Last updated October 24, 2026
This policy covers TartUp, the app for ordering custom cakes and pastries, TartUp Vendor, the app bakers use to sell on TartUp, and this website. It says what personal information we collect, how we use it, who we share it with, how long we keep it, and how you can get a copy of it or have it deleted.
TartUp is run by EigenSpace Developers, LLC ("TartUp", "we" or "us"). Questions go to carlosdelamora@tartup.net.
You sign in with Apple. Apple gives us an identifier that is unique to your Apple Account and TartUp, and the apps ask Apple for your name and email address. You can choose not to share your name, and you can hide your email, in which case Apple gives us a private relay address that forwards to you. For customers we keep the identifier, name and email. For bakers we keep only the identifier; the business details we hold are the ones you type in (see below). Every account also gets an internal TartUp ID, and the apps keep a sign-in token in your device's keychain so you stay signed in.
Customers and bakers can chat about an order. Chat is provided by Stream, which stores the messages, photos and voice messages you send on our behalf. Stream also gets your TartUp ID and the name the other person sees: a customer's first name, or a baker's business name and logo.
If you allow notifications, we store your device's push notification token and use it to tell you about orders, refunds, new preorder drops and messages. The token is also registered with Stream for chat notifications. You can turn notifications off at any time in iOS Settings.
The apps only use the photos you choose and the camera or microphone when you use a feature that needs them: photos you share in chat or attach to an order, voice messages in chat, scanning a payment card in the TartUp app, and scanning a product into a 3D model in TartUp Vendor.
To find and fix crashes and slow screens, the apps send diagnostic data to Measure, our crash-reporting provider: crash reports, performance measurements, the screens you visit and the outlines of what you tap, and records of the network requests the app makes (each request's web address, status and timing). It is linked to your TartUp ID when you are signed in. Those web addresses can include the location you are searching from (see Location and addresses). Measure keeps this data for 30 days.
Our server also keeps logs and traces of the requests it handles, with our hosting provider Fly.io and our monitoring provider Grafana Cloud. They can include your TartUp ID and the details of your requests, including the ones that sign you in. They are deleted automatically within 30 days.
To show bakers near you, the app sends the map position (latitude and longitude) of the address you choose along with each search. You can type an address, or tap Use My Current Location. The app only asks for location permission when you tap that, only while you are using the app, and uses Apple's address lookup to turn your position into a street address. Our server doesn't store the positions you search from, though they can appear in the diagnostics described above.
When you are signed in, the addresses you save (street, city, state, ZIP code and map position) are stored with your account so you can use them again.
We keep a record of each order: what you ordered, the options you picked and anything you wrote for the baker (such as the message on a cake), prices, tax and fees, pickup or delivery, the delivery address, the pickup or delivery time, the order's status and history, any photo the baker takes when they deliver it, and any problem you report, with its notes and photos, and how it was resolved.
Payments are handled by Stripe. Your card or Apple Pay details are entered in Stripe's payment form and go directly to Stripe; TartUp never sees or stores them. To take a payment we create a customer record at Stripe with your first name and TartUp ID, and to work out sales tax Stripe receives the delivery or pickup address. We keep Stripe's references to your payments and refunds, with their amounts and status.
The baker you order from sees your order and everything you wrote in it, your first name in chat, and, for delivery, your delivery address.
We collect the business details you enter: business name, contact name, description, contact email, phone number and logo, and your kitchen type with its cottage food registration or permit number and issuer. We use your kitchen details to review your shop and to show customers the food labels and notices the law requires. When you certify that you meet the marketplace's rules, or declare how your kitchen works, we keep a record of what you declared and when, including later changes. Customers see your business name, description and logo; your contact details and permit numbers are visible only to you and to TartUp.
Each location you add (street address, map position and time zone) is shown to customers who browse nearby, so they can find you and pick up their orders. If you bake from home, this is your home address.
We store the products you list, with their photos, descriptions, ingredients, allergen information and options, and any 3D model you capture. Photos and 3D models are stored and served by Bunny.net, our file-hosting provider, at web addresses that are public but hard to guess. Two features use OpenAI: as you write a listing, its text and photo are sent to suggest tags for it, and when you choose Tart Up This Photo, the photo is sent to produce an enhanced version.
Payouts go through Stripe Connect. We create your Stripe account with your contact email, and Stripe collects your identity and bank details itself, on its own pages. We only receive your account's status and what Stripe still needs from you.
We keep the same order records described for customers above, and share each order's details with you so you can make and hand it over.
This website is hosted by GitHub Pages, which receives your IP address so it can send you the page. The site uses no cookies and no analytics, and it treats every visitor the same whether or not their browser sends a Do Not Track signal.
When you open a shared TartUp link on a device without the app, the page tells our server which link you opened. The server stores that link with a one-way hash of your IP address, so the TartUp app can open the same link the first time you launch it after installing. The record can only be matched for 2 hours, and is deleted after about a day. The app can also open a link you copied: it reads what you copied only when you tap Paste.
We don't sell your personal information, share it for advertising, or use it to track you across other companies' apps and websites.
Depending on where you live, you may have further rights over your information. We answer these requests wherever you live, and we won't treat you differently for making one.
We limit who can access personal information and keep payment details out of our systems entirely. No way of storing or sending information is perfectly secure, but we work to protect yours and will tell you if a breach affects it. TartUp's servers are in the United States, and some providers may process information in other countries.
TartUp isn't directed to children under 13, and we don't knowingly collect their personal information. If you think a child has given us information, email us and we'll delete it.
When we change this policy we'll update the date at the top of this page. If a change affects how we use information we already have, we'll tell you in the apps before it takes effect.
EigenSpace Developers, LLC
carlosdelamora@tartup.net