Privacy notice
What this site collects, and what it doesn't.
Short version: this site measures how it gets used so it can be made better. It asks first where the law expects that. Nothing here is sold or rented; the only third-party measurement is named below.
Last updated 1 September 2026
Google Analytics and Microsoft Clarity.
This site uses two third-party tools. Google Analytics 4 reports traffic and audience. Microsoft Clarity produces heatmaps and session replay, which show where people get stuck. Both can set cookies, and both send data to their providers.
Where you are decides how they behave. In the European Economic Area and the United Kingdom, neither vendor is contacted until you accept the banner. In California and Switzerland they are on by default, with a standing control in the footer. Everywhere else they are on by default and can be turned off from the same control.
A Global Privacy Control signal turns both off before either vendor is contacted, even if this browser accepted earlier. Google runs in basic consent mode, so it sends nothing before a required opt-in. Clarity starts separately only after measurement is allowed, and it does not run on the audit request page.
A coarse location check, kept and stored nowhere.
To resolve the measurement rule, this site asks its own server which country your connection appears to come from, plus your state if you are in the United States. The server returns only allow, decline, or ask. Raw location is not returned to the page, written down, or logged here.
If that check fails, no banner appears and neither analytics vendor starts. The choice to fail that way is deliberate. It costs a little measurement rather than risking a request to a vendor before the rule is known.
A record of your answer.
When you accept or decline, that answer is stored in a first-party cookie for about twelve months. It holds one word, is marked HttpOnly so page scripts cannot read it, and is the record of your decision rather than a tracker.
What you type is sent here and kept.
When you send an audit request, the form goes to this site and is stored so the work can be done. You get an email asking you to confirm it. What you typed is used to answer you and to run the audit you asked for.
It is not sold, not rented, and not passed to anyone outside that work. If you would rather not use the form, email instead.
Your message, used to reply to you.
If you write to aloha@getbakery.dev, that message is kept so it can be answered and so the work can be done. It is used for that and nothing else. No list rental, no reselling, no marketing to an address that only asked a question.
Change your mind whenever you like.
Accept and Decline are the same size and carry the same weight, and this site behaves identically either way. Nothing is withheld from anyone who declines.
Browser controls work too. A Global Privacy Control signal takes priority over an earlier answer. Blocking cookies or analytics requests also stops these tools.
Ask, and it gets answered.
For anything about this notice, including a request to see or delete what is held, write to aloha@getbakery.dev.