Privacy Policy

Last updated: August 27, 2026

Cottage is made by Divinital. Questions about anything here go to cottage.support@protonmail.com, and a person reads that address.

This policy is written to be read, not skimmed past. It describes exactly what Cottage does today. If we change what the app collects, we change this page in the same breath.

The short version

• We keep as little as we can: who you are, who you follow, and the bakes you ask for. If you bake, we also keep your bakery page, your recipes, your pickup spots, and the photos of your bakes. If you post a photograph of something you picked up, that picture is public on that kitchen's storefront.
• We ask for a mailing address only when you ask for a bake to be posted to you, it belongs to that one order, the baker can't see it unless she accepts, and it's deleted if the order is cancelled.
• Your location never leaves your phone. Distances are worked out on the device.
• What you report comes to us and goes nowhere else — never to the baker, who is never even told they were reported. Blocking a bakery is only about your own board: nothing about it reaches them, and you can undo it.
• We never sell your information, we never share it for advertising, and there is no tracking or analytics in the app.
• We never see your money. Cottage takes no payment and holds no card or bank details.
• You can delete your account, and everything in it, from inside the app.

What we keep

Your account. Cottage signs you in with Apple. Apple gives us an identifier for you, and — only on the very first sign-in, and only if you allow it — an email address. We never receive your Apple password, and we never ask you to make one here.

The phone number you give a baker so she can reach you. It rides along on the request so she can find you if something about the handoff goes wrong, and it stays on that order afterwards — she reads it off her own queue days later, when the bake is ready.

We keep it on your account as well, in a row with your number in it and nothing else, so you set it once instead of typing it into every request. That row is yours alone: no baker can read it, and nothing in Cottage shows it to one. What a baker gets is the copy frozen onto the order *you placed with her* — which is why changing your number doesn't reach an order already placed. It reaches the next one. Closing your account deletes it.

A mailing address, on an order you asked to have posted — and on nothing else. Some bakers will put a jar of jam in the mail rather than have you drive over. If you switch that on when you ask, we take the name for the parcel, the street, the town, the state and the ZIP. This is the most personal thing Cottage holds, so it is worth being exact about what happens to it:

• It is attached to that one order, and to nothing else. Not to your account, not to a saved address book, not to your next order. If you ask for a second parcel, you type it again — because between the two we have not been holding your address for a person who wasn't buying anything.
• The baker cannot see it until she accepts. Not while she's deciding, not if she declines. She sees the *state* — because we only mail inside Florida and that's the part we have to check — and nothing else until she says yes. That rule is in our database, not in the app, so it holds no matter what any phone asks for.
• Nobody else can ever see it. Not another baker, not another neighbor, not a signed-out visitor. Only you and, after she accepts, the one baker posting your box.
• If the order is cancelled, the address is deleted. By you, by her, or by the app when nobody answered in time — however it ends, nothing was posted, so there is nothing left to post it to, and it goes.
• You cannot change it once you've sent it, and neither can she. If you mistyped it, cancel the request and ask again; she may already have written the label.

We never ask for an address on a pickup order, and there is nowhere in the app to give us one outside asking for a parcel.

The bakers you follow, so your list is waiting for you on any phone you sign in on.

Your orders — what you asked for, how many, the price, when you asked, and where it stands (requested, accepted, and then either ready and picked up, or posted and delivered — or cancelled). This is your record, and it's how the app can tell you what's happening without you calling anyone.

A photograph of what you picked up. After an order has actually arrived — handed over on a porch, or a parcel you opened — you can post one photograph of it, and it hangs on that kitchen's storefront. We keep the picture, which bake it was, and the month. There is no caption and no name on it. The public page does not say who took it. The maker can tell it was you because it came off your order, the same way she already has your name and number there. Treat it as a public picture: anyone with its web address can open it. Don't put anything in the frame you wouldn't hand to a stranger, and keep house numbers, mail, and other people out of the shot. You can take it down; the maker can take it off her wall without deleting it; closing your account takes it with you.

What you ask a baker to make. A storefront lets you ask that kitchen for something it hasn't posted — a cake for a birthday, next Saturday's loaf. We keep what you asked for (either the sentence you wrote or the bake of theirs you pointed at), the day you'd like it, how many, and which kitchen you asked. Two people can read it: you, and the kitchen you sent it to. Not another baker, not another neighbor, not a signed-out visitor.

An ask is a question, not an order — nothing is bought, nothing is held and no money is mentioned. If she says yes, it becomes an order, and the phone number kept on your account goes onto that order the way it would on any request you'd made yourself — she needs to be able to reach you about a bake she has now agreed to make, and you shouldn't have to type it again to be reached. She still can't read the row on your account; what she gets is the copy frozen onto that one order. While it's unanswered you can take the ask back from that kitchen's page, and it's gone. Once she answers it stays: if she said yes it has become an order, and if she said no it's the record of a question that was asked and settled, which is yours as much as hers. A no can carry one word of why — that she's full that day, that it's more than she can take on, or that it isn't something she makes — picked off a short list, so you know whether it's worth asking again. She can also say nothing, and plenty of nos arrive that way. There is nowhere for her to type anything else, and nothing about you is ever part of the answer. Either way it goes when you close your account — and if *she* closes hers, it goes then too.

