Legal
Privacy Policy
Last updated: October 2026. This is an initial product document describing current architecture honestly — not a claim of legal certification or a substitute for legal advice.
Who we are
This Privacy Policy explains how Bakeryss ("we", "us") handles information when you use Sourdough Lab and our public website. We are a small creator-run project; the philosophy is simple: we store what the product needs to work, we do not sell personal data, and we are open about the services we rely on.
Account and authentication data
Creating an account collects your name (optional), email address and a password. Authentication is handled by Supabase Auth — no custom password storage exists in our code, and password hashing is Supabase's responsibility. With your permission we exchange an email confirmation link, and after sign-in we keep a session so you stay signed in between visits.
Application data you enter
Your baking data — starters, feeding logs, observations, bake planner schedules, diagnostic sessions, journal entries, recipes and measurements — is stored under your account and shown only to you. This is your history: it is the reason the product exists, and we never use it for advertising or sell it to anyone. We do not delete it when a plan changes.
Hosting and infrastructure
Application data and authentication live in Supabase, a hosted Postgres and auth provider. Supabase processes data on our behalf under its own terms and region settings. The website is deployed on Netlify; like any web host, it logs minimal operational data (requests, errors) that we use only to keep the site running.
Cookies and session storage
We use a session cookie to keep you signed in and the minimal browser storage the authentication library requires. The public website itself sets no tracking cookies. We do not run third-party advertising, analytics or fingerprinting scripts today. If analytics are ever added, this policy will be updated first.
Commerce and payments
Lab+ membership payments never reach us: this site itself never stores card numbers, and payments never go through us. The one-time ebook store is still a planned future feature; when it launches, this section will be updated to describe exactly what payment data is collected, who processes it and where it goes, before checkout goes online for it.
Disclosure and retention
We share data only with the providers named above and only to the extent needed to run the service. We retain account and application data while your account is active. Export and full self-service deletion are planned. In the meantime, you can request deletion of your account and data, or ask a privacy question, by emailing the support address below; we will honor reasonable requests.
Your rights
Depending on where you live you may have rights to access, correct or delete your personal data. Because your baking data is yours by design, most of it is visible and editable inside the app directly. To exercise a data right you cannot handle in the app, email the support address below. This policy is an honest description of how we operate — it is not a claim of GDPR, CCPA or other legal certification, and it is not legal advice.
Changes
We may update this policy as the product grows (for example, when commerce, analytics or new data types arrive). Material changes will be announced on the website and, where practical, when you next sign in.
For privacy or data-rights requests, email support@bakeryss.com. See also our Refund Policy.