Privacy Policy

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Daniel Kurfess
Forststr. 7
70794 Filderstadt, Germany
Email: hello [at] baketsu [dot] app

Baketsu is developed in Germany and the website is hosted in the European Union.

No cookies, no analytics, no tracking

The website sets no cookies, uses no analytics or tracking services, and embeds no third-party content. Fonts are hosted on our own server, so opening the site does not trigger requests to font providers such as Google Fonts.

Hosting

The website is hosted by BunnyWay d.o.o. (bunny.net), a company based in Slovenia in the European Union. Your data does not leave the EU when you visit the site.

We have switched off request logging for this site: Bunny does not write your IP address, the requested page, the referring page, or your browser and operating system information to any log. Bunny still needs to see your IP address for the brief moment it takes to send you the page, the same way any server on the internet does, but nothing is stored afterwards.

Legal basis for this transient connection handling: our legitimate interest in operating the website, Art. 6(1)(f) GDPR.

Domain name resolution

The domain baketsu.app uses Cloudflare, Inc. (USA) as its DNS provider. Website traffic itself is not routed through Cloudflare; only the technical lookup of the domain name is answered by Cloudflare's name servers.

Links to other sites

The site links to the Apple App Store. Once you follow such a link, the privacy policy of the linked site applies; for Apple see apple.com/legal/privacy.

Contact by email

If you write to us, we process your email address and the content of your message to answer you. Legal basis: Art. 6(1)(f) GDPR (answering your inquiry) or Art. 6(1)(b) GDPR where your inquiry relates to a contract. We delete correspondence once it is no longer needed, unless statutory retention duties apply.

No tracking, no ads, no analytics

The app contains no advertising, no analytics SDKs, and no third-party trackers. We do not use the advertising identifier (IDFA) and do not build profiles. We do not run our own backend servers, so the app never sends your data to us. The only network services the app talks to are operated by Apple.

No account, no sign-in

There is no Baketsu account and no sign-in. The app never asks for an email address or a password, and we never learn who you are. The only personal detail the app asks for is a first name you type yourself, so it can greet you. It is stored on your device and, if you are signed in to iCloud, in your personal, private iCloud database so your other devices can greet you too. We never see it.

Legal basis: performance of the contract of use, Art. 6(1)(b) GDPR.

Your lists

Buckets, the places you save in them, and their checked-off state are stored locally on your device. If you are signed in to iCloud, this data is also stored in your personal, private iCloud database (Apple CloudKit) so it syncs across your devices and survives a device change. It is encrypted in transit and at rest. Technically and by design, we cannot read your private iCloud database; only you can access it with your Apple ID. Apple processes this data as part of your own iCloud agreement with Apple.

Legal basis: performance of the contract of use, Art. 6(1)(b) GDPR.

Location

If you grant the app location access ("while using the app" only), your position is used on your device to show where you are on the map and what is nearby. The app does not store a location history and does not transmit your location to us. You can revoke access at any time in iOS Settings; the app keeps working without it.

Legal basis: your consent via the iOS permission dialog, Art. 6(1)(a) GDPR. You can withdraw it at any time in iOS Settings with effect for the future.

Maps and place search (Apple Maps)

Maps, place search, and address lookups are provided by Apple's MapKit service. When you search for a city or place, your search text and an approximate map region are sent to Apple to return results, and map tiles are loaded from Apple's servers. Apple processes this data under its own privacy policy (apple.com/legal/privacy); according to Apple, Maps requests are associated with rotating random identifiers rather than your Apple ID. We receive none of this data.

We do not sell or share your personal data with third parties for their own purposes. The recipients that exist are:

• BunnyWay d.o.o. (Slovenia, EU): website hosting, as our processor under Art. 28 GDPR.
• Apple Inc. (USA): Apple Maps and iCloud, under your own agreements with Apple. Where data is transferred to the USA, Apple is certified under the EU-US Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection (Art. 45 GDPR).
• Cloudflare, Inc. (USA): DNS resolution for the domain only; no website content or visitor traffic passes through Cloudflare.

We keep no user database and no website request logs. App data stays on your device and in your private iCloud until you delete it: you can delete individual places and buckets in the app, use "Delete all data" in the app's settings, or simply uninstall the app. Deleting the app removes all local data; "Delete all data" additionally removes your synced iCloud data.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21), and
• withdraw any consent at any time with effect for the future (Art. 7(3)).

In practice, almost all of your Baketsu data is under your direct control on your device, so the fastest way to exercise most of these rights is the app itself. For anything else, email us at hello [at] baketsu [dot] app.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority of the German federal state where you live or where we are based (Art. 77 GDPR).

We do not use automated decision-making or profiling.

Baketsu is not directed at children. If you are under 16, please only use the app with the consent of a parent or guardian.

If we change this policy, we will publish the new version here with an updated date. For significant changes affecting the app, we will also point it out in the app.