Privacy Policy
What Baaka collects, why, and what rights you have over it.
Last updated 15 September 2026
1. Who we are
Baaka is a mood journaling application operated by SIA "Fabizone", registered in the Commercial Register of the Republic of Latvia under number 40203382023, with its registered address at Kuldīgas iela 45B - 13, Rīga, LV-1083, Latvia.
We are the data controller for the personal data described here, within the meaning of the EU General Data Protection Regulation (GDPR). Contact us at info@baaka.app about anything in this policy.
This policy covers baaka.app, the Baaka web application, and the Baaka mobile applications (the "Service").
2. What we collect
- Account data — your email address, the name you ask us to call you by, an identifier from Google or Apple if you sign in with them, and the time zone your device reports (you can change it in Settings), so that things like your weekly recap arrive accurately.
- Content you create — your journal entries, your answers to prompts, the emotions you select, and material derived from them. Because this content can describe your mood and mental state, we treat it as data concerning health — a special category of personal data under Article 9 GDPR.
- Your date of birth — collected once, when you first sign in, to confirm you are old enough to use the Service.
- Technical and usage data — information about the devices and sessions you sign in from, your IP address, diagnostic logs generated as you use the Service, and, if you turn notifications on in the app, a push notification token for that device.
- Subscription data — if you subscribe to a paid plan, whether the subscription is active, which plan it is, when it renews or expires, and which store or provider it was bought through.
If you dictate an entry, the audio is sent from your device to our speech-to-text provider and we receive only the resulting text.
We do not collect your location, contacts, photos or calendar, and we do not buy personal data about you from third parties.
We use cookies and similar local storage only where strictly necessary to operate the Service, such as keeping you signed in. We do not use advertising or third-party tracking cookies.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in | Performance of a contract (Art. 6(1)(b)) |
| Storing your content, processing it to provide the Service's features, and showing you your history and insights | Performance of a contract (Art. 6(1)(b)), and your explicit consent for the health-related content within it (Art. 9(2)(a)) |
| Sending you service emails, such as sign-in links and notices | Performance of a contract (Art. 6(1)(b)) |
| Providing paid subscriptions and the access to features they unlock | Performance of a contract (Art. 6(1)(b)) |
| Keeping the Service secure and reliable, preventing abuse, and improving it | Our legitimate interests (Art. 6(1)(f)) |
You give explicit consent for the health-related content on a dedicated screen shown the first time you sign in, by ticking a box that is not pre-ticked. You cannot use the Service without giving it, because the processing it covers is what the Service does. We record the date you gave it and the version of the wording you were shown.
You may withdraw it at any time by deleting your account, which erases the content the consent covers — see how to delete your account. Withdrawing does not affect processing carried out beforehand.
If we materially change what you are consenting to, we will ask again before relying on the new version.
4. Automated processing
The Service uses third-party artificial intelligence providers to process the content you submit — for example to interpret it, structure it, and generate responses and insights within the Service. Your content is sent to those providers for that purpose.
We do not make decisions about you that produce legal or similarly significant effects by automated means within the meaning of Article 22 GDPR.
5. Who we share it with
We share personal data with service providers who process it on our instructions, in the following categories:
- hosting, storage and infrastructure providers;
- artificial intelligence and speech-to-text providers;
- email delivery providers;
- push notification delivery providers, which receive a device token and a short fixed message about your account or something waiting in the app, never your content;
- monitoring, logging and diagnostics providers;
- payment and subscription-management providers, which receive an identifier for your account and the details of your subscription, never your content;
- identity providers, where you choose to sign in with an external account.
We may also disclose personal data where required by law, to protect our rights, or in connection with a merger, acquisition or sale of assets. We do not sell your personal data.
6. International transfers
Your data is primarily stored within the European Union. Some of our providers are established outside the European Economic Area. Where that is the case, we rely on the safeguards permitted under Chapter V GDPR, such as the European Commission's adequacy decisions or Standard Contractual Clauses.
7. How long we keep it
We keep your account data and content for as long as your account exists. When you delete content or your account, it is removed from our active systems; copies may persist for a limited period in routine backups and in diagnostic logs before those cycle out. Content already sent to the providers described in section 5 may persist in their systems for a limited period under their own retention arrangements.
If you have subscribed to a paid plan, we keep a limited record of the subscription — its final status, and the steps we took to end it — after your account is deleted, for as long as we need it to resolve or defend billing and subscription disputes.
We may retain information for longer where we are required to by law, or where it is necessary to establish, exercise or defend legal claims.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to certain processing;
- receive your data in a structured, commonly used, machine-readable format;
- withdraw consent at any time, by deleting your account (see below).
You can export your journal entries, and delete individual entries and your entire account, from within the Service — see how to delete your account. To exercise any other right, email info@baaka.app and we will respond within the period the GDPR allows.
If you believe we have handled your data unlawfully you may lodge a complaint with your local supervisory authority. Ours is the Datu valsts inspekcija (State Data Inspectorate of Latvia).
9. Security
We take appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls, and restricting internal access to what is necessary. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Children
The Service is intended for adults. It is not offered to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact info@baaka.app and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The date above shows when it last changed. Where a change is material, we will give you notice through the Service or by email before it takes effect.
12. Contact
SIA "Fabizone"
Kuldīgas iela 45B - 13, Rīga, LV-1083, Latvia
Registration number 40203382023
info@baaka.app