Privacy Policy
Last updated: September 2026
The short version
BAU stores the minimum needed to run community challenges: your account details and your check-ins. We don't show ads, we don't sell data, and we don't share it with anyone except the service providers that host the app. You can delete everything, yourself, at any time.
What we collect
Account: your name, email address, a securely hashed password (we can't read it), your timezone, and an avatar emoji. Activity: the challenges you create or join, your daily check-ins (status, optional numbers like steps or minutes, optional notes), streaks, and announcements you post. Reminders: if you enable push notifications, a push subscription token for your device. That's the full list — no location, no contacts, no tracking identifiers, no analytics profiles.
Family profiles and children
Adults can create managed profiles for children so kids can take part in challenges without their own account. A child profile is only a first name (or nickname) and an emoji — no email, no password, no birthdate, no contact details, and children cannot sign in themselves. The profile is created, managed and deletable only by the parent or guardian's account, and it is visible only inside the specific challenges it joins. Deleting a child profile immediately removes their check-in history too.
Who can see your activity
Your name, avatar, progress and check-in notes are visible to the other members of challenges you join — that's the point of a group challenge. Public challenges are discoverable by any signed-in user; private ones are visible only to members invited by link or code. Nothing is ever visible to people outside your challenges.
Where it's stored
Data lives in our database and hosting providers (currently Vercel for the application and a managed PostgreSQL provider for the database), used purely to run the service. Push notifications are delivered through your device platform's push service (e.g. Apple or Google), which receives the message content in transit.
Cookies
One cookie: an encrypted session token that keeps you signed in. No advertising or tracking cookies.
Deleting your data
Profile → Delete account removes your account, family profiles, check-ins, subscriptions and any challenges you created — immediately and permanently. You can also remove a single family profile, or leave a single challenge, without deleting your account.
Contact
Questions or requests: see the support page. If this policy changes, we'll update this page and the date above.