Privacy at Baked Design Studio

The short version

This site has no ads. Our public pages load Google Tag Manager, which runs Google measurement tags that can set cookies, and Leadfeeder, which tells us which companies visit (more below). Visit counts also come from cookieless Cloudflare Web Analytics and our own cookieless counts. Beyond that, we only get what you choose to send us, plus the minimum needed to keep the site safe. Questions or deletion requests: hi@baked.design.

Last updated: October 2026.

Who we are

baked.design is run by Baked Design Studio, based in Vancouver, BC, Canada. We are responsible for the information described here.

What you send us

• Project requests and contact messages: if you use the request form, the contact form or the Design check form, we receive what you type (such as your name, company, email and message, and for a Design check your link, next goal, company size and whether you plan to invest in design this year). It is delivered to the studio's private Slack and emailed to hi@baked.design through Resend, an email delivery service, so we can reply.
• The Skate to Demo Day game on the YC page: when you finish a run, we keep its result (arrival time, wipeouts and which ride you were on) to show how many people played and how they rank. If you choose to put your name on the leaderboard, we also keep the name and YC batch you type and show them publicly. Nothing else about you is attached. Ask and we will remove a name.
• Getting started (Request details or Book a call): we receive your name, email, business, your launch date if you give one, any links you add, and which of the two you picked. It goes to the studio's private Slack and to hi@baked.design through Resend. If you pick Request details, Resend also sends one short note from us to the email you gave; it contains nothing you typed. Book a call then opens our calendar (Cal.com) with your name, email and business already filled in, so you don't type them twice; the same happens if you request details and then choose to book a call.
• Questions to the site assistant (Ask Baked): your questions are sent to Anthropic's Claude API to write the answer. We do not keep chat transcripts.
• On some client brand pages (behind their password), what you type in "What do you want to make?" is sent to Anthropic's Claude API to pick the brand's templates and write their words. We do not keep what you typed or what comes back; the pictures are drawn on your device. To catch problems, we count only what kind went wrong (like words cut off or an error), by day, for 90 days, with nothing you typed.
• Booking a call happens on Cal.com, and payments happen on Stripe's hosted checkout. Those services handle the details you enter there under their own privacy policies; we receive the booking or payment confirmation.
• Emails you send to hi@baked.design are kept in our Google Workspace mailbox.

What the site collects on its own

• To stop abuse of the forms and the AI features, we count requests per visitor using a one-way hash of the IP address and the date. Raw IP addresses are never stored, and the counters expire within a day.
• To keep spam out, each form also sends how many seconds you spent filling it in, and we check the message for signs of spam (such as links to unknown file-sharing sites). This check happens as the message arrives; nothing from it is stored, and a message that looks like spam is not delivered.
• The site is hosted on Cloudflare, which processes requests to deliver pages, stream videos and protect against attacks.
• We count visits with Cloudflare Web Analytics, which does not use cookies or store your IP address. It tells us which pages people read, not who they are.
• Our public pages load Google Tag Manager, which runs the Google measurement tags we set up in it. Those tags can set cookies on your device and send Google your IP address, device and browser details, and the pages you visit, under Google's privacy policy. Password-protected client pages and unlisted pages don't load it.
• Our public pages also load Leadfeeder (by Dealfront), which looks up the company behind the network a visit comes from (a business's office network, say) and shows us that company's name and the pages it read. It can set a cookie on your device to recognise a return visit, under Dealfront's privacy policy. It is meant to name companies, not people, and visits from home or mobile networks usually show no company at all. Password-protected client pages and unlisted pages don't load it.
• We also count a few moments on our own pages: which page you opened, the site you came from (its name only, like x.com), how far down the home page you got, and when you press Book a call, Request more info, a pricing button, the deck or our email. The studio's own devices are left out of these counts. After Book a call we also note whether the calendar showed, how long it stayed open, which steps the calendar reports (like the times showing) and whether a call was booked; nothing you type in it. Each visit gets a random number that lives in that browser tab only and is gone when you close it, so we can see steps in order (opened a case study, then booked a call) without knowing who you are. We keep the day, the event, the page, phone or desktop, the country Cloudflare sees and the time zone your browser reports (like America/Vancouver, which puts the visit on our map); no cookies, no IP address, nothing you type. These counts are kept for 90 days. We also count AI crawlers and assistants (like ChatGPT or Claude) that read our pages, by the name they give themselves, the page and the day; that says nothing about people. When you book a call, the booking also notes which of our pages and buttons it came from (for example "home · end") and that tab's random number, nothing about you.
• Those counts stay anonymous unless you get in touch. When you send us a message or your details, or book a call, we look up what that same browser tab did on our site (the pages it opened and the buttons it pressed, as above) and add it to the email the studio gets, so we know what you've already seen. We also keep your name and company with that visit for 90 days, so we can see what leads people to us; what you wrote stays in the email only. Cal.com tells our site when a call is booked or cancelled (your name, email, the time and any notes) so we can send ourselves that email. Once your call is confirmed, Resend also sends you one short note from us, with your first name and nothing else you typed.
• If you follow @nickbakeddesign on X, once a day we read the public profiles of new followers through the X API (name, handle, bio, location, link and follower count) and have Claude, from Anthropic, suggest who might want to work with us, so the studio can say hi. We keep the X id, handle, name and Claude's short note for each profile we've looked at, so nobody is looked at twice and the studio can see who it has said hi to; nothing is posted anywhere public, and any message comes from Nick himself.
• Fonts are served from baked.design itself, so no font service sees your visit.
• One private client tool (a newsletter builder behind a password) sets a single sign-in cookie for that page only. Its link preview reads the public page you paste to fill in a card, and its import sends the newsletter text you give it to Anthropic's API to sort into blocks; neither keeps anything. When the team sends an issue, it goes out through the client's own Resend account, to their own list. When the team publishes an issue, it becomes a public page on the client's own website (with the client's own analytics), until they take it down. So the team can see who changed what, each save keeps the name the editor picked (a made-up one by default), their kind of device and browser, and the rough city Cloudflare sees; no IP address is kept, and only the last 12 changes per issue.
• Some client previews and client brand guidelines are behind a password. Entering the right one sets a single cookie that keeps that page open on your device for 30 days. It holds no personal information and is not used for tracking.
• One client preview can run on the client's real waitlist. The client's waitlist tool (GetWaitlist) keeps sign-ups and sends their emails. Because that tool can't move people by different amounts, we keep one small table for that preview: each person's email, their waitlist ID and invite code, their spot in line, and the packs they've opened and what they were. Packs are rolled on our server. Nothing else about you is stored there, and the table can be handed to the client or deleted at any time.
• Your browser (local storage) remembers a few things on your device only: that you unlocked the YC discount or saw the game, the name you last used on the game's leaderboard, and which display mode you switched on (blueprint, time machine or proofreader), the background you were making on a client's brand page, with any you saved to use there, and that you closed the Design check bar. The client welcome page reads the name in its link and only shows it on your screen. None of these are sent to us.

How long we keep it

Project requests and emails are kept while we talk with you and, for clients, for as long as we work together and as required for accounting. Abuse counters expire within a day. Game results and leaderboard names are kept while the game is on the site. Ask and we will delete what we hold about you.

Your choices and rights

You can ask to see, correct or delete the personal information we hold about you by emailing hi@baked.design. We reply within 30 days. We handle personal information in line with Canada's PIPEDA and give the same rights to visitors from other places, including the EU and UK.

We do not sell personal information or share it for advertising.

Changes

If this changes, we update this page and the date above.