Cookie Cart — From Scratch App Privacy Policy

Effective date: May 29, 2026 · Last updated: May 29, 2026 · Applies to: From Scratch app (iOS & Android) and app.cookiecart.org

1. About This Policy

This Privacy Policy describes how Cookie Cart collects, uses, and protects personal information when you use From Scratch (“the App”), the Cookie Cart mobile application available on the Apple App Store and Google Play Store.

This policy applies specifically to the App and its associated web platform at app.cookiecart.org. It is separate from the privacy policy that governs the Cookie Cart public website at cookiecart.org.

Restricted access: Access to the App is restricted to individuals who are enrolled in the Cookie Cart program. You must log in with credentials provided at enrollment to use any features of the App.

Please read this policy carefully. By using the App, you agree to the practices described here.

2. Who We Are

Cookie Cart is a nonprofit organization based in Minneapolis, Minnesota. Our mission is to serve youth in our community through workforce development and life skills training. Throughout this policy, “Cookie Cart,” “we,” “us,” and “our” refer to Cookie Cart.

The App is operated by Cookie Cart and powered by technology including BuddyBoss (community and app platform), LearnDash (learning management system), and supporting services described in Section 14.

3. Information We Collect

We collect only the information necessary to operate the program and the App. The information we hold about you was provided at the time of your enrollment in the Cookie Cart program.

Identity — First and last name, date of birth (collected at enrollment)
Contact — Email address, phone number, mailing address (collected at enrollment)
Household — Household information collected at enrollment
Account — Login credentials: username and encrypted password (created at account setup)
Learning activity — Course progress, lesson completion, quiz results, time spent in training modules (recorded automatically during app use)
Community activity — Posts, comments, and forum contributions you choose to make (recorded voluntarily during app use)
Technical data — IP address, device type, operating system, app version, session data (recorded automatically during app use)
Analytics data — Pages and features visited, time in app, interaction patterns via Google Analytics (recorded automatically during app use)

We do not collect payment information, Social Security numbers, government ID numbers, or biometric data through the App.

4. How We Use Your Information

We use the information we collect only for the following purposes:

To authenticate your identity and provide secure access to the App
To deliver training content and track your progress through program modules
To identify participants who may need additional support and to improve training content
To enable community features such as discussion forums and program posts
To communicate with you about your participation in the program
To understand how the App is being used and to improve its functionality
To meet our obligations as a nonprofit program operator, including reporting program outcomes to funders in aggregate form

Our commitment: We do not use your information for advertising, marketing to third parties, or any commercial purpose. We do not sell your personal data. Ever.

5. Learning Progress and Training Data

The App uses LearnDash, a learning management system, to deliver training content and track your progress. This includes recording which lessons and modules you have completed, your quiz results, and time spent on training activities.

This learning data is used by Cookie Cart staff to:

Monitor your overall progress through the program
Identify areas where you or other participants may benefit from additional support
Improve the quality and effectiveness of training content over time

Your learning data is never shared with third parties in a form that identifies you individually. Aggregate, anonymized data about program outcomes may be shared with funders and sponsors as described in Section 9.

6. Community Features

The App includes optional community features powered by BuddyBoss, such as discussion forums and activity posts. Participation in these features is entirely voluntary and is not required to complete the program.

If you choose to post in community areas, please be aware that your posts may be visible to other enrolled program participants. We encourage thoughtful and respectful participation.

Profile privacy: Your personal profile information — including your name, contact details, and household information — is not displayed publicly in the BuddyBoss community. Other participants cannot view your personal data through the App.

Community posts are moderated by Cookie Cart staff. We reserve the right to remove content that is inappropriate or violates program guidelines.

7. Analytics and Cookies

We use Google Analytics to help us understand how the App and its web platform are being used — for example, which features are most frequently accessed and how users navigate through training content. This helps us improve the App experience for all participants.

Google Analytics collects data such as session duration, pages visited, and general device information. This data is associated with an anonymized identifier, not your name or other personal information.

