Privacy policy

Who we are and what this covers

Bakes & Brews is an Indian-American café and bakery at 5019 Lone Tree Way, Ste B, Antioch, CA 94531. In this policy, “we”, “us” and “our” mean Bakes & Brews, and “you” means anyone who visits our website or uses the Community Shelf.

This policy covers:

• our website, bakesandbrews.shop, and
• the Bakes & Brews Community Shelf app at shelf.bakesandbrews.shop, including signing in with Google or Facebook.

When you follow a link to another site, like Instagram, WhatsApp or Google Maps, that site’s own privacy policy applies.

About the Community Shelf

The Bakes & Brews Community Shelf is our give-back project. Neighbours share homegrown produce, like vegetables, herbs, greens and fruit, on self-service racks inside our café. Anyone can browse the shelf without an account. To get a packet, you can:

• pay online and take it from the rack,
• hold it and pay at the counter, or
• take it for free, when the grower has priced it as Free.

Neighbours who want to share what they grow sign in with Google or Facebook, make a short profile and apply to be a seller. Our staff review each request and every post before it goes on the shelf. The café collects the money for sales and pays sellers itself.

We use Google and Facebook sign-in only so you can have an account on the shelf without making a new password. We don’t use it for anything else.

What we collect on this website

The “Hear it first” form

If you fill in the form on our home page, we collect:

• your email address,
• your phone number, and
• anything you write in “What are we missing?” (optional).

We use these to send you a note when the doors open and to share shop news. What you write about the menu helps us decide what to make. The form saves your details to a Google Sheet that we manage, using Google Apps Script.

Measuring visits

We use Google Analytics and Google Tag Manager to understand how people use the site, for example how many people visit, which pages they see, and whether they tap Call, Directions, Instagram, WhatsApp, the ordering buttons or the sign-up form. Google Analytics uses cookies and collects things like your device type, browser, rough location and the pages you visit. We don’t send your email address, phone number or anything you type into the form to Google Analytics.

Things on the page that come from Google

Our fonts load from Google Fonts, and the map on our home page is embedded from Google Maps. To show them, your browser connects to Google, which receives your IP address and may set its own cookies for the map. See Google’s privacy policy.

Hosting

Our website is hosted by Vercel. Like any web host, Vercel receives basic technical information when you visit, such as your IP address and browser type, to deliver the page and keep the site secure.

What we collect in the Community Shelf app

You can browse the shelf, hold an item and pay online without an account. We only ask for information when you do one of the things below.

Signing in with Google or Facebook

An account is only needed if you want a profile or want to sell. When you sign in, Google or Facebook shares with us:

• your name,
• your email address, and
• your profile photo.

With Google, we ask only for the basic sign-in permissions (openid, email and profile). With Facebook, we ask only for your public profile and email address. We don’t get your password, contacts, posts, friends, files or anything else from either account. We also note which of the two you used, so we know how you sign in.

Your profile

After you sign in, you make a profile. It can include:

• a photo (if you skip it, we use your Google or Facebook photo) and a display name,
• your area, for example your neighbourhood or town,
• your mobile phone number (optional for buyers, needed for sellers),
• your usual shelf (which café branch you visit),
• your notification choices, and
• a short “about you” and your Instagram handle, both optional.

If you sell, we also ask how you’d like to be paid, for example the email address or phone number you use for Zelle.

Seller applications

To become a seller, you tell us what you grow, where you grow it, how often you’ll have some, which shelf you’d like to use, and a little about yourself. Our staff use this to review your request.

Posts and photos

When you post an item, we keep what you enter: the item name, category, packet size, price (or Free), how many packets, a description, the dates it was picked and is best before, whether you’d like packing help, and your photos. When you place it on a rack, we record the rack number, the time, and an optional photo of it on the rack.

Holds

You don’t need an account to hold an item. To hold one, you give us your name, mobile number, email address, the day you’ll pick it up, and an optional note. We email you a pickup code and use your number only if our staff need to call you about the hold. We also use your number and email to stop any one person from holding too many items at once.

Paying online

Online payments go through Stripe Checkout. You enter your card or wallet details on Stripe’s secure page, not ours, so we never see or store your card number. Stripe tells us when the payment goes through. We keep a record of the order: the item, the amount, the time, an order code, and the email address you gave, so we can reach you about your order. See Stripe’s privacy policy.

