Legal
Privacy policy
Trust is the product. This policy explains in plain language what Baku does with your data. The short version: your dreams are yours. They stay private, are stored in Switzerland, are never sold or used for advertising, and you can export or delete them at any time.
Last updated: 20 October 2026
Auf Deutsch lesen1. Who is responsible
Baku is a product of BSNS GmbH. The controller for your personal data is BSNS GmbH, a limited liability company under Swiss law, Birkenstrasse 47, 6343 Rotkreuz, Switzerland, UID CHE-213.120.212 ("Baku", "we", "us"). Write to us about privacy at support@baku.care, or by post to the address above, marked "Data protection".
For people in the European Union and the United Kingdom, the contact for every question about your data is Roman Fritschi, managing director of BSNS GmbH, at the address above or support@baku.care.
2. What this policy covers, and which law applies
This policy covers the website baku.care, the Baku app for iPhone and Android, our emails, gifts of Baku, our creator and partner programmes, our social media profiles, and any contact you have with us. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR. Where they differ, we follow the stricter rule.
3. Your dreams are health data
What you record in Baku (dreams, nightmares, how your nights went, when you woke, how you felt, what helped, and sleep data from a device you connect) is health data. Under the FADP it is sensitive personal data; under the GDPR it is a special category of personal data (Article 9). We treat it that way:
- We process it only with your explicit consent, which the app asks for separately and which you can withdraw at any time in Settings.
- It is private by default, stored in Switzerland, encrypted in transit and at rest, and can be locked on your phone behind Face ID, a fingerprint or a passcode.
- Our team cannot read your journal. Support can see it only if you grant time-limited access yourself (72 hours), and every look is logged.
- We never sell it, never use it for advertising, and never share it for marketing.
4. What we process, and why
On the website
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Server logs: IP address, browser, page, time | Delivering the site, security, preventing abuse | Legitimate interest (FADP art. 31; GDPR art. 6(1)(f)) | 30 days |
| A one-way hash of your IP address when you use a form, a code or a gift page | Limiting how often one connection can try, against abuse | Legitimate interest | At most 2 days |
| Waitlist: email, language, page and site you came from, campaign tags, optional dreamer type | Telling you when Baku opens | Consent (GDPR art. 6(1)(a)), confirmed through the link in the first email we send (double opt-in); we write to confirmed addresses only | Unconfirmed addresses 30 days; otherwise until you unsubscribe, at most 24 months after launch |
| "Email me the link": the address you type | Sending the store links once | Your request (GDPR art. 6(1)(b)) | Not stored; a one-way hash for 24 hours prevents repeats |
| Creator applications: name, email, handle, platform, audience size and country, your note | Reviewing and answering your application (the confirmation email repeats nothing you typed except a plain first name) | Steps before a contract (GDPR art. 6(1)(b)) | 12 months if not accepted; for the partnership if accepted |
| Kit requests from practices and studios: organisation, contact person, email, postal address, profession, notes | Sending printed material | Steps before a contract (GDPR art. 6(1)(b)) | 24 months after the last kit |
| Counts of website actions (for example a tap on a store button) with the page only, never an identifier | Knowing which pages help people find Baku | Legitimate interest | 24 months |
| Analytics, only if you allow it (Google Analytics 4 through Google Tag Manager, consent mode): pages visited, device type, approximate location, pseudonymous identifiers; advertising signals off | Understanding which pages help | Consent (GDPR art. 6(1)(a)) | 14 months |
| Theme and cookie choices in your browser | Remembering your choices | Necessary for the service you asked for | Until you clear your browser storage |
In the app
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account: email address or the identifier from Sign in with Apple or Google, optional name, language, time zone | Your account, sign-in, sync | Contract (GDPR art. 6(1)(b)) | Until you delete your account |
| Health data: dreams as text and voice notes, night labels, emotions, distress ratings, wake times, bed times, rewrites and rehearsals, rituals, check-ins (for example stress, alcohol or medication changes), questionnaire answers | Providing Baku's features to you | Explicit consent (FADP art. 6(7); GDPR art. 9(2)(a)) | Until you delete it or your account |
| Sleep data from a source you connect (section 6) | Your nights, wakes your device noticed, comparisons with your own nights | Explicit consent | Until you disconnect and delete it, or delete your account |
| What you send to the AI Guide (section 5) | Tidying, reflecting and co-writing, only when you ask | Explicit consent for AI processing | With your account |
| Partner mode: your partner's name, voice notes and messages, the permissions you set | Letting someone you invite support you | Contract and consent | Until either of you ends the connection or deletes the account |
| Codes and invitations: which code or invitation you used, free months granted | Giving you the free month or offer, thanking the person who invited you, paying creators | Contract; legitimate interest in correct commission | As long as the account exists; payout records 10 years |
| Subscription status: app user ID, product, trial and renewal dates | Unlocking Plus, preventing fraud | Contract | As long as the subscription needs it, then the accounting period |
| Product events without content (for example "ritual completed"), app version, device type | Improving Baku, measuring whether nights get better | Consent, which you can change in Settings | 26 months, then only as totals |
| Crash reports: device model, system, app version, technical details, never dream content | Fixing errors | Legitimate interest | 90 days |
| Push notification token | Sending the notifications you chose, never during your night | Contract | Until you turn notifications off or delete your account |
| News from Baku, only if you turn it on (Settings, Notifications): your email address, first name and language | Occasional news by email and notification, such as new programmes and gift seasons; at most twice a month and never in your quiet hours | Consent (GDPR art. 6(1)(a)); withdraw it at any time in the app or with the unsubscribe link in every email | Until you turn it off or unsubscribe; after that our email service keeps only your address, marked as unsubscribed, so no news reaches you again |
| Messages to support | Answering you | Contract or legitimate interest | 24 months after the conversation ends |
With your separate consent we may include your data in anonymous research statistics, such as the share of people who report calmer nights after four weeks. We publish them only as totals across at least 20 people, never individual entries. You can withdraw this consent at any time in Settings.
