Privacy

We're a two-person home bakery. We collect what we need to bake your order and hand it to you at the market, and a little about how people move around this site so we can make it less confusing. We don't sell your information to anyone, we don't run ads, and we don't build profiles to follow you around the internet.

If you'd rather we deleted everything we have about you, email hello@solandflour.com and we will.

When you place an order or reserve a share, we ask for your name, email address, phone number, which market day you want, and anything you type into the order notes. We keep that so we know what to bake, who to hand it to, and how to reach you if something changes — a rained-out market, a sold-out loaf.

If you sign in to your account, we use your email address to send you a sign-in link. There's no password to lose.

We never see or store your card number. Payments go straight to Stripe, and what comes back to us is a yes or no and the amount.

We use PostHog, an analytics service, to understand how this site is actually used — which pages people visit, what they click, where they give up. It sets a cookie so repeat visits from the same browser count as one person rather than several.

PostHog also records browsing sessions on the public pages of this site. That recording captures page contents, mouse movement, clicks, and scrolling, so we can watch back where the ordering flow trips people up. What you type into form fields is masked before it leaves your browser — we see that a field was filled, not what was put in it. Recording is switched off entirely on your account pages and on order and share confirmation pages, because those show your name and order history on screen.

Our host, Vercel, also counts page visits at the server level. Those counts are aggregate and aren't tied to you.

If you'd rather not be measured at all, any browser's private mode works, and most tracker-blocking extensions will stop both of these. Nothing about ordering breaks if you block them.

We're small, so we rent most of our plumbing. Each of these sees only the slice it needs to do its job, and none of them are permitted to sell it or use it for their own advertising:

• Supabase — stores orders, accounts, and share memberships.
• Stripe — takes payment. Card details go to them directly and never touch our systems.
• Resend — sends order confirmations, pickup reminders, and sign-in links.
• PostHog — the analytics and session recording described above.
• Vercel — hosts the site.
• Behold — pulls our Instagram photos onto the site.

We don't sell or rent your information, and we never have. We don't share it with advertisers or data brokers. We don't send marketing email you didn't ask for — the mail we send is about an order you placed or a share you joined.

We'll hand information to law enforcement only if we're legally required to, and we'll tell you if we're allowed to.

Orders and share records stick around as our books — we need them for taxes and for working out how much to bake next season. Analytics data and session recordings age out on PostHog's retention schedule and are then discarded; we don't keep our own copies of either.

Ask us to delete your account and order history and we will, minus what tax law makes us keep.

Three kinds, all first-party: one that remembers what's in your cart, one that keeps you signed in to your account, and PostHog's, which tells repeat visits apart. No advertising cookies, because we don't advertise.

This site is meant for adults buying bread. We don't knowingly collect anything from children under 13. If you think we have, email us and it's gone.

If this policy changes we'll update the date at the top. Nothing here applies retroactively to information already collected under an older version.

Questions, corrections, or a deletion request — email hello@solandflour.com. A real person reads it. We're based in Wayne, Pennsylvania.