One thing worth saying about the list you pick from: it is what that kitchen has already posted in public, and never her recipe book. Her book is hers, and nothing in Cottage shows it to a neighbor.

And a kitchen can stop being asked. If she has, her storefront says so where the button was, and there is nothing for us to keep because there is nothing you can send. It doesn't touch an ask you already made — she can still answer it, and you can still take it back.

And what you've asked for every week. You can tell a kitchen you'd like something on a regular day — one loaf, every Saturday. We keep the same handful of things an ask keeps: what you asked for (your sentence, or a bake of theirs you pointed at), which day of the week, how many, and which kitchen. The same two people can read it: you, and that kitchen. Nobody else.

It is not an order and nothing is held. Nothing comes off her board, nothing is bought, and no money is mentioned — it is a standing note of what you'd like, and an order only exists once she has actually baked and said yes to that week. Either of you can skip a single week without ending anything, and we keep that too: which week, and which of you struck it off. Either of you can end it altogether, and we keep when and which of you did — so the other one is told what happened rather than finding the loaf stopped coming. Ending it doesn't erase it: it stays as your record of an arrangement that ran, and as hers, and it is in no count from that moment. It goes when you close your account — and if *she* closes hers, it goes then too.

If she has stopped being asked, you can't start one, for the same reason you can't send her an ask. And a kitchen you've hidden is out of reach for this the same way it's out of reach for everything else.

Anything you report. If you report a bake, a bakery, or a photograph on a kitchen's wall, we keep which one it was, the reason you picked, and when. That's the whole row — there's nowhere to type anything else. We keep it because it's what we look at when we decide whether to take something down for everybody. Nobody else can read it — not the baker you reported, not another neighbor. A report can't be taken back.

And what a baker can report about you. An ask is the one place your own words land on somebody else's screen, so the kitchen you asked has the same way out of one that you have out of a bake. If she reports an ask, we keep which ask, the reason she picked, when, and a copy of what you wrote — because the thing being reported is the sentence itself, and you can take an ask back a second later. Nobody can read that row but us: not you, and not her either once she's tapped it. She is not told anything about you beyond what you already sent her, and you are not told it happened — you get the same no every turned-down ask gets, because a decline that read differently would be the report delivered by hand.

A photograph you posted on her wall is the other place. If she reports it, we keep which photograph, the reason, when, and the bake's name. It comes off her wall in the same tap. You are not told.

What you've hidden. Blocking a bakery, and reporting anything, puts it out of sight, and we keep that list so your board is the one you left when you open it on another phone. Each line is the bakery, the bake if it was one, the photograph if it was one, and when — nothing else. nothing else. Only you can read it, and blocking is only ever about your own board: the baker is never told, and nothing about it reaches them. This is the part you can take back, from Account → Hidden from your board. Putting something back doesn't withdraw a report — that stays with us.

If you bake, we also keep

Your bakery page — the name you sell under, your town, and the sentence or two you write about yourself. This is public: it's what neighbors see on the board.

Your recipe book — names, categories, prices, and the ingredient lists the Florida label requires. Only you can see it.

Your pickup spots — the name of each spot ("Front porch"), its town, and the directions or address that tell someone how to find it. The name and the town are public; they ride along on every bake you post so a neighbor knows roughly where to go before they ask. The directions are private. They are released only to a buyer whose request you have accepted, and only for that order. That rule lives in our database, not in the app, so it holds no matter what any phone asks for.

Unless you mark a spot public. A farmers market or a church lot is an address on a sign by the road, and holding it back only stops a neighbor from working out whether it's worth the drive. So each spot has a switch, off unless you turn it on, that puts its address on every bake you post from there — visible to anyone browsing, account or no account. Turn it off and the address comes straight back off, including on bakes already on the board. It is there for a market table, and never for your home.

How you've arranged your Bakes tab — which of your past bakes you've chosen to lead with, and which you've taken down. This is public, the same way the page it arranges is. Taking a bake down removes it from your storefront; it does not erase the post it came from, so treat it as tidying your shop window rather than as a way to un-say something.

Photos of your bakes. These are stored so anyone can load them — that's how a photo shows up on the board for a buyer who isn't signed in. Treat a bake photo as a public picture: anyone with its web address can open it. Don't put anything in the frame you wouldn't hand to a stranger, and keep house numbers, mail, and other people out of the shot.

Photographs neighbours took of what they picked up. These hang on your storefront, in a row at the foot of the page, and they are public the same way your own bake photos are. They carry no name. You can tell who took one because it came off an order of yours. You may set one aside, or close the wall; neither deletes anything, and a neighbour is never told. You can report one, which takes it off your wall in the same tap. The owner can hide one by hand.

Your storefront photo is stored the same way and is public for the same reason: it's the picture at the head of your bakery page, and a neighbor with no account has to be able to see it.

