Privacy Policy

The short version

• No bank logins. Ever. We never ask for or access your bank or card accounts, card numbers, or transaction history.
• We never sell or rent your data — not to advertisers, data brokers, banks, or anyone else.
• We collect only what we need to run baku: your account info, the cards you choose to track, and basic technical data.
• You can access, export, or delete your data at any time.

Who we are

baku is operated by Chester Leung (“baku,” “we,” “us”). This policy applies to the baku website and app. For how the Service works in general, see our Terms of Service.

Information we collect

Account information

You sign in with Google. Through that, we receive your name and email address and a Google account identifier. We use these to create and identify your account. We don’t receive your Google password.

Your card portfolio

The information you enter to use baku: which cards you hold, their anniversary dates, any nicknames you add, which credits you choose to track, and the usage you log (for example, marking a credit “used”). To be clear, this is notyour actual card or bank account — it’s just a list of card types and the credits you’re keeping an eye on. We do not collect card numbers, expiration dates, CVVs, or banking credentials.

Payment information

If you subscribe to baku Pro, payments are handled by Stripe. Stripe collects and processes your payment details directly; we never receive or store your full card number. We keep a record of your subscription status and basic billing metadata (such as whether you’re an active subscriber) so we can provide the paid features.

Technical and usage data

Like most websites, we automatically receive some technical information when you use baku — such as your IP address, browser and device type, and pages viewed. We use a privacy-friendly, cookieless analytics tool to understand aggregate usage. We use cookies only as needed to keep you signed in and secure your session.

How we use your information

• To provide baku — show your credits, track usage, and run your account.
• To process payments and manage baku Pro subscriptions.
• To send you essential service messages (for example, account or billing notices).
• To maintain security, prevent abuse, and debug problems.
• To understand aggregate usage so we can improve the Service.
• To comply with legal obligations.

What we don’t do

• We don’t sell or rent your personal information.
• We don’t connect to or pull data from your financial accounts.
• We don’t share your data with advertising networks or use it to target ads.

Who we share information with

We don’t sell your data. We do rely on a small set of trusted service providers (“subprocessors”) to operate baku, and they only handle your data to perform services for us:

• Supabase — database hosting and authentication (stores your account and card data).
• Vercel — application hosting and infrastructure.
• Google — sign-in (OAuth).
• Stripe — payment processing for baku Pro.
• Resend — sending transactional and account emails.
• Analytics — a privacy-friendly, cookieless analytics tool for aggregate usage metrics.

We may also disclose information if required by law, to protect the rights, safety, or property of baku or others, or in connection with a merger, acquisition, or sale of assets (in which case we’ll require the successor to honor this policy).

Data retention

We keep your information for as long as your account is active or as needed to provide the Service. If you delete your account or ask us to delete your data, we’ll remove your personal information from our systems within a reasonable period, except where we’re required to retain certain records (for example, billing records) by law.

Your rights and choices

Wherever you live, you can access, correct, export, or delete your baku data. To do any of these, use the controls in the app where available, or email us at chestercleung@gmail.comand we’ll help.

Depending on where you live, you may have additional rights:

• California (CCPA/CPRA):the right to know what personal information we collect, to delete it, to correct it, and to opt out of sale or sharing — and we don’t sell or share your personal information.
• EU/UK (GDPR): the rights of access, rectification, erasure, restriction, portability, and objection. Our legal bases for processing are performing our contract with you, our legitimate interests in operating and securing baku, and your consent where applicable.

We won’t discriminate against you for exercising any of these rights.

Security

We take reasonable measures to protect your information, including encryption in transit and access controls that keep each user’s data scoped to their own account. No system is perfectly secure, so we can’t guarantee absolute security, but the deliberately small amount of non-sensitive data baku holds is part of the design.

International users

baku is operated from the United States, and your information is processed and stored in the U.S. and other countries where our service providers operate. By using baku, you understand that your information may be transferred to and processed in countries with different data protection laws than your own.

Children

baku is not intended for anyone under 18, and we don’t knowingly collect personal information from children. If you believe a child has provided us information, contact us and we’ll delete it.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll update the “Last updated” date above and, where appropriate, notify you.

Contact

Questions about your privacy or this policy? Email chestercleung@gmail.com.