Privacy Policy

1. Information We Collect

When you reserve a box, join the waitlist, or create an account, we collect your name, email address, phone number, delivery address, and an account password (stored only as a secure hash, never in plain text). If you sign in with Google, we receive your name, email address, and profile photo from Google instead.

We also collect any produce exclusions you set and any allergies you tell us about, so we can tailor your box. This is information you choose to share with us; see Section 7 of our Terms for how we handle it.

We do not collect or store your card number, its expiration date, or its security code ourselves. That information goes directly to our payment processor, Stripe, described below.

2. Payment Information

Payments are processed by Stripe, Inc. Card details are entered directly into Stripe’s own secure payment form and sent straight to Stripe — they never pass through or touch our servers. Stripe shares back with us only what we need to run your account: a customer reference id, the last four digits of your card for your own reference, and whether a charge succeeded. Stripe’s handling of your payment details is governed by Stripe’s own privacy policy.

3. How We Use Your Information

We use the information above to:

• Confirm you’re in our delivery area and route deliveries once the program launches;
• Create and secure your account portal login;
• Process your cooler deposit and, later, your subscription billing;
• Email you about your reservation, waitlist status, or account (confirmations, delivery updates, launch timing);
• Tailor the contents of your box to any exclusions or allergies you’ve told us about;
• Respond to messages you send us through the Contact page.

We do not sell your personal information, and we do not use it for advertising or share it with third parties for their own marketing purposes.

4. Who We Share It With

We share information only with the service providers that help us run Sunday Harvest: Stripe (payments), Google (if you choose Google sign-in), Resend (sending account and order emails), and our hosting and database providers (Vercel and Neon), who process data on our behalf to keep the site and your account running. We may also disclose information if required by law.

5. Data Retention

We keep your account and delivery information for as long as your account is active, and for a reasonable period afterward in case you return. You can ask us to delete your account and personal information at any time by contacting us (Section 7); we’ll do so except where we’re required to keep certain records (for example, payment records) for tax or legal reasons.

6. Your Choices

You can review and update your contact and delivery information at any time from your account portal. You can request a copy of your data, ask us to correct it, or ask us to delete your account by contacting us below.

7. Data Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS) and securely hashed passwords. No method of transmission or storage is perfectly secure, but we work to protect your information and respond quickly if something goes wrong.

8. Children’s Privacy

Sunday Harvest is not directed to children, and we don’t knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we’ll delete it.

9. California Residents

If you’re a California resident, you may have additional rights under the CCPA, including the right to know what personal information we hold about you, and to request its deletion. We don’t sell personal information. You can exercise these rights by contacting us below.

10. Contact

Questions about this policy, or requests about your data, can be sent to hello@sundayharvest.co (placeholder, update with your real support email).