Privacy Policy

The Service is published by Easy Carb. Hicham Mahfoud is the founder and the primary contact for privacy questions and data-subject requests. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), Easy Carb is the data controller for personal data processed through the Service. You can reach us at any time at support@bakepup.com.

We designed BakePup to collect as little as possible. We do not require an account name, email address, or phone number to use the app. The information we process falls into these categories:

• Anonymous account identifiers. When you first open the app we generate an anonymous user ID (a UUID issued by Supabase Auth) so your scans, journal, and settings persist on your device. No email or phone number is attached to it.
• User-submitted photos. Photos you capture or choose for loaf/starter scans, and photos you add to your journal, starters, and bakes. Scan photos are uploaded to our private storage and sent to an AI provider for analysis (see Section 5). Your journal, starter, and bake photos are kept ONLY on your device and are never uploaded to our servers (see Section 8).
• Chat messages and journal content. The text of your messages to the Doughy assistant, journal notes, titles, and tags.
• Onboarding answers. Your self-reported baking experience, goals, baking frequency, and starter status, used to tailor guidance.
• Kitchen temperature. If you save a kitchen temperature, we store the confirmed value (in Celsius) and when you set it, to estimate fermentation timing. If you use location-based weather detection, your device sends your coordinates to our backend, which forwards them to Open-Meteo (a third-party weather service) to fetch the local temperature. We use your coordinates only in that moment to get the temperature and do not store them.
• Subscription & purchase data. An anonymized RevenueCat customer ID and whether you have an active subscription or free trial. Apple processes the actual payment; we never see your card or billing details.
• Analytics & usage data. Product events such as “scan completed” or “tool opened,” collected via PostHog. We do not capture your screen content or keystrokes.
• Diagnostics & crash data. Crash reports and unhandled errors via Sentry, scrubbed of personal data where possible, so we can fix problems.
• Launch waitlist email (website only). If you enter your email in the launch waitlist form on this website, we store that email and the date you signed up, so we can email you once when BakePup launches. This is optional, applies only to the website and not the app, and you can ask us to remove it at any time at support@bakepup.com.

• Apart from a launch-waitlist email you choose to give us on this website (see Section 2), we do not collect your name, email, phone number, postal address, payment card details, contacts, health or fitness data, precise stored location, browsing history, or search history.
• We do not use third-party advertising trackers, and we do not build advertising profiles about you.

We use the information above only to operate and improve BakePup:

• To provide the core features — showing your scans, journal entries, and chat history back to you, and powering the 21-day starter coach, recipes, and bake tracking.
• To analyze your photos and chat messages with AI. We send the photo or message you submit to a third-party AI provider so it can return feedback (see Section 5).
• To estimate fermentation timing using your confirmed kitchen temperature.
• To manage your subscription and unlock premium features, via RevenueCat and Apple.
• To diagnose crashes (Sentry) and understand which features are used (PostHog) so we can prioritize what to build and fix.
• To keep the Service secure — preventing abuse, enforcing rate limits, and protecting against fraud.

BakePup’s scan and chat features are powered by third-party AI providers. To analyze a photo or answer a chat message, the content you submit is transmitted over an encrypted (HTTPS/TLS) connection to one of the following providers, which process it on our behalf:

• Anthropic, PBC (the Claude / Anthropic API) — primary provider for image analysis and chat.
• Google LLC (the Gemini API) — used for AI analysis and as a fallback.

Which provider handles a given request depends on availability and our routing configuration, so any of the providers above may process a photo or message you submit.

Your explicit consent

We ask for your consent before any photo or message leaves your device for an AI provider, and we do not transmit your content to AI providers in the background or without your action:

• You grant the app camera and/or photo-library access through the standard iOS permission prompt.
• You affirmatively choose to submit each scan or chat message — nothing is sent automatically.
• This Policy and the app disclose that your submitted content is sent to the named AI providers for analysis before you do so.

By submitting a photo or message you consent to that transmission. You can withhold consent simply by not submitting content, and you can stop at any time.

How AI providers handle your content

Under our agreements with these providers, your content is used only to generate the response we request and is not used to train their models across customers. A provider may retain submitted content briefly for operational and abuse- monitoring purposes in accordance with its own policies. Each provider is contractually required to protect your information to a standard at least equivalent to this Policy. AI outputs are best-effort suggestions and are not professional baking, food-safety, or medical advice.

How we store and review your scan photos

Separately from the AI providers above, we store the scan photos you submit on our own servers (Supabase storage, EU region) in a private location that is not publicly accessible by URL. Our team may review uploaded scan photos to evaluate and improve our scanning accuracy (an app-functionality and product-improvement purpose). We automatically delete stored scan photos after 30 days. Your bake history and scores stay saved in your journal after the photo is removed, and you can remove a photo sooner by deleting your account in the app or by emailing us (see Section 8).