Emails we send

The app sends emails through Resend: pickup codes, notes about your seller request, and the updates you choose in your profile, such as when your hold is about to end, when your post is approved, or when something you’re selling is held or sold. We keep a short record of each email the app sends (who it went to, what kind of email it was, and whether it was sent), so we can help if one goes missing. We don’t send text messages.

Sales and payouts

When a packet is paid for, picked up or taken for free, we record the sale: the item, the branch, how it was sold, the amount and the time. We keep a record of each payout we make to a seller: the amount, the period it covers, how we paid (Zelle or cash) and a reference.

What other people can see

If you sell on the shelf, anyone visiting it can see your seller page and your posts. That includes:

• your display name and photo,
• your area and usual shelf,
• your “about you”,
• your Instagram handle, only if you choose to show it,
• when you joined, and
• your posts and their photos.

Photos you upload to the app can be viewed by anyone who has the link, so please keep personal details out of them.

How we use your information

We use your information to:

• run the Community Shelf: show items, hold packets, take payments, and keep the shelf counts right,
• create and look after your account and profile,
• review seller requests and posts,
• contact you about your holds, orders, posts, seller request and payouts,
• pay sellers what they’re owed,
• keep records of sales for our bookkeeping and taxes,
• prevent abuse, such as too many holds by one person, and keep the shelf safe and fair,
• tell you when we open, if you signed up on our website, and
• understand how people use our website, so we can improve it.

We don’t sell your personal information. We don’t share it with anyone for advertising, and we don’t use what we learn in the app to advertise to you.

Who helps us, and who we share with

We use a small number of service providers to run the website and the app. They process your information only on our behalf and only to provide their service to us.

Supabase

Stores the app’s database, handles sign-in, and stores photos. Supabase privacy policy

Vercel

Hosts this website and the Community Shelf app, and runs our scheduled tasks. Vercel privacy policy

Stripe

Takes online card and wallet payments. Stripe privacy policy

Resend

Delivers the app’s emails. Resend privacy policy

Google

Google sign-in, Google Analytics and Tag Manager, Google Fonts, the Google Maps embed, and the Google Sheet for the “Hear it first” list. Google privacy policy

Meta (Facebook)

Facebook sign-in. Meta privacy policy

These providers may store and process information in the United States or Canada.

Apart from these providers, we only share personal information if the law requires it, to protect people’s safety or our rights, or if the café’s business is ever sold or transferred, in which case this policy would still apply to your information.

Google user data

This section explains how the Bakes & Brews Community Shelf handles information we receive when you choose “Continue with Google”.

What we access

Only your basic Google profile: your name, email address and profile photo, through the openid, email and profile permissions. We don’t ask for, and can’t see, your Gmail, Drive, Calendar, contacts or any other Google data.

How we use it

• To create your Community Shelf account and sign you in.
• To fill in your profile name and photo, which you can change.
• To send you the emails you ask for, such as pickup codes and updates on your holds, your seller request and your posts.

We don’t use Google user data for advertising, and we don’t sell it.

Sharing

We don’t share Google user data with anyone, other than the service providers listed above who store and process it for us (Supabase for the database and sign-in, Vercel for hosting, and Resend to deliver emails to your address). Your email address is never shown publicly. Your display name and photo appear on your seller page only if you sell.

Storage and protection

Your information is stored in our Supabase database. It is encrypted in transit (HTTPS) between your device, our app and our providers. Access is limited by role: database rules let each person see only what they should, and only café staff who run the shelf can see private contact details.

Retention and deletion

We keep your Google profile information while your account is open. When you ask us to delete your account, we delete it, as explained in Delete your data. You can also remove our access at any time from your Google Account’s third-party access page.

Limited Use

The Bakes & Brews Community Shelf’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the sign-in and account features you can see, we don’t transfer it except as described above or as required by law, we don’t use it for advertising, and people only see it when it’s needed to run the shelf for you (for example, café staff reviewing your seller request), to support you, for security, or to comply with the law.

We don’t use Google user data to develop, improve or train artificial intelligence or machine learning models, and we never use it to create AI-generated images or other content about anyone.

Cookies

On this website

Google Analytics and Google Tag Manager use cookies to count visits and see how the site is used. The embedded Google Map may set Google’s own cookies. You can block or delete cookies in your browser settings, or install the Google Analytics opt-out add-on. The site still works without them.

