Privacy Policy

Last updated: July 19, 2026

BakeUp is made by Unhinged Ventures, a small company based in British Columbia, Canada. This policy explains what information the BakeUp app collects, why we collect it, where it lives, and the choices you have. We've tried to write it the way we'd want to read it: plainly.

The short version: we collect what the app needs to work — your account, your learning progress, and the photos you choose to add. We use privacy-respecting analytics to improve the app. We don't run ads, we don't track you across other apps or websites, and we never sell your personal information.

What we collect

Account information

When you create an account, we collect your email address and a password. Passwords are stored in hashed form by our authentication provider (Supabase) — we never see or store your plain-text password.

Learning activity

As you use BakeUp, we store your lesson progress, placement-quiz answers, streaks, and in-app rewards (like Bake Bucks and badges) so the app can remember where you are and celebrate your progress.

Photos you add

If you choose to add photos of your bakes, they're uploaded to private storage that only your account can access. Bake photos are not visible to other users or to the public. Camera and photo-library access are used only when you actively add a photo, and only with your permission.

Purchase information

Subscriptions are processed by Apple through your App Store account, with subscription status managed by RevenueCat. We receive your subscription status (for example, "active trial") linked to your account ID. We never receive or store your payment card details — Apple keeps those.

Analytics

We use PostHog to understand how the app is used — events like "app opened," "lesson completed," or "paywall shown." These events are linked to your account (your user ID and email) so we can understand real usage, but they are used only by us, for product improvement. No advertising networks, no cross-app or cross-site tracking, no sale or sharing of this data for marketing.

Crash reports

We use Sentry to collect crash and error reports (device model, OS version, and what the app was doing when it failed) so we can fix bugs.

Push notifications

If you opt in to notifications, we store a push notification token for your device so we can send you gentle reminders. You can turn notifications off any time in iOS Settings, and the token stops being used.

What we don't collect

• No advertising identifiers, and no tracking across other companies' apps or websites.
• No location data, contacts, or health data.
• No payment card numbers (Apple processes all payments).
• We never sell personal information, and we haven't in the past.

Where your data lives

Your account, learning activity, and photos are stored with Supabase on servers located in the United States (us-west-2, Oregon). Our other providers (RevenueCat, PostHog, Sentry, Apple) also process data primarily in the United States. Because Unhinged Ventures is based in Canada and you may be elsewhere, your information is transferred to and processed in the United States. We choose reputable providers with strong contractual safeguards, but data stored in the U.S. is subject to U.S. law — under Canada's PIPEDA, you're entitled to know that, and to contact us with questions about our transfer practices.

How we use your information

• To provide the app: accounts, lessons, progress, photos, subscription access.
• To improve the app: aggregate usage patterns and crash diagnostics.
• To communicate with you: service emails and, if you opt in, push reminders.
• To comply with legal obligations.

We do not use your information for advertising, and we do not make automated decisions with legal or similarly significant effects.

Who we share it with

Only the service providers that make the app run, each acting on our instructions:

• Supabase — database, authentication, and photo storage
• Apple — payment processing and app distribution
• RevenueCat — subscription status management
• PostHog — first-party product analytics
• Sentry — crash reporting
• Expo — push notification delivery

We may also disclose information if required by law, or in connection with a business transfer (in which case this policy continues to apply to previously collected data).

Retention and deletion

We keep your information while your account is active. You can delete your account from inside the app (Profile → Delete account), which permanently removes your account, learning activity, and photos from our systems. Some records may persist briefly in encrypted backups before being purged, and we may retain minimal transaction records where the law requires it. You can also email us at support@getbakeup.com and we'll handle deletion for you.

Your rights

If you're in Canada (PIPEDA)

You have the right to access the personal information we hold about you, to challenge its accuracy and have it corrected, and to withdraw consent (which may limit what the app can do). We're accountable for personal information we transfer to service providers. To exercise any of these rights, email us. If you're not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

If you're in the EU/EEA or UK (GDPR)

We process your data on these legal bases: performance of a contract (providing the app you signed up for), legitimate interests (analytics and crash reporting to improve a service you use, done in a privacy-respecting way), and consent (push notifications, camera/photo access). You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority.

If you're in California (CCPA/CPRA)

You have the right to know what personal information we collect (it's all listed above), to delete it, to correct it, and to not be discriminated against for exercising these rights. We do not "sell" or "share" personal information as those terms are defined in the CCPA, and we do not use sensitive personal information beyond what's necessary to provide the service. Requests: support@getbakeup.com.

Children

BakeUp is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we'll delete it.

Security

Data is encrypted in transit (TLS) and at rest by our providers. Access to user data within our systems is restricted by row-level security — your photos and progress are readable only by your account. No system is perfectly secure, but we've designed ours so that the default is private.

Changes to this policy

If we make material changes, we'll update the date at the top and, for significant changes, tell you in the app. Continued use after changes means you accept the updated policy.

Contact

Unhinged Ventures · British Columbia, Canada
support@getbakeup.com