Privacy Policy

Last updated: May 7, 2026

This Privacy Policy describes how Bake Notes ("we", "us", or "our") collects, uses, and discloses your information when you use our website and service (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Account Information

When you create an account, we collect:

  • First name and last name
  • Email address
  • Password (stored as a salted SHA-512 hash; we never store your plaintext password)
  • Optional profile photo

Baking Content

As you use the Service, you may provide:

  • Baking session notes and observations
  • Photos of your bakes
  • Audio recordings and their transcriptions
  • Recipe details, ingredients, and ratings
  • Chat conversations with the AI assistant

Preferences and Settings

You may optionally provide:

  • Timezone and measurement system preference
  • Baking skill level and frequency
  • Baking interests and goals
  • Dietary preferences
  • AI summary tone and voice preferences
  • Notification preferences

Automatically Collected Information

We may automatically collect:

  • IP address and browser user agent (during registration)
  • Session data necessary for authentication
  • Product usage data (including pages visited, button clicks and form interactions, route changes, browser and device characteristics, approximate location derived from IP address, and timing) collected via our analytics provider (see "Third-Party Services" below) so we can understand how the Service is used and improve it
  • Session recordings of your interactions with the Service, used for debugging issues and improving usability. Password fields and form inputs are masked before transmission, and we exclude additional sensitive UI areas from recording on a per-element basis

How We Use Your Information

We use your information for the following purposes:

  • Providing the Service: To operate the core features including bake documentation, chat conversations, and data organization.
  • AI-Powered Analysis: To generate bake summaries, analyze photos, transcribe audio recordings, extract ingredients and techniques, and provide personalized baking insights. This involves sending your content to third-party AI services (see "Third-Party Services" below).
  • Account Management: To manage your registration, authentication, and account settings.
  • Communications: To send you account-related emails including welcome messages, password reset codes, bake completion notifications, and other account notifications.
  • Personal Baking Analytics: To provide you with insights into your own bakes (trends, ratings, habits). This processing happens within Bake Notes and uses only your account data.
  • Product Analytics and Session Replay: To understand how the Service is used in aggregate, identify usability issues, and improve features. This involves a third-party analytics provider (see "Third-Party Services" below) and includes session recordings.
  • Error Monitoring: To identify and fix technical issues that affect your experience.

Third-Party Services

We use the following third-party services to operate Bake Notes. Your data is shared with these services only as necessary to provide the functionality described:

OpenAI

We use OpenAI's API to power our AI features. When you use the chat assistant, submit a bake for analysis, upload a photo, or record audio, the relevant content (conversation messages, bake details, photo URLs, or audio files) is sent to OpenAI for processing. OpenAI's use of this data is governed by their API data usage policy. Per OpenAI's API policy, data sent through their API is not used to train their models.

Amazon Web Services (AWS S3)

Photos you upload are stored on Amazon S3 cloud storage. If you choose to share a bake publicly, the associated photos become accessible via their S3 URL.

Sentry

We use Sentry for error tracking and application monitoring. When an error occurs, technical details (such as the error message and stack trace) may be sent to Sentry along with limited, sanitized user context (user ID and email). Sensitive information such as passwords and API keys are automatically redacted before transmission.

PostHog

We use PostHog for product analytics and session replay. PostHog receives event data describing how you interact with the Service (pages visited, features used, button clicks, and similar product metrics), along with identifiers needed to associate that activity with your account (your user ID, email address, and name). PostHog also records replays of your sessions so we can debug issues and improve usability; password fields and form inputs are masked before transmission, and we exclude additional sensitive UI areas from recording. Data is processed on PostHog's US-hosted infrastructure and is governed by their privacy policy.

Cloudflare Turnstile

We use Cloudflare Turnstile during login and registration to protect against automated abuse. This service may collect your IP address and browser information to verify you are a real user. Cloudflare's use of this data is governed by their privacy policy.

Publicly Shared Content

Bake Notes includes a feature that lets you share individual bakes publicly via a short link. When you enable sharing for a bake, the following information becomes accessible to anyone with the link: bake name, description, dates, ratings, AI-generated summary (including ingredients and steps), and associated photos. Sharing is entirely opt-in and can be disabled at any time, which immediately removes public access.

Cookies and Local Storage

Bake Notes uses cookies and browser local storage for two purposes:

  • Authentication: A session cookie keeps you signed in between visits. This is required for the Service to function.
  • Analytics: Our analytics provider (PostHog) uses a combination of cookies and local storage to maintain a stable identifier for your device, so events can be grouped into sessions. You can clear this at any time by clearing your browser's site data for Bake Notes.

Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide the Service. You can delete individual bakes, photos, and conversations at any time through the Service, and all associated data (including files stored on S3) will be permanently removed.

If you wish to delete your entire account and all associated data, please contact us at the email address below and we will process your request promptly.

Security

We take the security of your data seriously. Passwords are stored using salted SHA-512 hashing. Authentication uses JSON Web Tokens (JWT) with configurable expiration. API keys and secrets are stored as environment variables, never in application code. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

Children's Privacy

Bake Notes is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, you can reach us through our contact form.