Skip to content
The forest keeps its promises ✿ 21+ only, always
BAKED ELFCart

Privacy

What we collect, why we collect it, and what happens to it.

This policy explains what personal information Baked Elf collects through bakedelf.com (the “Site”), why we collect it, who else handles it, and the choices you have. “We”, “us” and “our” mean Baked Elf. The Site is for adults 21 and over.

Checkout happens on Shopify, and our Shopify storefront at shop.bakedelf.com is set up separately from the Site and runs some tools the Site does not. The section “Checkout and our Shopify store” covers those.

The short version

Your account

Sign-in is run by Clerk. To create an account you give Clerk an email address and a password, or you sign in with Google, in which case Google shares your name, email address and profile picture with Clerk. Clerk's sign-up form also offers first- and last-name fields; they are optional. Clerk runs a Cloudflare Turnstile check at sign-up to keep bots out.

In our own database we keep your email address, your Clerk account ID, a handle we assign automatically (like elf-1a2b3c4d), the trail name you choose, your date of birth once you give it, and your settings, such as notification and Stoney preferences. We don't copy your first or last name from Clerk.

The first time you open your account page we ask for your date of birth to confirm you are 21 or older. We check it on our server, store it with your account and never show it on your profile. Once it is confirmed, we don't ask the 21+ question again on a device where you are signed in. If the date shows you are under 21, we don't save it; your account isn't deleted automatically, though, so its email address and anything already saved to it stay on file until it is. Email privacy@bakedelf.com and we'll delete it.

We use your email address to sign you in, to send the notification emails you haven't turned off, to subscribe you to the Forest Dispatch if you turn it on, and to match Shopify orders to your account so they earn points.

What you post

Recipes you publish and Grove stories, threads and replies appear on the Site as soon as you post them. Venue reviews and “I Baked This” bake reports become public once a moderator approves them. Public posts show your trail name, recipe authors get a public chef page at an address made from their handle, and search engines can index all of it. Recipe pages also name the author in the structured data they give search engines, and the data behind each recipe, Grove post and reply also includes your handle and an internal account number that is the same on all your posts.

Recipes, Grove posts and replies, and reviews keep the trail name they were published under, so changing your trail name later doesn't rename them. Bake reports always show your current trail name, and a recipe's “Baked by” credit keeps the name you had when your bake report was approved. Recipe drafts you save in the Kitchen are visible only to you. Your votes, your saved recipes and any dose you set for yourself on a recipe are private; only vote totals are public.

A bake report can include the changes you made, the appliance you used, your comments and a photo. If your report is the first one approved for a recipe, its photo can become that recipe's main picture, credited “Baked by” your trail name.

Photos you upload

Photos for bake reports, Grove posts, venue listings and the UV print customizer are stored with Cloudflare R2 and served from images.bakedelf.com. Grove, venue and print-customizer photos upload as soon as you choose them, even if you never send the form; a bake-report photo uploads when you send the report, even if the report is then turned away. From then on, anyone who has the photo's web address can open it.

We store each photo exactly as you uploaded it. If your phone or camera saved your location or device details inside the file, those details stay in it, so turn off location tagging or remove it before uploading if you don't want to share it. Removing a post or report from the Site doesn't delete its photo file. To have a photo file deleted, email privacy@bakedelf.com with the photo's web address if you have it. Photos you chose but didn't post, and print-customizer artwork, aren't linked to your account, so we can only find them from their address. A deleted photo can still be served from our image cache for a few hours.

The recipe generator and other AI features

The Kitchen's recipe generator sends the photo you choose to Google's Gemini service, which describes the dish, then sends that description and anything you typed to Anthropic's Claude, which drafts the recipe. The photo goes to Google as you took it, including any location data inside it. We don't store the photo or the draft on our servers: the draft waits in your browser until you open it in the recipe form.

When a recipe is published without a photo, we may send its title, category, ingredients and some of its steps (never the author's name) to Anthropic and Google to make a picture for it, which the Site labels as an illustration.