Your photos, the other way round. If you tap "Save QR code" on your storefront, your phone asks whether Cottage may *add* a picture to your photos. That is the only kind of access Cottage asks for: it can put your QR code in your camera roll and nothing else. It cannot open, read, or send the photos already there. When you pick a photo for a bake or your storefront, iOS hands Cottage the one picture you chose — the app never sees the rest of your library. Saying no leaves everything else working; you can still share your link or print a flyer.

Where your location goes: nowhere

If you tap "Use my location" on the Fresh Board, your phone asks iOS for a rough fix — accurate to about a kilometer, which is enough to know which town you're in and nothing more — and uses it to sort the board by how far away each baker is. That coordinate stays on your phone. It is never uploaded, never stored on our servers, and never shown to a baker. A baker sees a town, the same one you'd see on the board.

Cottage never asks for your location when you open the app, and never asks in the background. If you say no, the app keeps working — you pick a town from a list instead.

What stays on your phone only

• The town, distance, and sort you've picked for the board
• Any ingredients you've asked the board to hide
• Which reminders you've switched off

Reminders and heads-ups are made by your own phone, on a schedule it keeps itself. No server sends them, and nothing about them is reported back to us.

What we don't do

• We don't sell your information, and we never will.
• We don't share it with advertisers, data brokers, or anyone building a profile of you.
• There is no analytics, no tracking, no advertising code, and no third-party software in the app beyond the two named below.
• We don't handle payments. Cottage never sees a card number, a bank account, or what you paid — payment is between you and your baker, in cash or through whatever handle they give you, and their app handles that, not ours.
• We don't ship anything ourselves. A baker who mails a bake buys her own postage, packs her own box and hands it to her own carrier; Cottage sells no postage, quotes no rates and tracks no parcels. We ask for a mailing address only on an order you have asked to have posted — never on a pickup, and never as part of setting up an account. What happens to it is the section above.
• We have no messaging, so there are no messages for us to read.

Who else can see your information

The baker you order from sees what you asked for and the phone number you typed. Once they accept, you see their pickup directions — and on a parcel, they see your mailing address, which they could not see before. Nobody sees an address on an order nobody accepted. Neither side sees anything else about the other. A baker is never told who reported them, or that they were reported at all — if we act on a report we go to them ourselves. Nor is a baker ever told they were blocked. Their bakes simply stop showing up for you, and no request of yours reaches them.

Supabase, which runs the database, the sign-in, and the photo storage that Cottage sits on. They hold this information for us and may not use it for anything else.

Apple, which handles Sign in with Apple. Apple has its own privacy policy for that.

That's the whole list. We share nothing with anyone else, except where the law requires it of us.

How long we keep it

We keep what's above while your account is open. Bakes come off the board when they expire, and closed orders stay in your history so you can look back at what you bought or sold.

A mailing address is the exception in the other direction: it doesn't wait for your account to close. A cancelled order loses its address there and then, and a parcel that arrived keeps it — the two of you may still have to talk about a box that came back — until you close your account, when it goes with everything else of yours.

An ask you've sent lasts until it's answered or you take it back, and an answered one stays in both people's history until either of you closes an account.

A report is the exception, and it outlives what it was about: it stays if the post is deleted, it stays if the baker closes their account, and it stays if you put the thing back on your board. It goes when *you* close your account, because then it's your row leaving with you. A report a baker filed about an ask works the same way in both directions — the copy of what you wrote stays with her report even after you take the ask back or close your account, and the report goes when *she* closes hers. What you've hidden lasts exactly as long as you keep it hidden — putting something back deletes that line for good.

Deleting your account

Open Account and tap Delete my account. It happens right there, in one step, and it can't be undone.

What goes: your account, the phone number kept on it, the bakers you follow, anything you asked a kitchen to make, anything you reported, the list of what you'd hidden, every mailing address you ever gave for a parcel — those go even from orders that are finished and staying in the other person's history — and — if you bake — your bakery page, your recipe book, your pickup spots, how you'd arranged your Bakes tab, everything you have on the board, and every photo of your bakes. Anything still in flight is cancelled, and the person on the other side is told the order ended rather than left waiting.

What stays: an order has two people in it, and only one of them is leaving. The other person keeps their own record of a bake that already changed hands — with your name, phone number and mailing address removed from it. A report somebody else filed about you stays too — including a baker's report about something you asked her to make, which keeps its copy of what you wrote: it's their report, not yours, and closing an account is not a way to clear one.

If any part of that fails, none of it happens; you're told, and you can try again. We don't leave a half-erased person behind.

Children

Cottage isn't for children. Don't use it or create an account if you're under 13, and we don't knowingly keep information from anyone that age. If you believe a child has an account here, write to us at the address at the top and we'll delete it.

Where this applies

Cottage is offered in the United States, to people in Florida, and the information above is held in the United States.

Your choices

You can see everything Cottage holds about you inside the app itself — your orders, your follows, your bakery, your recipes, your spots. You can change any of it there, and you can delete all of it with Delete my account. If you'd rather have a copy sent to you, or want something corrected without deleting your account, write to cottage.support@protonmail.com and we'll take care of it.

Changes to this policy

If we change what the app collects or who can see it, we'll update this page and change the date at the top. If the change is a big one, we'll tell you in the app before it takes effect.