Privacy Policy

Who we are

Baku is made by Mosaic Analytics LLC, trading as Baku Science, in Salt Lake City, Utah. This policy covers the Baku iOS app and this website. Questions: support@bakuscience.com.

What we collect

Identity. You sign in with Apple. We receive a stable identifier from Apple and, if you consent on first sign-in, an email address — which for most people is Apple’s private relay address rather than their real one. We do not ask for your name.

Health and wearable data, only what you grant: sleep sessions and stages, heart rate, heart-rate variability, resting heart rate, respiratory rate, blood oxygen, steps, active energy and workouts. From these we derive scores, baselines and trends, which we also store.

Profile you enter yourself: age, sex, weight, height, maximum heart rate, sleep need and your app settings.

Operational records: sync timings, ingestion logs, and app errors. Error reports go to our own server — there is no third-party crash service in the app.

What we never collect

How we use it

To produce the analytics you opened the app for, to keep your account working, to fix bugs, and to improve the models. Nothing else.

We do not use your health data for advertising, we do not sell it, and we do not share it with anyone for marketing. There is no advertising side to this business for it to feed.

Where your data lives

In a PostgreSQL database hosted on Railway, in the United States. Connections to it require TLS. Access tokens for services you connect — Oura, for instance — are encrypted at rest with a separate key, so a copy of the database alone does not give anyone access to your Oura account.

Your iPhone also keeps a local copy so the app works without a signal.

Who else touches it

A short list, and it is the whole list:

We may also disclose data if the law requires it, or if the business is ever transferred — in which case the same commitments follow it, and you would be told before anything moved.

Apple Health

Data read from Apple Health (HealthKit) is used solely to power your analytics inside Baku. It is never used for advertising or marketing, never shared with third parties for those purposes, never sold, and never disclosed to data brokers. You control which categories Baku may read, in the Health app, and you can revoke any of it at any time.

Air quality and approximate location

Baku shows local air quality, which needs to know roughly where you are. It does this without ever asking for GPS — the app has no location permission and cannot see your precise position.

Instead, one of two things happens. If you have typed a city into Settings, that is used. Otherwise the app asks ipapi.co to infer a city from your IP address. Either way the resulting coordinates go to Open-Meteo, which returns the air quality reading. A typed city is stored only on your phone and is never sent to our server.

Two things worth being clear about. These requests go directly from your phone to those services, so they see your IP address or an approximate position — and Baku’s own server never receives your location at all. And no health data is included in them: they are deliberately made with a plain request that does not carry your Baku credentials, so neither service can associate a location with your account.

IP-derived location is coarse and often wrong — a phone on cellular can appear in a different city entirely. If air quality is not something you care about, ignore it; if it is, typing your city in Settings is both more accurate and less revealing.

Processing that happens on your phone

The written daily summary is generated by a language model running on your iPhone. The text is never produced in a datacentre, and the data behind it is not sent anywhere to write it.

Getting your data out, and deleting it

Both are in the app and neither needs our involvement:

Settings → Export my data gives you the entire record as a file. Settings → Delete my data permanently removes every measurement, score, baseline and experiment we hold for you. Deletion is immediate and irreversible — there is no grace period and no copy kept.

To remove the account itself, email support@bakuscience.com and it will be done.

How long we keep it

For as long as you keep the account, because the whole point is a long personal record. Delete your data and it is gone at once. Ordinary database backups may hold a copy for a short period before they roll over.

Children

Baku is for adults. It is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a minor has used it, tell us and it will be deleted.

If you are in California

You may ask what we hold, ask for a copy, ask us to delete it, and not be treated differently for asking. We do not sell or share personal information as those terms are used in the CCPA, and we never have. Export and deletion are both self-service in the app; for anything else, email support@bakuscience.com.

Security

TLS in transit, encryption at rest for third-party tokens, and access to production limited to one person. Sign in uses Apple’s own authentication, so there is no Baku password to be stolen.

No system is perfectly secure. If a breach ever affected your data, we would tell you.

Changes

We will update the date at the top, and for anything significant we will say so in the app or by email rather than quietly reposting this page.

Contact

Mosaic Analytics LLC (Baku Science), Salt Lake City, Utah — support@bakuscience.com.