Gifts
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Buyer: email, optional name, language; whether and when you paid; the payment reference | Selling and delivering the gift, your receipt and order page, refunds | Contract (GDPR art. 6(1)(b)) | Payment records 10 years (Swiss Code of Obligations art. 958f) |
| Recipient's first name and email address, given by the buyer | Delivering the gift at the chosen time | The buyer's and recipient's legitimate interest in receiving the gift (GDPR art. 6(1)(f)) | The address is deleted 30 days after delivery |
| The message, ready line, drawn signature and chosen card | Showing the gift to the recipient | Contract with the buyer | Deleted 12 months after the gift was started, expired or was refunded; unpaid drafts after 30 days |
| Whether the gift was delivered, opened (the card) and started (in the app); a thank-you note | Telling the buyer only these things | Contract; the recipient's choice for the note | The note is deleted 7 days after we pass it on |
Card payments, Apple Pay, Google Pay and TWINT on the website are processed by Stripe. We never see your full card number; Stripe tells us only that the payment succeeded, the amount and a reference. In the app, Apple or Google process the payment. We never tell a buyer how a recipient uses Baku, and we never use a recipient's address for anything but their gift. One thing a buyer can infer: if the recipient later pays for Plus themselves, we may thank the buyer with a free month, as in our invitation programme, so the buyer may conclude that the recipient subscribed. We never say when or which plan.
Creators, practices and studios
For people in our creator programme and our partner practices, clinics, pharmacies and studios we process contact details, codes, the counts behind their statistics page, commission statements, payout records and bank details for payouts (contract, GDPR art. 6(1)(b); accounting records 10 years). Partners and creators never receive the identity of anyone who used their code; their statistics show totals only, and counts under five are hidden.
5. The AI Guide
The Guide uses large language models from Anthropic (Claude). It processes an entry only when you ask it to, and entries you mark "keep private from AI" are never sent. Requests go through our servers; we send only the text needed for the answer, never your name or email address.
- Anthropic processes the content to produce an answer, as our processor, and does not use it to train its models.
- Anthropic may keep inputs and outputs for a limited time for safety and abuse monitoring under its commercial terms and our data processing agreement: at most 30 days, and longer only where a request is flagged for a breach of its usage policy. We have asked Anthropic for zero data retention; once it is granted, nothing is kept after the answer.
- Every message is first checked for signs of crisis, so that human help can be shown straight away. Only the category of a safety signal is stored, never the text.
- The Guide never makes decisions with legal or similarly significant effects about you. You can read, edit and delete what it remembers, and switch AI features off entirely in Settings.
6. Sleep data from wearables
If you choose to, Baku reads your sleep from Apple Health on iPhone, from Health Connect on Android, and directly from WHOOP or Oura. Through Apple Health and Health Connect, sleep from many devices arrives too (for example Apple Watch, Garmin, Fitbit, Samsung, Withings) when their app shares it with your phone. Nothing is read until you connect a source and give your explicit consent.
What Baku reads: when you fell asleep and woke, time awake, sleep stages where your device records them, heart rate variability, resting heart rate and respiratory rate during sleep; from WHOOP or Oura also their own sleep and recovery scores and, from Oura, your lowest and average heart rate during sleep. Of your WHOOP or Oura profile, Baku keeps only the account identifier it needs to match new nights to you. These figures are estimates from consumer devices, not medical measurements.
Apple Health and Health Connect: Baku only reads and never writes. Health data is never used for advertising, ad measurement or marketing, never sold, and never shared with third parties except the processors that run Baku for us (Supabase for our database in Switzerland, and Anthropic only when you use the AI features). Baku's use of information received from Health Connect follows the Health Connect Permissions policy, including the Limited Use requirements; the reason for each permission is set out at baku.care/health-connect.
WHOOP and Oura: you connect by signing in on their own page (OAuth); Baku never sees your password and asks only for the access it needs. Access tokens are encrypted and stored in Switzerland, usable only by our server functions, never by a person. When you connect, your last 30 nights are imported; new nights arrive by themselves after that. WHOOP and Oura are responsible for the data in their own services under their own policies.