We do not sell your personal information. We share it only with the service providers below, each of which processes data on our behalf under a written agreement that requires them to safeguard your information to a standard at least equivalent to this Policy and to use it only for the purposes we specify:

• Anthropic and Google, for AI inference on scans and chat (see Section 5).
• Supabase — authentication, database, and photo storage (hosted in the EU, West Europe / Ireland).
• Vercel — hosting for our backend API and this website.
• Open-Meteo, a third-party weather service that receives your coordinates in the moment to return the local temperature for fermentation timing. It receives no other personal data, and we do not store the coordinates.
• RevenueCat — subscription management and entitlement checks (processes the anonymized purchase data described above).
• PostHog — product analytics (US region).
• Sentry — crash and error diagnostics.
• Apple — App Store payments, billing, and subscription management. Apple’s handling of your purchase is governed by Apple’s privacy policy.

We use Apple Search Ads to promote BakePup on the App Store. To understand which campaigns are effective, we use Apple’s AdServices framework to collect a privacy-preserving attribution token when you install BakePup after tapping one of our ads. This token allows us to measure, in aggregate, which campaigns lead to installs and subscriptions.

This attribution is processed on our behalf by our subscription provider, RevenueCat. It does not involve tracking you across other companies’ apps or websites, does not use the device advertising identifier (IDFA), and does not require any tracking permission. The data is used solely to measure the performance of our own advertising and improve how we reach new bakers.

• Scan photos are automatically deleted after 30 days. We keep them only this long so our team can review them to improve scan accuracy; your bake history and scores stay in your journal after the photo is removed.
• Your journal, starter, and bake photos are stored only on your device and are never uploaded to our servers. They remain until you delete them in the app; because they are kept on the device, they do not transfer to a new device and are lost if you reinstall the app. They are not analyzed by AI.
• Your other data (anonymous account, journal entries, scan scores, and chat messages) is retained for as long as you keep using BakePup.
• You can delete everything from inside the app. Go to Settings → Account & Data → “Delete account,” which permanently deletes your BakePup account and data on the device and on our servers and cannot be undone.
• You can also request deletion by emailing support@bakepup.com with your user ID (visible in Settings → Device ID). We may need to confirm your user ID before acting, because accounts are anonymous.
• We may retain aggregated, de-identified analytics that can no longer be linked to you, and limited records we must keep for legal, security, or accounting reasons.

Depending on where you live, you have rights over your personal data. We honor these rights regardless of where you are located. To exercise any of them, contact support@bakepup.com. We will not discriminate against you for exercising your rights.

• Access — ask what personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — delete your data (in-app or by email).
• Portability — receive a copy of your data in a portable format.
• Opt-out / object / restrict — object to or restrict certain processing.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the following applies.

Legal bases for processing

• Performance of a contract — to provide the features you request (running scans, chat, journal, subscriptions).
• Consent — for sending your photos and messages to AI providers, and for optional location-based weather detection. You may withdraw consent at any time without affecting prior processing.
• Legitimate interests — to keep the Service secure, prevent abuse, and understand product usage through privacy-respecting analytics, balanced against your rights.
• Legal obligation — where we must retain or disclose information to comply with the law.

Your rights as a data subject

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

International transfers

Some of our providers (for example, PostHog and certain AI providers) process data in the United States. Where we transfer personal data outside the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) to protect your data.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you specific rights. In the preceding 12 months we have collected the following categories of personal information:

• Identifiers — an anonymous user ID and an anonymized RevenueCat customer ID.
• Internet/usage activity — product analytics events and diagnostic/crash data.
• Visual information — the photos you submit for scans and journal entries.
• Other user content — your chat messages, journal notes, onboarding answers, and saved kitchen temperature.
• Commercial information — your subscription/trial status.

We collect this information from you directly and from your device, and use it for the business purposes described in Sections 4–6. We disclose it to the service providers in Section 6 to perform services for us.

We do not sell your personal information

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16. Some privacy laws define “sharing” broadly enough to include certain analytics cookies/SDKs; to the extent any analytics processing is treated as a “sale” or “share,” you may opt out as described below.

Do Not Sell or Share My Personal Information

Because we do not sell or share personal information for advertising, there is nothing to opt out of for that purpose. If you would still like to limit analytics processing or exercise any other right, email support@bakepup.com with the subject “California Privacy Request.”

Your CCPA/CPRA rights

• The right to know and access the personal information we collect.
• The right to delete your personal information.
• The right to correct inaccurate personal information.
• The right to opt out of any “sale” or “sharing” and to limit use of sensitive personal information.
• The right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact support@bakepup.com. You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and ask you to verify your identity (which, for anonymous accounts, means confirming your user ID).

BakePup is rated 4+ and intended for hobbyist home bakers. We do not knowingly collect personal information from children under 13 (or the minimum age required in your jurisdiction). If you believe a child has provided us personal information, contact support@bakepup.com and we will delete it.

All traffic between the app and our backend is encrypted with TLS. Provider API keys are stored encrypted. We follow standard cloud- security practices, but no method of transmission or storage is 100% secure. If you discover a vulnerability, please report it to support@bakepup.com.

We may update this Policy as the Service evolves. We will revise the “Last updated” date above, and for material changes we will provide notice in the app before the change takes effect. Your continued use of the Service after an update means you accept the revised Policy.

Questions, requests, or complaints about privacy? Contact Easy Carb, attn. Hicham Mahfoud, at support@bakepup.com.