We only get personal details when you hand them to us: your email when you spin the prize wheel, an email (and a phone number, if you add one) when you sign up for our offers, or your name and contact details on the catering, contact and job application forms. We use them to reply and to send what you asked for, and spinning the wheel also puts you on our mailing list. We never sell them. Ordering happens on our ordering partners' sites under their own policies.
What we collect
- Offers and updates. Your email address, and your phone number if you add it, when you sign up with the Square form on our sign-up page ("Stay in the dough" in the footer).
- Prize wheel. Your email address when you spin, and a record of the spin: when it was, which prize you won, its gift card number, and whether the prize email went out. See The prize wheel.
- Catering requests. Name, phone, email, the date and type of event, guest count, and anything you write in the notes.
- Contact and feedback. Name, email, which shop, the date of your visit if you give it, and your message.
- Job applications. Name, email, phone, the shops, roles, hours and days you're interested in, whether you're 18 or older and allowed to work in the US, your most recent job, a résumé link if you add one, and anything you tell us about yourself.
- Site usage. Basic statistics about which pages are visited and from what kind of device, so we know what's working. See Cookies and analytics.
We don't ask for payment details, dates of birth or anything else on this site. Ordering for pickup and delivery happens on Orders2.me and the delivery apps linked from each shop; what you enter there is covered by their privacy policies, not this one.
What we do with it
- Reply to your catering request or message. Feedback may be shared with the team at the shop you name.
- Consider your job application. It may be shared with the managers of the shops you pick.
- Send the offers and updates you signed up for. Every email has an unsubscribe link, and you can reply STOP to any text.
- Run the prize wheel: hold each email address to one spin, send your prize, help if it goes missing, and add you to our mailing list, as the wheel says next to the Spin button.
- Understand, in aggregate, how the site is used so we can improve it.
We don't sell personal information, and we don't use it for advertising to you elsewhere.
Who else sees it
Only the services that make the site run, and only what they need:
- Form handling: Web3Forms delivers catering, contact and job application submissions to our inboxes and stores a copy for the retention period below.
- Offers and updates: Square runs the sign-up form, stores what you enter in it and sends the emails and texts, under its own privacy policy.
- Prize wheel: Google records the spins and sends the prize emails, Square holds the gift cards and our customer list, and Cloudflare checks that spins come from people, not bots. See The prize wheel.
- Hosting: Vercel, our web host, serves the pages, and Cloudflare serves the shop-tour and story videos. As with any website, they see your IP address and browser details in order to deliver them.
- Analytics: Google Analytics 4 counts visits and which pages are read. See Cookies and analytics.
We'd also share information if the law required it. That's the whole list.
The prize wheel
When you spin our first-birthday prize wheel, this is what happens to your details:
- What we keep: your email address, when you spun, which prize you won, the number of its gift card, and whether the prize email went out. That's how we hold each address to one spin and help if a prize goes missing.
- Google runs the wheel behind the scenes: your spin goes to a small Google Apps Script program, which records it in a Google spreadsheet only our team can open and sends your prize email through Google's email service.
- Square runs our gift cards and our mailing list. We add your email address to our customer list there with a note of the prize you won, and link your gift card to it so the shops can look it up. Our news and offers come from there too.
- Cloudflare Turnstile checks that a spin comes from a person, not a bot. To decide, it looks at technical details of your browser and connection, under Cloudflare's own privacy policy.
- Our mailing list: spinning signs you up, as the wheel says next to the Spin button. Every email has an unsubscribe link, and unsubscribing never cancels a prize.
- How long: we delete the spin records from the spreadsheet one year after the wheel closes. You stay on the mailing list until you unsubscribe, and your customer profile stays in Square until you ask us to delete it.
The wheel's official rules cover the rest.
Cookies and analytics
This site uses Google Analytics 4, which sets two first-party cookies, _ga and _ga_HWKD56PS2Q, to tell one visit from the next. They hold a random ID, not your name or email, and last up to two years from your last visit. If your browser sends a Global Privacy Control signal, Google Analytics isn't loaded at all and neither cookie is set.
The sign-up form on our sign-up page is loaded from Square, which uses Google reCAPTCHA to keep out bots. Both may set their own cookies there, under their own policies.
Your browser may also keep a few small notes on your own device so the site remembers them: the shop you last picked in the order bar, whether you turned motion off on the accessibility page, and, until you close the tab, that you've already seen the opening animation on the home page. None of them is sent to us.
How long we keep it
- Catering and contact messages, and job applications: as long as we need to handle your request or application and follow up, and no longer than three years.
- Offers and updates: until you unsubscribe.
- Prize wheel spins: one year after the wheel closes. See The prize wheel.
- Usage statistics: we only look at totals. Google Analytics keeps the visit-level data for two months, then deletes it.
Your choices
- Unsubscribe with the link in any email or by replying STOP to a text, or ask us and we'll do it.
- Ask what we hold about you, ask us to correct it, or ask us to delete it. We'll do it within 30 days.
- Use the site without any forms at all; nothing is collected just from reading it beyond the usage statistics above, and not even those if your browser sends Global Privacy Control.
Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the GDPR. Ask, and we'll honour them.
Questions
Send us a message through the contact form. If we change this page in a way that matters, we'll update the date below and, for newsletter subscribers, say so in the next email.
Last updated October 26, 2026.