How Baku uses it: to place your nights on the moon calendar, to suggest wakes your device noticed (you confirm or dismiss them), and to compare your own nights once there are enough of each. If you use the AI Guide or receive the Sunday letter, a short summary of your recent nights is sent to Anthropic so the text can mention them in approximate terms. Our team cannot read your sleep data; our internal tools show only counts and connection errors.
Stopping: disconnecting a source in Baku stops access at once (for WHOOP and Oura we also revoke our access with them), and you choose whether the imported nights are deleted. You can also withdraw access in the Health app or in Health Connect at any time.
7. Who processes data for us
We use a small number of service providers. Each has signed a data processing agreement and may use your data only on our instructions.
| Provider | What for | Where the data is |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Switzerland (Zurich); company in the US |
| Vercel | Hosting the website and the team's admin panel | Global edge network; company in the US |
| Cloudflare | Domain name service, protecting the admin panel, and a bot check on our forms (Turnstile) if we switch it on | Global network; company in the US |
| Resend | Sending emails (sign-in codes, receipts, gift emails, news you asked for) | EU sending region (Ireland); company in the US |
| RevenueCat | Managing app subscriptions and in-app gift purchases | Company in the US |
| Stripe | Payments for gifts bought on the website | Stripe Payments Europe, Ireland; Stripe, Inc., US |
| Anthropic | The AI Guide | Company in the US |
| Sentry | Crash reports, without dream content | EU data region (Germany) |
| Expo | Delivering push notifications | Company in the US |
| Website analytics with Tag Manager, only with your consent; Google sign-in if you choose it | Company in the US | |
| Apple and Google | App stores, payments, Sign in with Apple, Apple Health and Health Connect on your phone | Their own privacy policies apply |
| WHOOP and Oura | Only if you connect them: they send us your sleep | Their own privacy policies apply |
Switzerland is recognised by the European Commission as providing adequate protection, so data from the EU may be stored here. Some providers are located in, or may access data from, the United States. For providers certified under the Swiss-US and EU-US Data Privacy Frameworks we rely on those frameworks; otherwise we use the European Commission's Standard Contractual Clauses with the Swiss addendum, plus encryption and other safeguards.
We do not otherwise disclose your data, unless the law requires it, and then only what is required.
9. How long we keep data, and deleting your account
We keep data only as long as we need it for the purposes above; the periods are in the tables in section 4.
You can delete your account in the app at any time (Settings, then Your data, then Delete my account). Deletion has a 30-day grace period in case you change your mind: during that time your account is inactive and you can cancel the deletion. After 30 days your account and all its data are permanently deleted, including your recordings and every other file you stored; we also revoke Baku's access at WHOOP or Oura and delete your record at RevenueCat. Deleted data is removed from backups within a further 30 days. Data we must keep by law, such as payment records, is kept only for the statutory period and only for that purpose.
The steps, including how to ask by email without the app, are at baku.care/delete-account.
Dreams you delete are hidden at once and removed for good, with their recordings, 30 days later. A data export is available for 24 hours and its file is deleted after 7 days.
10. Your rights
You have the right to:
- know whether we process your data and receive a copy of it (the app exports everything as a file you can read, with download links to your recordings);
- have incorrect data corrected and incomplete data completed;
- have your data deleted;
- restrict processing, or object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw any consent at any time, without affecting processing that happened before;
- not be subject to automated decisions with significant effects (Baku makes none);
- complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority in your country, in the UK the Information Commissioner's Office.
Most of this you can do yourself in the app. For anything else write to support@baku.care. We answer within 30 days and may ask you to confirm your identity.
11. How we protect your data
- Encryption in transit (TLS) and at rest, including data stored on your phone; wearable tokens are additionally encrypted.
- Row-level security in our database: every personal record is readable only by its owner.
- An optional app lock with Face ID, a fingerprint or a passcode.
- Strict access for our team: journals and sleep data are invisible to staff, team members sign in to the admin panel with a second factor, and every administrative action is logged.
- A data protection impact assessment before launch, and reviews whenever we add a feature that touches health data.
- If a breach puts your rights at high risk, we tell you and the authorities as the law requires.
12. Age
Baku is for people aged 16 and over in Switzerland, the European Union and the United Kingdom, and 13 and over elsewhere. We do not knowingly collect data from younger children. If you believe a child has given us data, write to us and we will delete it.
14. Changes to this policy
If we change this policy in a way that matters, we tell you in the app or by email before the change takes effect, and ask for your consent again where the law requires it. Earlier versions are available on request.
8. Social media and links
Our profiles are on Instagram (@baku.care), TikTok (@baku.app), X (@baku_app) and LinkedIn (bakuapp). Our website and app only link to them; we do not embed their plugins, so nothing is sent to these networks until you click a link. If you interact with our profiles, the network's privacy policy applies; for Instagram and LinkedIn page insights we and the network may be joint controllers, and you can exercise your rights with either.