Privacy Policy

1. Who controls your data

CrumblyOS is operated by Sleepy Cow Media. For your owner account, we are the data controller. For your customers’ order data, you are the controller and we process it on your behalf as part of running your storefront.

2. What we collect

From bakery owners

• Account details: name, email address, and authentication identifiers.
• Store details: bakery name, description, logo, products, prices, and images.
• Billing status: subscription state and a Stripe customer reference. We never receive or store your full card number.
• Basic technical data: IP address, browser/device type, and error logs.

From your customers

• Order details: items, quantities, pickup date/time, and any order notes.
• Contact details needed to fulfil the order: name, email, and phone number.
• Payment confirmation only — a payment reference and status. Card details go directly to Stripe and never reach our servers.

Customers do not need an account or an app to order. We do not build advertising profiles of them.

3. Why we use it

• To run your storefront and deliver orders to you.
• To process subscription billing and customer payments.
• To send you order and account notifications.
• To keep the service secure and debug problems.
• To meet legal and tax obligations.

We do not sell personal data, and we do not share it with advertisers.

4. Who we share it with

We use a small number of processors, each for a specific job:

• Supabase — database, file storage, and authentication infrastructure.
• Clerk — owner sign-in and identity.
• Stripe — subscription billing and customer payments.
• Vercel — hosting and content delivery.
• Cloudflare — DNS, security, and backup storage.

We may also disclose data if legally required, or as part of a business transfer — in which case this policy continues to apply until you are told otherwise.

5. How long we keep it

• Account and store data: while your account is open.
• Order records: retained while your account is open so you have your sales history, and afterwards only as long as tax and accounting rules require.
• Logs: a short rolling window for security and debugging.

When you delete your account we remove your store and its content. Some records may persist briefly in encrypted backups before they age out.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to certain processing, and to complain to a data protection regulator.

You can delete your account from the app. For anything else, email support@crumblyos.com and we’ll respond within 30 days.

If you are a customer of a bakery using CrumblyOS and want your order data removed, contact that bakery directly — they control it. If you can’t reach them, we can help.

7. Security

Data is encrypted in transit. Access to production data is restricted, tenant data is isolated at the database level, and payment card details never touch our infrastructure. No system is perfectly secure, but we take this seriously and will notify you promptly of a breach affecting your data.

8. Children

CrumblyOS is not intended for children. We do not knowingly collect data from anyone under 13, and will delete it if we learn we have.

9. Changes

We’ll update this page when our practices change and revise the “last updated” date. Material changes will be announced in the app or by email.

10. Contact

Privacy questions: support@crumblyos.com.