Privacy
What this shop collects, who receives it, and how to reach us.
Cozy Loaf is a cottage bake stand in Buffalo, Minnesota. Grafted Software builds this website and the order system for Cozy Loaf.
Questions about an order or about the site go to orders@cozyloaf.co. That reaches Cozy Loaf and Grafted Software.
We do not publish a street address on this site.
A preorder asks for your name and email. Phone is optional. We also keep the pickup day and window you chose, and the items and quantities in the order.
A special request asks for your name, a message, and an email or a phone number so we can answer.
There is no account. We do not sell this information.
While you build a preorder, this site stores three cookies: preorder_cart (product and quantity), preorder_contact (name, email, and phone if you added one), and preorder_pickup (the day you picked).
They last one day so you can go back and edit. They are not advertising cookies. We clear them when card checkout starts.
The review step and the special request form use Cloudflare Turnstile to check that a person sent the form. Your browser talks to Cloudflare for that check.
We send Cloudflare the check result and the IP address of the submission. We use that IP to limit repeated tries. We do not save it on your order.
The site is hosted on Cloudflare. Cloudflare sees the IP address of a visit in order to serve the page.
Card and wallet payment happens on Stripe checkout. We send Stripe your email and the order total so they can charge that order once. We do not store your card number.
We keep the Stripe checkout id, whether the order is paid, the amount, any tip, and the payment method Stripe reports. That checkout is a single charge for the order.
Order email is sent by Resend. Messages come from Cozy Loaf <orders@cozyloaf.co> to the email you gave us: the recap after you pay, and a note if an order is canceled or refunded.
We also email the baker when a paid order or a special request comes in. That note includes the contact details you submitted.
These are messages about your order. This shop does not run a mailing list.
Checkout cookies expire after one day, or sooner when checkout starts.
We keep the order (name, email, phone if you gave one, pickup, items, and the payment record) for as long as we need it to bake, hand off, refund, and keep ordinary bakery books. We do not set a fixed deletion date.
A special request stays until we have answered it and no longer need the note. Stripe and Resend keep what they need to process the payment and the email, under their own rules.
This shop is for neighbors placing their own orders. It is not directed at children under 13, and we do not knowingly collect information from them.
Email orders@cozyloaf.co for a privacy question. That is the contact for Cozy Loaf and for Grafted Software.
Updated October 7, 2026