Privacy policy

Splash Baking ("Splash", "we", "us") is a small family business in Chicago, Illinois that sells cookie kits at splashbaking.com. This policy explains what we collect when you use our website, why, who helps us handle it, and the choices you have. The short version: we collect what we need to send you cookies and tell you about drops, we don't sell your information, and we don't use advertising trackers.

What we collect

When you browse the site

• Which page you viewed, the website that linked you here (just its name, like "instagram.com"), and the marketing tags in that link, so we can count visits and see which posts bring people in.
• Your approximate location (country, state and city) as estimated by our hosting provider. We do not store your IP address, and we do not set a cookie to recognise you: to count unique visitors we keep a scrambled code that changes every day, so it can't be used to follow you from one day to the next.

When you join the waitlist or sign up for drop emails

• Your email address and, if you give it, your first name.
• Which form you used, and the marketing tags in the link you arrived from (for example "utm_source=instagram"), so we know which posts bring people in.
• Your approximate location (country, state and city) as estimated by our hosting provider from your connection. We do not store your IP address.

When you place an order

• Your name, email address, phone number and shipping address.
• If you send kits as gifts: each recipient's name and shipping address, and any gift message you write.
• What you ordered, what you paid, discount codes used, and shipping and tracking details.
• Payment card details are entered directly with our payment processor, Stripe. They never touch our servers, and we never see your full card number.

When you create an account

• Your email address and first name.
• If you use a password: a scrambled version of it (a one-way scrypt hash). We cannot see or recover your actual password. When you choose one, we check it against a public list of passwords exposed in past data breaches, using a method that sends only the first 5 characters of a fingerprint of it, never the password itself.
• If you sign in with Google or Apple: the account ID, email address and first name that Google or Apple share with us. With Apple's "Hide My Email", we receive a private relay address instead of your real one. We never receive your Google or Apple password.
• If you add a passkey: its public key, a label for where it's saved (for example "iCloud Keychain"), and when it was added and last used. The private part of a passkey stays on your device or in your password manager; we never receive it, and we never receive your fingerprint or face data.
• Sign-in sessions: when and on what kind of browser you signed in, so you stay signed in.

When you send us a photo of your bake

• The photo, plus the name and note you choose to add, and whether you said we may share it on our social media. We only post photos where you ticked that box.
• Your approximate location (country, state and city), as above.

When you email us

Your email and whatever you choose to tell us.

Cookies and similar technology

We keep this to what the site needs to work:

• Your cart is saved in your own browser (local storage) so it is still there when you come back. It never leaves your device until you check out.
• A sign-in cookie keeps you signed in to your account for up to 30 days. Short-lived cookies (10 minutes) protect the Google, Apple and passkey sign-in steps.
• Stripe sets its own cookies during checkout to process payments and prevent fraud.
• Klaviyo, our email provider, sets a cookie that recognises you if you are on our email list (for example after you click a link in one of our emails or sign up on the site). For people it recognises, it notes which kits you looked at and what you put in your cart, so we can send one reminder. If it doesn't know who you are, nothing is sent. Our emails also use Klaviyo's standard open and click tracking. If your browser sends a Global Privacy Control signal, the Klaviyo script doesn't load at all.

We do not use advertising cookies, ad pixels or third-party analytics.

How we use it

• To take, pack, ship and support your order, including emailing receipts and shipping updates.
• To email you when a new drop opens, if you joined the waitlist or turned on drop emails. Every one of these emails has an unsubscribe link.
• If you are on our email list, or ticked the box at checkout to hear from us, to send you one reminder when you leave kits in your cart, don't finish a checkout, or look at a kit without ordering. These emails have an unsubscribe link too.
• To run your account: sign-in, password resets, and showing your order history.
• To keep the site safe: limiting repeated sign-in or sign-up attempts and spotting abuse.
• To understand, in aggregate, which channels bring people to Splash and plan how many kits to bake.
• To share bake photos on our social media, only where you gave permission.
• To meet legal, tax and accounting obligations.

Who we share it with

We do not sell or rent your personal information, and we do not share it for advertising. We use a handful of service providers who handle it on our behalf, only to do these jobs:

Provider	What they do for us
Stripe	Payments, sales tax calculation, fraud prevention and receipts
Vercel	Hosts the website
Neon	Hosts our database
Klaviyo	Sends our marketing emails (drop announcements and cart reminders) and keeps our email list
Brevo	Sends our emails: drop announcements and account emails
Google Workspace	Our email inbox at hello@splashbaking.com
Google and Apple	Only if you choose "Continue with Google" or "Continue with Apple"
Shipping carriers	Deliver your kits, using the name and address on the order

We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of our business, in which case this policy would continue to apply.

How long we keep it

• Orders: as long as tax and accounting rules require, usually up to 7 years.
• Waitlist: until you unsubscribe. After that we keep only a record that you unsubscribed, so we never email you by mistake.
• Accounts: until you delete your account. Deleting it removes your profile, password and Google or Apple link and signs you out everywhere. Past orders stay, because we need them for our records.
• Sign-in, verification and reset links: they expire after 30 days, 24 hours and 1 hour respectively.
• Bake photos: until you ask us to remove them.

Your choices and rights

• Stop drop emails and reminders with the unsubscribe link in any of them, or in your account under Emails.
• Turn off on-site tracking by turning on Global Privacy Control in your browser, or by clearing your cookies for splashbaking.com.
• See and update your name, password and orders at splashbaking.com/account.
• Delete your account from the bottom of your account page.
• Ask us for a copy of the information we hold about you, to correct it, or to delete it (including from the waitlist, or a photo you sent), by emailing hello@splashbaking.com. We will reply within 30 days. Depending on where you live, you may have additional rights under your state's privacy law; we honor these requests for everyone.

Security

We use encrypted connections (HTTPS) everywhere, store passwords and sign-in links only in scrambled form, limit who on our team can access customer data, and keep card details entirely with Stripe. No system is perfectly secure, so please use a password you don't use elsewhere. If we ever learn of a breach that affects you, we will tell you.

Children

Splash is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

Where your data is stored

We are based in the United States and so are our service providers' main data centers. If you use the site from outside the US, your information will be processed in the US.

Changes

If we change this policy we will update the date at the top. If a change is significant, we will let account holders and the waitlist know by email before it takes effect.

Contact

Questions or requests: hello@splashbaking.com. Splash Baking, Chicago, Illinois.