Your information, handled with care.

01 Who we are

This Privacy Policy describes how BAUX LLC ("BAUX," "we," "us," or "our") collects, uses, and shares information when you use the BAUX iOS app (the "Service"). BAUX is a guided-tourism app where users converse with Bae, an AI guide, to discover and learn about destinations.

If you have any questions about this policy or your data, contact us at privacy@hibaux.ai.

02 Information we collect

Voice and conversation data

You speak to Bae using your iPhone's microphone. Here's what happens to your voice:

• Voice audio is captured and transcribed locally on your device. We use Apple's built-in Speech Recognition framework to convert your speech to text. Depending on your device, iOS version, and Apple's settings, Apple may process this audio on-device or on Apple's servers; in either case, Apple's handling of your audio is governed by Apple's Privacy Policy.
• BAUX never receives, stores, or transmits your voice audio. Only the transcribed text of what you said is sent to our servers.
• The transcribed text becomes the content of your conversation with Bae. We process and store this text to provide responses, maintain context across a conversation, and improve Bae over time.

Account information (optional)

You can use BAUX without an account. If you choose to sign in:

• Sign in with Apple and Continue with Google are our authentication options. With Sign in with Apple, you can share your email address or use Apple's private email relay service (which gives us a relay address rather than your real email). With Google, you authenticate through your Google account and we receive your basic profile information (name and email).
• We receive your name (if you choose to share it) and your email or Apple relay address.
• We do not receive or store your Apple ID password.

Profile photo (optional)

• If you choose to set a profile picture, you can select a photo from your photo library. We access your photo library only for the image you select, and only when you initiate it — we do not scan or access any of your other photos, and we do not access your photo library unless you choose to set or change your profile picture.

Connected accounts — Calendar, Reminders, and Gmail (optional)

• You can optionally connect your calendar and reminders (via iCloud) and your calendar and email (via Google) so Bae can offer recommendations that fit your schedule and context. This access is read-only, is used only to inform Bae's suggestions, and happens only if you explicitly connect these accounts.
• Connected calendar and reminders data is limited to a short window around the present (approximately seven days), is encrypted, and can be disconnected at any time — disconnecting removes the stored copy. From your calendar, we access event titles, dates and times, locations, and calendar names. From your reminders, we access titles, due dates, and list names; we do not create, edit, or delete your reminders. You control this access and can revoke it in the app or in your iCloud or Google account settings.
• When you connect iCloud reminders, Apple's system prompt asks for "Full Access." This is simply the only permission level iOS offers for reminders — there is no read-only option — and despite the wording, BAUX only reads your reminders and never changes them.

Location data

When you grant the app permission to access your location:

• We use your location to show destinations near you, surface "you're nearby" suggestions, and provide context-relevant recommendations from Bae.
• You can revoke location permission at any time in iOS Settings.
• We do not continuously track your location in the background. Location is accessed only while you're actively using the app.

Usage and device information

• Device and OS info (such as device model, iOS version, app version) for compatibility and debugging.
• App interaction data (such as which destinations you view, what you favorite, conversation history with Bae) to provide the Service and improve it over time.
• Crash reports and performance metrics via Apple's standard mechanisms (TestFlight and App Store Connect).
• Product analytics via PostHog, a third-party analytics provider. We record in-app events (such as app opens, screens viewed, destinations viewed, and sign-in actions), associated with a user or device identifier, to understand how the app is used and improve it. This is in-app analytics only — it is not used for advertising and is not used to track you across other companies' apps or websites.

What we do not collect

• We do not collect contacts, health data, or general files from your device. (See the optional cases above where you can choose to share a profile photo or connect your calendar and Gmail.)
• We do not collect data from other apps.
• We do not use third-party advertising SDKs, and we do not track you across other companies' apps or websites.
• We do not collect data to build advertising profiles.

03 How we use your information

We use the information we collect to:

• Operate Bae (process your transcribed conversations and generate responses)
• Show you relevant destinations and recommendations
• Maintain your account and personalize your experience
• Improve the Service (understand what works, fix what doesn't)
• Communicate with you about the Service (only if you've signed in and provided an email)
• Comply with legal obligations and enforce our terms

We do not sell your personal information to anyone. We do not share your personal information for advertising purposes.

04 Third parties who process data on our behalf

To provide the Service, we share specific data with the following vendors. Each only receives what's necessary for their function and is bound by contractual obligations to protect that data.

We do not share your personal information with any other third parties except as described in Section 7 (Legal & Safety).

05 Data retention

We retain your information only as long as needed to provide the Service:

• Account information — for as long as your account is active, plus a reasonable period for backups and account-recovery scenarios.
• Conversation history — retained to maintain conversational context with Bae and improve the Service. You can request deletion at any time (see Section 6).
• Location data — used in real time; we do not store a historical location trail.
• Device and crash data — retained as long as needed for diagnostic purposes, typically no more than 12 months.
• Product analytics data (PostHog) — retained for up to 12 months, then aggregated or deleted.

When you delete your account or request data deletion, we delete or anonymize your personal information within 14 days, except where retention is required by law. Copies may remain in our encrypted backups for up to a further 42 days before those backups are overwritten.

06 Your rights and choices

You can:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated personal information
• Export your data in a portable format
• Opt out of communications at any time
• Revoke permissions (location, microphone, Sign in with Apple) in iOS Settings at any time

To exercise any of these rights, email us at privacy@hibaux.ai. We will respond within 30 days.

If you are in the European Economic Area, United Kingdom, or California, you have additional rights under GDPR, UK GDPR, or CCPA respectively (including rights to object, restrict processing, and lodge a complaint with your local data protection authority). The contact above applies for all such requests.

07 Legal and safety disclosures

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, or government request
• Protect the rights, property, or safety of BAUX, our users, or the public
• Investigate or address fraud, security issues, or violations of our terms
• Enforce our agreements

We will notify you of any legally compelled disclosure unless prohibited from doing so.

08 Security

We use industry-standard technical and organizational measures to protect your information, including:

• Encryption in transit (HTTPS/TLS) for all communications between the app and our servers
• Encrypted authentication tokens (we never receive or store your Apple ID password)
• Access controls limiting who at BAUX can access user data
• Regular security review of our infrastructure and third-party vendors

No system is perfectly secure. If we become aware of a security incident affecting your information, we will notify you and applicable regulators as required by law.

09 Children's privacy

BAUX is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact privacy@hibaux.ai and we will delete it.

You must be at least 16 to use the Service. If you are 16 or 17, we recommend a parent or guardian review this policy with you before using the Service.

10 International users

BAUX is operated from the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our vendors operate (primarily the U.S.). By using the Service, you understand that your information may be transferred internationally.

Our vendors (Anthropic, ElevenLabs, AWS, PostHog) operate in multiple jurisdictions and apply appropriate safeguards for international data transfers under their respective policies.

11 Beta-stage notice

The BAUX iOS app is currently in beta testing. The Service is evolving rapidly, and we may add features, change how data flows, or update this Privacy Policy as the product matures. We will notify beta testers of any material changes via the email associated with their account, and we will update the "Last updated" date at the top of this policy.

12 Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page
• For material changes, provide additional notice (such as an email or in-app notification)
• Continue to honor the policy in effect at the time you provided your information, unless we have your consent to apply changes retroactively