Cake Builder privacy notice
Effective: 21 October 2026. Cake Builder (com.soance.cakebuilder) is provided by Soance Innovations LLP. This notice covers the Android and iOS apps and the cake studio at cakebuilder.soance.com. The notices for Quotation Builder, FitKadam and My BNI on this page apply to those separate products.
For Cake Builder support or privacy requests, email [email protected] or visit Cake Builder support.
All-ages design and adult account features
Anyone can browse the public cake menu and design a cake without an account. Accounts, order requests and creating or changing public links are for adults aged 18 or over. A neutral age check offers under 18, 18 or over, and prefer not to answer. Selecting under 18 or declining keeps those account features unavailable; browsing and local design remain available. We do not request a birth date, identity document or a child's account details.
The age eligibility choice is kept on the device. An adult confirmation is sent when adult features are enabled, and the website uses an eligibility cookie. We do not keep a date of birth or age-history record in the account database. Cloudflare Turnstile is loaded only after adult eligibility has been confirmed. Ordinary hosting and security processing still applies to requests for public pages and menu data.
Information we process and why
Registering provides your name and email address; your password is stored as a secure hash. We use account identifiers and sign-in records to authenticate you, manage your requests and recover your account.
An order request contains the customer name, phone number, preferred pickup date and time, cake specifications, both cake-message lines when filled, customer notes and an optional generated cake preview. Saved requests also contain price estimates, administrator quotes, status, timestamps and private preparation notes. Cake Builder's authorised administrators use these details to review and respond to the request and arrange fulfilment. A cake preview is generated from your design, not a photo taken from your camera or photo library.
We use technical request details, security checks and operational logs to deliver the service, investigate failures and limit abuse. If you contact support, we receive your message, contact details and any attachments you choose to send, and use them to respond. Please do not send passwords or unnecessary personal information.
Public cake and order links
Sharing is optional and requires acceptance of the Cake Builder community guidelines. We store the accepted guidelines version and acceptance time. A public cake link exposes the cake design; a public order link exposes cake specifications, estimates, status, any quote and creation/update information. Visibility controls let you choose whether the available name, cake message, customer notes and pickup/delivery schedule fields appear. The phone-number field and private preparation notes are excluded from public order responses. Avoid putting private contact information into messages or notes you choose to publish.
Hiding a field changes public visibility; it does not remove the complete design, order or private preview stored for your account and the administrators. Hiding a cake message suppresses both message lines. Uploaded preview images are not served publicly; public pages use the structured cake design and trusted menu thumbnails.
Anyone with a public link can view or forward it, and can customise a copy of the design. Messaging and social services may fetch and cache public link previews, including text you chose to publish. You can change visibility, revoke an order link, or delete its order. Cake links have no automatic expiry; account deletion removes your cake and order links. Changes cannot recall copies independently saved by other people or services.
Reporting and blocking
Public text is checked for objectionable language. You can report a shared cake or order without signing in. A report contains its link reference, selected reason, optional details and submission time; security controls may use a hashed network identifier to limit abuse. Do not include unnecessary personal information in a report. Authorised administrators review reports and can remove content or disable an account's public sharing.
Public links contain a random creator key for the block feature, not the creator's email address or internal account identifier. Blocking keeps that creator's content hidden on the current device/browser. The blocked-key list is stored locally, is not account-synced and can be reset by clearing the relevant app or browser data.
Device storage, sessions and permissions
The native app stores favourites, saved design names and details, cake messages, timestamps, preview PNGs and preferences in app-private device storage. These local designs are not account-synced unless you submit or share them. Sign-in tokens and cached account identity are kept in protected device storage. The website and embedded studio also use browser storage for a cake draft and cookies for sign-in and adult eligibility.
Local drafts can remain after signing out. In-app account deletion clears the native favourites and saved-design collection on that device, but does not erase the studio's browser draft or copies on other devices. Remove saved designs in the app, and clear the relevant browser or app website data to remove remaining local drafts. Uninstalling the app alone does not delete your server account.
Server sign-in tokens are stored as hashes. Sessions expire after 30 days; one-use native-app-to-studio sign-in tickets expire after 60 seconds. Session expiry is not a promise that every historical security record is immediately erased. Requests use HTTPS. The release has no advertising or analytics SDK and does not request camera, microphone, contacts or precise-location permission. We do not sell your personal information.
Service providers
Cloudflare hosts the service, database, private preview storage and fonts, and processes network/device information, including IP address, browser/device details and country inferred from network requests, for delivery, abuse prevention and operational logging. We store hashed rate-limit identifiers for security. Adult account and order actions use Cloudflare Turnstile; Cloudflare may also use its security signals to improve its bot-detection service under its own privacy practices. When you request password recovery, Resend receives your account email address and a message containing a short-lived reset link for transactional email delivery, not your account password.
Fonts are packaged with the app or served by Cake Builder's own website; the studio does not request them from Google Fonts. Providers may process information outside your country. External email, browser, app-store and sharing services you choose operate under their own privacy practices.
Retention, deletion and your choices
Account information, orders and shared cake records remain in the active service until removed. You can delete individual orders in My orders; deleting an order also removes its active public order link and attached preview. You may request deletion of specific information without deleting your whole account by emailing the privacy contact below.
For account deletion, use Account → Delete account in the app or the Cake Builder account deletion page. After password confirmation, deletion removes your active account, sign-in sessions, reset tokens, owned order/share records, their attached previews and public links. Deletion is permanent. Security identifiers, operational logs, backups and independently retained copies are separate from those active account records; this notice does not promise immediate erasure of every historical copy.
You can request access, correction or deletion of information you have supplied to us by emailing [email protected]. Identify Cake Builder and the email used for your account; do not email your password. We may need to verify that the request is yours. Contact us if you believe a child has supplied personal information through an adult feature, so we can investigate and remove it as appropriate.
Physical orders and notice updates
Cake Builder sends requests for physical cakes. No payment or card details are taken in the app. An authorised Cake Builder administrator must confirm availability, the final design, price and pickup arrangements. Account or order deletion does not cancel arrangements already confirmed outside the service; contact Cake Builder support about those arrangements.
Only include information necessary for your cake request, including when a cake is for a child. We will update this notice and its effective date when Cake Builder's data practices change.