Stephy Sourdough Bakehouse

The problem

Stephy bakes sourdough from her home kitchen in the FishHawk area of Tampa: three ingredients, no sugar, and loaves people recognise by the patterns scored into the crust. The business had grown entirely through neighbours, friends, and WhatsApp referrals. Every order was a chat thread, every "is Saturday full?" was a question she answered by hand, and there was no storefront for browsing the menu and placing an order.

The design needed to feel specific to Stephy and her bread. Because many customers live in Spanish-speaking and bilingual households, we built English and Spanish into every part of the experience from the start.

The approach

We started from a single sentence in the brief: a website should make you feel something before you read anything. The storefront opens on a full-bleed loaf, the menu uses circular photo crops that echo her wax-seal badge, and every string on the site exists in both languages from day one, down to the error messages. The site uses HTML, CSS, and vanilla JavaScript, without a framework or build step. We tested loading performance on mobile.

The ordering flow follows how the home bakery already works. Customers do not need an account or card processor. They choose a pickup date, pay by Venmo, Zelle, or cash on pickup, and get a private order page they can return to without a password. Capacity is a real constraint when one person bakes everything, so the system enforces a maximum number of orders per weekday, closed dates, and a minimum lead time, and it tells the customer the moment a date fills up.

The build

The whole platform runs as one Cloudflare Worker at the edge, with D1 for products and orders, R2 for photos she can swap herself, and KV for presentation settings. Two installable apps share it: the public storefront, and a Spanish-only admin panel built for her phone.

• Bilingual storefront: EN / ES toggle that reaches every string, product, notification, and error message
• Live capacity limits: the capacity check runs inside the database insert itself, so two customers can't both take the last slot
• Pickup scheduling: per-weekday limits, closed dates, lead times, and per-date notes such as "only 3 spots left"
• Auto order expiry: unpaid orders release their slot after a set window, on a 15-minute cron sweep
• Push notifications: hand-rolled Web Push with VAPID and payload encryption, no third-party service; customers opt in per order, the baker gets a morning digest
• Passwordless everywhere: customers are remembered by a signed cookie; the admin signs in with Face ID via passkeys
• Menu & content admin: bilingual products, options and add-ons, drag-to-frame photos, per-date calendar overrides, and sales charts
• Server-side price integrity: every line item is recomputed from the database; the browser's totals are never trusted

The order engine and admin panel went from first commit to live on the custom domain in about nine days, with a plain-Spanish changelog inside the panel so she could follow what changed each morning.

Delivery and handoff

Everything ships in her name: the domain, the Cloudflare account, and the email routing at her own address. The client can change prices and photos without depending on us. A security pass added a strict content security policy, HSTS, rate limiting, and constant-time credential checks before launch, and the client received a Spanish walkthrough deck rather than a manual.

Because the ordering engine sits behind a single feature flag, the bakehouse can run as a catalog-plus-WhatsApp site on quiet weeks and switch full online ordering on when the calendar demands it, without a redeploy.

The outcome

The bakery now has a public storefront and an ordering system in English and Spanish. Customers can browse the menu, choose a pickup date, use the bakery's existing payment methods, and receive order updates from a phone. The hero image alone dropped from 947 KB to 366 KB in the performance pass, and the site runs on free tiers. Ongoing changes can be made through the admin app.