Privacy Policy.
A short, honest description of what we collect, who handles it, and how to make us forget it. Last updated .
Who we are
Belvedere Cookies is a sole-proprietor bakery operated by Hasret in Brentwood, Los Angeles, California. The "we" / "us" / "our" in this policy means Belvedere Cookies. This policy covers belvederecookies.com, the email letters we send, and the few service providers listed below.
What we collect and why
| What | When | Why |
|---|---|---|
| Email address | You subscribe to the newsletter | To send The Bakery Journal on Friday mornings |
| Name, email, subject, message | You write through the contact form | To read your note and reply |
| IP address, browser, referrer | You load any page | Anonymous traffic analytics + bot protection |
| Device fingerprint (Turnstile) | You submit a form | Spam and bot prevention only |
We do not collect: location data beyond the country your IP belongs to, payment-card details, biometrics, government IDs, health data, or any of the "sensitive personal information" categories under California law.
Service providers we use
We are a small operation. To run the website and email we rely on a few service providers; each acts as a "processor" of your information on our behalf, under their own published privacy commitments.
| Service | What it does | What it sees |
|---|---|---|
| Cloudflare Pages (hosting) | Serves the website from Cloudflare's global network. | IP address, browser type, requested page, timestamp. |
| Cloudflare Web Analytics | Anonymous, cookieless aggregate traffic counts. | Country, browser, page view, referrer, performance metrics. |
| Cloudflare Turnstile (captcha) | Spam/bot filter on the contact form. | IP, browser signals, a short-lived bot-score cookie. |
| Cloudflare Email Routing | Forwards mail sent to [email protected] to Hasret's inbox. | The contents of incoming email and standard mail headers. |
| Resend (via Amazon SES) | Sends the newsletter and contact-form replies, and stores the subscriber list. | Email address, mail open/click events, basic delivery telemetry. |
| Google Fonts | Loads typefaces. | Your IP address when the font CSS is requested. |
All of the above are headquartered in the United States. Where data is processed in other regions, the providers apply Standard Contractual Clauses or equivalent protections.
Cookies and similar technologies
This site does not use marketing, advertising, or analytics cookies. The only client-side storage in use is:
| Cookie / item | Set by | Purpose | Duration |
|---|---|---|---|
__cf_bm | Cloudflare | Distinguish humans from bots (anti-abuse). | 30 minutes |
cf_clearance | Cloudflare | Set only after passing a security challenge. | Up to 30 days |
| Turnstile in-page tokens | Cloudflare Turnstile | Single-use captcha proof for one form submission. | Cleared on submit |
These are strictly necessary cookies under California / EU consent frameworks. They keep the site secure and functioning and require no consent banner. We set no other cookies.
Honor of Global Privacy Control
Our site treats the Global Privacy Control signal as a valid opt-out of sale or sharing under California law. We do not sell or share personal information in the first place, but if you send the GPC header we will respect it.
How long we keep things
- Newsletter subscribers: until you unsubscribe. Unsubscribed addresses are retained for a short period to honor the opt-out, then deleted.
- Contact-form messages: up to 24 months in Hasret's inbox, then deleted.
- Server logs (IP, request): short-rolling retention at Cloudflare per their data-handling policy (typically less than 7 days for raw logs; anonymized analytics longer).
Your rights
Regardless of where you live, you can write to [email protected] and ask us to:
- Tell you what information we hold about you.
- Correct anything that is wrong.
- Delete your information.
- Send you a copy of your data in a portable format.
- Stop using your information for anything you have not asked for.
We respond within 30 days. Requests are free and we will not discriminate against you for making one.
For California residents (CCPA / CPRA)
Under California law you have the rights listed above plus:
- The right to know which categories of personal information we have collected, the sources, the purposes, and any third parties we shared them with (we summarise this in the tables above).
- The right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising, monetary value, or otherwise.
- The right to limit the use of sensitive personal information. We do not knowingly collect sensitive personal information.
- The right to non-discrimination for exercising any privacy right.
- The right to designate an authorized agent to act on your behalf. Send a written authorization signed by you (a phone photo is fine).
To verify a request we may ask you to confirm an email address that matches the one we hold. We do not use the request itself for any purpose other than handling it.
Children
The site is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has subscribed, email us and we will remove the address right away.
Security
The site is served over HTTPS only. Newsletter subscriber data is stored encrypted at Resend and Pages secrets are encrypted at rest at Cloudflare. We use double opt-in for the newsletter so a stranger cannot sign you up without access to your inbox. We do not store payment information ourselves.
International visitors
Our servers, processors, and Hasret are all in the United States. If you visit from outside the US, your information will be transferred to and processed in the US under standard contractual protections.
Changes
If we change anything material we will update the "last updated" date and, where appropriate, mention it in the next newsletter. Continued use means you accept the latest version.
Contact
Questions, requests, complaints. Write to [email protected]. Hasret reads everything.