly collect their information. If you believe a child has given us information, contact us and we'll delete it.

If we change this policy, we'll post the new version here and update the effective date. If the changes are significant, we'll also let account holders know by email.

Questions or requests about your privacy? Email hello@local-loaves.com. Local Loaves, Augusta, Georgia.