Like most web-based platforms, the App’s web components may use cookies — small data files stored on your device — to maintain your login session, remember your preferences, and support core functionality. Session cookies are deleted when you close the App. Persistent cookies support features like staying logged in.

For more information on how Google handles analytics data, see Google’s privacy policy at policies.google.com/privacy.

8. How We Share Information

We are committed to protecting your privacy. We do not sell, rent, or trade your personal information to any third party.

We share information only in the following limited circumstances:

Technology service providers. We share data with vendors who help us operate the App, including BuddyBoss (app platform), LearnDash (LMS), and Google Analytics. These providers are contractually required to use your data only to provide services to us and may not use it for their own purposes.
Legal requirements. We may disclose information if required to do so by law, court order, or government authority.
Safety. We may share information if we believe it is necessary to protect the safety of a participant or others.

In all other cases, your personal information stays within Cookie Cart.

9. Sponsors and Program Funders

Cookie Cart is supported by sponsors and donors who contribute to the program. Some of these organizations wish to understand the impact of their support.

We may share high-level, aggregate program analytics with sponsors and funders — for example, total number of participants, overall course completion rates, or program outcome statistics.

Aggregate data only: We never share data on individual participants with sponsors or funders. All reporting to external organizations is anonymous and aggregated in a way that cannot be used to identify any individual.

10. Data Retention

We retain your personal information for as long as you are enrolled in the Cookie Cart program and for a reasonable period afterward to meet our administrative and legal obligations.

If you would like to request deletion of your account and associated personal data, please contact us using the information in Section 16. We will fulfill deletion requests subject to any legal retention requirements.

11. Your Rights and Choices

You have the right to:

Access the personal information we hold about you
Correct inaccurate or outdated information
Request deletion of your personal data, subject to legal obligations
Opt out of non-essential communications from Cookie Cart
Withdraw from community features at any time without affecting your training access

To exercise any of these rights, contact our Privacy Compliance Officer using the information in Section 16. We will respond to your request within 30 days.

12. Security

We take the security of your information seriously. The App and its underlying platform use industry-standard security measures, including:

HTTPS encryption for all data transmitted between the App and our servers
Password hashing and secure credential storage
Restricted access — only authorized Cookie Cart staff can access participant data
Wordfence security monitoring on the web platform
Redis object caching and LiteSpeed web server protections
Activity logging to detect unauthorized access

No system is completely secure. If you have reason to believe that your account has been compromised, please contact us immediately.

13. Teen User Protections

From Scratch is designed for high school students, and the majority of our users are teenagers (ages 14–18). We take additional care to protect the privacy of young users.

Specifically:

We do not display participant profiles publicly or to other users
We do not use teen participant data for advertising or marketing
We do not share identifiable data about individual participants with sponsors, funders, or any external party
Community participation is optional and not required to complete the program
Cookie Cart staff moderate community spaces to maintain a safe environment

The App is not intended for children under the age of 13. If we become aware that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information promptly.

If you are a parent or guardian and have concerns about your teen’s use of the App, please contact us using the information in Section 16.

14. Third-Party Services

The App relies on the following third-party services to function. Each has its own privacy policy governing how it handles data:

BuddyBoss — App platform, community features, and mobile app infrastructure. Privacy policy →
LearnDash — Learning management system for course delivery and progress tracking. Privacy policy →
Google Analytics — App and web usage analytics. Privacy policy →
WP Mail SMTP — Transactional email delivery for account and program notifications.

Once you follow a link from the App to an external website or service, this Privacy Policy no longer applies. We encourage you to review the privacy policies of any external sites you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the App, our practices, or applicable law. When we make material changes, we will update the “Last updated” date at the top of this policy and, where appropriate, notify participants through the App or by email.

We encourage you to review this policy periodically. Your continued use of the App after any changes constitutes your acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact our Privacy Compliance Officer:

Organization	Cookie Cart
Role	Privacy Compliance Officer
Email	info@cookiecart.org
Address	1119 West Broadway Ave, Minneapolis, MN 55411
Phone	612-588-0855