Privacy Policy

Last updated: 8 July 2026

We take the protection of your data seriously. This policy explains which personal data we process when you use the “Bako” app and what rights you have.

1. Controller

ESBM-Solutions UG (haftungsbeschränkt) i. Gr.
Ditfurthstraße 48
33611 Bielefeld, Germany
Email: support@esbm-solutions.com

2. Hosting

Our servers are operated by Hetzner Online GmbH (Germany) and managed via Coolify. The server location is in Germany (Frankfurt am Main). Database, authentication and photo storage additionally run through our processor Supabase (see section 7). Data processing agreements are in place in each case.

3. Use without an account, local storage

You can use Bako without an account at first. Until your first paid action (spending Stars or purchasing Bako Plus), your settings are stored exclusively on your device (encrypted device storage). Only when you create an account do we process your email address for authentication (via our processor Supabase).

4. What personal data we process

Depending on which features you use, we process the following categories of data:

• Email address – for registration and sign-in (required for an account).
• Display name – an optional entry in your profile.
• Account identifier (user ID) – a technical identifier (UUID) linked to your account and your data.
• Date, time and place of birth – where you enter them for methods such as astrology, horoscope or numerology (voluntary). The place of birth is a text entry; we do not collect any device location.
• Free text entries (user-generated content) – e.g. dream descriptions for dream interpretation, or questions to Tarot, Lenormand, oracle or coffee reading. These entries are transmitted to OpenAI for interpretation (see section 7).
• Photos – for palm and coffee reading (see section 5).
• Purchase and transaction data – the history of your Star purchases and spending as well as your Bako Plus subscription status (see section 9).
• Diagnostics and crash data – for error analysis and stability (via Sentry, see section 7).
• Advertising ID (AAID/IDFA) and approximate location – only for users without Bako Plus, for the delivery of advertising via Google AdMob (see section 8).

5. Processing of photos (palm and coffee reading)

For the “Palm Reading” and “Coffee Reading” methods you voluntarily upload a photo. This photo is transmitted to OpenAI (see section 7) to generate the AI reading and is stored on our servers for a maximum of 30 days, after which it is deleted automatically. Please do not upload photos showing more than is needed for the reading.

6. Data about other people (compatibility)

For compatibility or partner readings you may voluntarily enter the name and date of birth of another person. Please only enter such data if that person agrees. You are responsible for informing that person about the processing or obtaining their consent. The legal basis is our or your legitimate interest in the requested reading (Art. 6(1)(f) GDPR). This information is likewise transmitted to OpenAI for interpretation and stored with your account until you delete it or your account.

7. Recipients / Processors

To provide the app we use the following service providers:

8. Advertising, advertising ID and approximate location

For users without a Bako Plus subscription we show advertising via Google AdMob. The advertising SDK processes your advertising ID (AAID on Android, IDFA on iOS) and – derived from your IP address – an approximate location in order to deliver ads, cap their frequency and prevent fraud. Before displaying personalised ads we obtain your consent through the consent dialog (Google UMP); on iOS additionally through Apple's App Tracking Transparency (ATT). You may choose non-personalised advertising. With Bako Plus, no advertising is shown and no advertising ID is processed.

9. Purchases and subscriptions

Purchases of Stars and Bako Plus are handled through the Apple App Store or Google Play; the technical management is provided by RevenueCat. We do not receive payment data (e.g. credit card numbers). To provide the Stars feature and your subscription, we store a transaction history (purchases and spending of Stars, balance, subscription status) linked to your account identifier. The privacy terms of Apple and Google additionally apply.

10. Legal bases

We process data on the basis of Art. 6(1) GDPR: to perform a contract (lit. b, e.g. account, purchases, readings), based on your consent (lit. a, e.g. personalised advertising), and based on our legitimate interest (lit. f, e.g. stability and security of the app, compatibility readings).

11. Transfers to third countries

Several of the providers listed in section 7 – in particular OpenAI, RevenueCat, Sentry and Google AdMob – process data (also) in the USA. Such transfers are based on the EU Standard Contractual Clauses (SCC) or an adequacy decision (EU-US Data Privacy Framework), where applicable.

12. Retention period

Uploaded photos are deleted after 30 days at the latest. We store account, profile, input and transaction data for as long as your account exists or as long as statutory retention obligations require. On request or via the account deletion function we delete your account along with all associated data.

13. Your rights

You have the rights to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

14. Contact for privacy matters

For questions or to exercise your rights, contact: support@esbm-solutions.com.

Note: This text is a carefully prepared draft and does not constitute legal advice. We recommend having it reviewed by a lawyer before the official app launch.