In the Community Shelf app

The app uses cookies only to keep you signed in and to remember which shelf you chose. It doesn’t use advertising cookies. Stripe’s checkout page, which is on Stripe’s own site, may use its own cookies to process your payment and prevent fraud.

How long we keep it

• Account and profile: while your account is open.
• Seller applications, posts and photos: while your account is open, unless you remove them sooner.
• Holds and online orders: as long as we need them to run the shelf and keep our sales records.
• Sales and payout records: as long as we need them for the café’s bookkeeping and as tax law requires.
• “Hear it first” list: until you ask us to take you off it.
• Website analytics: Google Analytics keeps data for a limited period set in our account.

When you ask, we delete or anonymise the rest. Anonymised means we remove your name and contact details, so the record can no longer be linked to you.

Delete your data

You can ask us to delete your Community Shelf account and the information we hold about you at any time. This section is also our data deletion instructions for Facebook sign-in.

How to ask

• Call us at (925) 301-8384.
• Message us on Instagram at @bakes.brews.
• Email us at support.bakesnbrews@gmail.com.
• If you have a Community Shelf account, you can also delete it yourself: sign in, open your profile and choose “Delete my account”.

Tell us the name and the email address you used. We may ask you to confirm it’s you before we delete anything, and we’ll let you know when it’s done. To come off the “Hear it first” list, ask the same way.

What gets deleted

• Your account and the name, email address and photo we got from Google or Facebook.
• Your profile: photo, display name, area, phone number, usual shelf, notification choices, about you, Instagram handle and payout details.
• Your seller application, your shelves, and your posts and photos.
• Your name, phone number and email address on holds and orders.

What we keep

We keep records of past sales and payouts, because the café needs them for bookkeeping and tax law. We anonymise them first, so they no longer show your name or contact details.

Remove the app’s access to your Google or Facebook account

Deleting your account with us doesn’t change your Google or Facebook settings. To remove the Bakes & Brews Community Shelf from them:

• Google: go to your Google Account’s third-party access page, choose Bakes & Brews Community Shelf, and remove access.
• Facebook: go to Settings, then Apps and websites, choose Bakes & Brews Community Shelf, and remove it.

Removing access stops future sign-ins through that account, but it doesn’t delete what we already hold. To delete that too, ask us as described above.

Your choices and rights

• See your information: most of it is in your profile. You can also ask us for a copy.
• Correct it: edit your profile at any time, or ask us to fix anything else.
• Delete it: see Delete your data.
• Choose what’s public: your Instagram handle shows only if you choose, and you can change your photo, display name, area and about you.
• Choose your emails: change your notification choices in your profile. We still send emails you need, like your pickup code.

To make a request, contact us. We won’t treat you differently for asking.

California privacy notice

We’re a California business, and this notice is for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

• What we collect: identifiers (like your name, email address and phone number), records of holds, orders, sales and payouts, the photos and text you post, and website usage information. The sections above explain each one.
• Where it comes from: from you, from Google or Facebook when you sign in, from Stripe when you pay, and from your browser when you visit the website.
• Why: the purposes listed in How we use your information.
• Selling and sharing: we don’t sell your personal information and we don’t share it for cross-context behavioural advertising. We haven’t done so in the past 12 months.
• Sensitive information: we don’t collect government ID numbers, account passwords, card numbers or precise location, and we don’t use any information to infer things about you.

You have the right to know what we collect, to get a copy, to correct it and to delete it, and not to be treated differently for using these rights. You can ask yourself, or have someone you authorise ask for you. We’ll confirm the request comes from you before acting on it.

Children

Our website and the Community Shelf are not meant for children under 13, and people under 13 shouldn’t use the app. We don’t knowingly collect personal information from children under 13. If you think a child has given us information, contact us and we’ll delete it.

Keeping it safe

We protect your information with HTTPS encryption in transit, database rules that limit who can see what, and access by role, so only café staff who run the shelf can see private contact details. Payment card details are handled by Stripe and never reach us. No system is perfectly secure, but we work to keep your information safe and will tell you if something goes wrong that affects you, as the law requires.

Changes to this policy

If we change how we handle your information, we’ll update this page and the effective date at the top. If a change is significant, we’ll also let signed-in users know in the app or by email before it takes effect.

Contact us

Questions, requests or worries about your privacy? We’re happy to help.