Stoney, our AI concierge

Stoney's replies are written by Anthropic's Claude models. Each time you send Stoney a message, we send Anthropic your message, the earlier messages in the conversation (yours and Stoney's), which page you're on and details of the recipe, venue or product it shows, today's date, and whether you're signed in. If you're signed in, we also send the preference notes Stoney keeps for you. Under Anthropic's commercial terms, Anthropic does not use this data to train its models.

If you're not signed in, we don't store your chat: it lives only in your open browser tab and is gone when you reload the page. To keep Stoney's daily message limits fair, we store a scrambled code made from your IP address (never the address itself) with a count of the day's messages, and delete it after about three days. For members, the count is kept against your account instead.

If you're signed in, your chats are saved to your account unless you turn saving off, so Stoney can pick up where you left off on any device; only your most recent 200 messages are kept. Stoney may also save short notes about preferences you mention, such as a dietary need, a cooking style, products you like, the area you usually look in, or the dose per serving you're comfortable with. Stoney is instructed not to save notes about health conditions, medications, pregnancy or anyone under 21, and each note is checked for them, but that check can miss things, and a dietary need such as an allergy can itself be health information. A saved chat keeps what you typed, exactly as you typed it, until you clear it.

Once you've confirmed your date of birth, your account page lets you turn saving off, edit or delete any note, delete your chat history, or delete everything Stoney holds about you. Until then, you can clear the current chat from the Stoney panel, or email privacy@bakedelf.com to delete anything else. Turning saving off stops new chats from being saved but doesn't delete what is already saved, and Stoney keeps using your notes until you delete them. Stoney is educational, not medical.

The Guide

Venue listings come from public state licensing records: business names (for some licences, the licence holder's own name), addresses, phone numbers, websites and licence details. Listings are refreshed every week from those records, so a correction has to be made with the state regulator to stay on the Site. You can still email privacy@bakedelf.com about a listing that names you.

If you suggest a venue, our moderators see what you sent along with your handle. If you claim a venue, our moderators also see the role and business email you give us. Once a claim is approved, the description, hours, menu link and photos you add are public on the listing, which shows that the venue has been claimed. The page doesn't name you, but the listing's public data includes the same internal account number as any recipes or Grove posts you publish, so the two can be connected.

The Guide map is drawn by Mapbox. Your browser loads the map directly from Mapbox, which receives your IP address and the area you're looking at, and Mapbox's map software stores an anonymous device ID in your browser to report map usage to Mapbox. If you press the button that finds your location, your browser asks your permission first, and your location is used only to move the map; it isn't sent to us.

Shopping, checkout and rewards points

Your cart is kept in your browser, not on our servers. When you check out, we send Shopify the items in your cart and, if you're signed in, your account ID so the order can earn points. Checkout runs on Shopify: Shopify collects your name, email address, shipping and billing addresses, payment details and any phone number the checkout asks for. We never see or store your card details.

We use the order details in our Shopify store to make, ship and support your order. Our products are made to order by print-on-demand partners, which receive your name, shipping address and the items you ordered, and they hand your order to a shipping carrier.

When an order is placed, cancelled or refunded, Shopify also sends the Site that order's details, including the buyer's name, addresses and what was bought. The Site uses only the order's ID and number, the email address on it, its total and the account ID added at checkout, and doesn't store the rest. If the order matches your account, by account ID or by email address, we add the points to your rewards ledger, or take them back for a cancellation or refund. If an order doesn't match an account, we keep its order ID and number, the email address on it and its total for a planned way to claim those points; that isn't available yet.

Your rewards ledger records each time you earn or lose points (for example an order, a refund, an approved bake report or an approved review) and is visible only to you, as are the patches you earn.

Checkout and our Shopify store

Our Shopify storefront at shop.bakedelf.com is configured in Shopify rather than on the Site, and it runs tools the Site doesn't: Shopify's own analytics, Google Analytics and Google Tag Manager, Klaviyo's website script, a Tidio live-chat window (which receives anything you type into it), Sumo, scripts from other Shopify apps, and advertising pixels added by Shopify apps, which receive what you view and buy and can receive your contact details. Shopify classifies two of those pixels as ones whose use of your data some US state privacy laws treat as selling or sharing personal information. These companies may collect information about your activity on our store over time and across other websites. Some of these tools may also run on Shopify's checkout pages.

The store also has its own email sign-up forms, and it sets Shopify's cookies, for example for your currency, your cart, analytics and marketing. Shopify describes how it handles your information at https://www.shopify.com/legal/privacy.

Email

The Forest Dispatch is our one marketing email, and you only get it if you ask for it. You can sign up with the form on our home or shop page, or by turning it on in your notification settings; either way, your email address goes to Klaviyo, the service that sends the Dispatch. To stop it, use the unsubscribe link in any Dispatch email. If you turned it on in your notification settings, you can also turn it off there; signing up with the form doesn't change your notification settings.

Notification emails, such as a bake report or review being approved, are sent through Resend. Some kinds, including approvals, are on until you turn them off; you choose which kinds you get in your notification settings, and each one carries a one-click unsubscribe link. Emails that verify your address or help you sign in come from Clerk. We don't send text messages and the Site never asks for your phone number.

Information collected automatically

The Site is hosted on Vercel and its database runs on Convex. Like any website, they receive your IP address, your browser details and the pages you request, and keep technical logs for periods those services set. Vercel's firewall also uses your IP address to limit how many requests can reach some features in a short time. Cloudflare runs our domain name service and our image hosting.

Pages also load product photos from Shopify, recipe illustrations from Convex, uploaded photos from images.bakedelf.com and the sign-in software from Clerk, and some venue pages load a photo directly from the venue's own website, so those services and sites receive your IP address and browser details too. Apart from the Guide map's usage reporting to Mapbox, the Site doesn't use analytics, advertising or tracking tools, and it doesn't change what it does when your browser sends a Do Not Track signal.

Cookies and browser storage

The Site uses a small number of cookies and browser storage entries:

You can clear all of these in your browser settings. If you do, you'll be signed out and asked the 21+ question again.

Who can see your information

The Site doesn't sell your personal information. For our Shopify store, see “Checkout and our Shopify store”.

How long we keep it

We keep your account information and what you post until you or we delete it. A few things expire on their own: the 21+ cookie at the end of your browsing session, Stoney's message counters after about three days, and saved Stoney chats beyond your most recent 200 messages. Your rewards ledger keeps every entry for as long as your account exists, and records of orders that didn't match an account are kept until you ask us to delete them. Shopify keeps its own order records.

Your choices

There isn't a delete-account button on the Site yet. To ask us to delete your account, or posts, reviews, bake reports or photos you can't delete yourself, email privacy@bakedelf.com from the address on your account. Shopify keeps its own order records.

You can also email us to ask what personal information we hold about you, or to correct it.

If you are a European resident, you have the right to access the personal information we hold about you and to ask that it be corrected, updated or deleted; email privacy@bakedelf.com to do so. We process your information to fulfil contracts we have with you (for example your account or an order), on your consent for the Forest Dispatch, which you can withdraw at any time, or otherwise to pursue our legitimate business interests described above. Your information is transferred outside Europe, including to the United States and Canada.

Under 21

The Site is for adults 21 and over and isn't meant to collect personal information from anyone younger. If you believe someone under 21 has given us personal information, email privacy@bakedelf.com so we can delete it.

Security

The Site is served only over encrypted connections (HTTPS), and payment details are handled by Shopify, never by us. No way of sending or storing information is completely secure, so we can't guarantee it.

Where your information is processed

We are based in the United States. Our service providers process information in the United States and in other countries where they operate.

Changes

We'll update this page, and its “Last updated” date, when what we collect or how we use it changes.

Contact us

For questions about your privacy, to make a request or to make a complaint, email privacy@bakedelf.com or write to us at:

Baked Elf

Attn: Privacy

2140 Hall Johnson Rd, Ste 102-290

Grapevine, TX 76051

Last updated: October 11, 2026.