Privacy Policy

1. Introduction

Bobao is operated by Bobao LLC ("Bobao", "we", "our", "us"), a California limited liability company, which is the data controller responsible for the personal data described here. This policy explains what we collect, why, who we share it with, and what you can do about it. It covers the Bobao app and the getbobao.com website.

We have tried to write this so it can actually be read. Where we do something you might not expect — sending review text to an AI provider, or letting a payment processor see your card details rather than us — we say so plainly rather than hiding it behind a general clause.

2. Information We Collect

2.1 Account Information

• Email address
• Password (stored only as a salted hash by our authentication provider — we never see or store it in readable form)
• Display name and username
• Profile photo, if you upload one
• Account preferences and settings

2.2 Usage Data

• Shops you save, like, or add to collections
• Reviews, ratings, photos and notes you write
• Check-ins, stamps, points, streaks and quest progress
• Search queries and filters
• Recently viewed shops

2.3 Guest Mode Data

If you use Bobao without an account, your saves and preferences are stored on your device in browser localStorage. This data is not sent to our servers, expires after 7 days, is deleted if you clear browser data, and can be carried into an account if you create one.

2.4 Optional Survey Data

If you complete the optional account survey or tick the box on the taste-quiz results screen, your answers are submitted without being linked to your account, and used for aggregate insights and your own recommendations. Completing either is never required.

2.5 Technical Data

• Device type, operating system and browser
• IP address
• Session duration and error logs
• App version

2.6 Location Data

If you grant location permission, we use your coordinates to find shops near you and to verify check-ins made by the location method, which requires you to be within roughly 20 metres of the shop. Your precise coordinates are never shown to other users — they see approximate distance only.

Before you grant permission, we make a coarse guess at your city from your IP address so the app can open somewhere sensible instead of a hardcoded city. This is described in section 9.

You can turn Location Services off in Settings, then Privacy. Search and check-in by staff PIN or QR code still work without it.

2.7 Payment Data

If you buy a premium subscription, or if you are a shop owner paying for a plan or an advert, payment is handled by our payment processor. Your full card number never reaches Bobao’s servers. We receive and store only a customer reference, the plan you are on, its status, and its renewal date.

3. How We Use Your Information

• Provide the service: show shops near you, keep your saves, stamps and points, and verify check-ins
• Sync your account across devices
• Show shop ratings and community summaries built from reviews written on Bobao
• Take payment for subscriptions and adverts, where you have bought one
• Keep the service safe: prevent fraud, spam and abuse, and enforce our Terms
• Improve the app by looking at aggregate usage patterns
• Reply to you when you contact support or send feedback
• Send service messages such as claim verification codes and shop-edit outcomes

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use advertising networks or tracking pixels. Adverts shown inside Bobao are sold directly to shops and are targeted by location and search terms, never by identity or profile.

4. Legal Bases for Processing

If you are in the UK or European Economic Area, we rely on the following bases under the UK GDPR and EU GDPR:

• Contract: running your account, saving your stamps and points, and taking payment for a subscription you bought
• Consent: location, analytics, buzz features and marketing, each a separate switch in Settings, then Privacy, and each withdrawable at any time
• Legitimate interests: keeping the service secure, preventing abuse, and understanding aggregate usage — balanced against your rights, and never used for profiling or advertising
• Legal obligation: keeping records we are required to keep, such as those relating to payments

5. Data Storage & Security

Account data is stored in our hosting provider’s managed Postgres database. Guest data stays on your device.

The measures we actually have in place:

• All traffic is encrypted in transit using HTTPS/TLS
• Data is encrypted at rest by our hosting provider
• Passwords are hashed and salted by our authentication provider; nobody at Bobao can read them
• Row Level Security on the database, with the privileged service key held only on the server and never shipped to the app
• Access controls and authentication on administrative functions
• Rate limiting on sensitive routes

What we do not claim: Bobao does not use end-to-end encryption, and we have not commissioned an independent penetration test or third-party security audit. Earlier versions of this policy said otherwise. That was wrong, and we would rather correct it than imply an assurance we cannot evidence. No online service can promise perfect security.

6. Data Retention

• Guest data: on your device only, expires after 7 days or when you clear browser data
• Account data: kept while your account is open
• Deleted accounts: your login, profile, saves, collections, check-ins and quiz results are removed within 30 days; backups age out within 90 days
• Posts and reviews after deletion: kept, but your name and photo are stripped and they are credited to "Former Bobao user", so shops keep their review history and nothing left behind identifies you. Ask us and we will remove them entirely
• Error logs: retained by our error-tracking provider for 90 days
• Payment records: kept as long as tax and accounting rules require
• Support and feedback emails: kept while we need them to answer you

7. Your Rights (GDPR/CCPA)

Wherever you live, you can:

• Access: request a copy of your data, or download it yourself from Settings, then Privacy
• Rectification: correct anything inaccurate, mostly from Edit Account
• Deletion: delete your account from Settings, then Privacy, or by emailing us
• Portability: export your data in a machine-readable format
• Withdraw consent: turn off any of the four privacy switches at any time
• Object or restrict: object to processing based on legitimate interests
• Non-discrimination: we will not degrade the service because you exercised a right

California residents: we do not sell or share personal information as those terms are defined by the CCPA and CPRA, so there is no "Do Not Sell or Share My Personal Information" action to take. We do not knowingly process the sensitive personal information categories beyond precise location, which is consent-gated and switchable off.

We answer requests within 30 days. If you are in the UK or EEA and think we have got it wrong, you can complain to your national data protection authority — in the UK, the Information Commissioner’s Office.

8. Cookies & Local Storage

We use browser localStorage rather than advertising cookies, to:

• Keep you signed in
• Hold guest saves and preferences
• Remember your theme, filters and consent choices

Clearing browser data removes all of this, including any guest saves that have not been migrated to an account. We set no third-party advertising cookies.

9. Third-Party Services & Data Processors

These are every third party that receives data as part of running Bobao, and what each one gets. Where a service is optional or not switched on, that is said.

• Supabase (USA) — database, authentication and file storage. Holds your account and everything in it. Covered by a data processing agreement.
• Apple, Google or Facebook (USA) — only if you choose to sign in with one of them. The provider confirms who you are and passes Bobao your name and email address to open the account; it also learns that you use Bobao. Signing in with an email address and password instead involves none of them, and a provider you cannot see a button for is not switched on.
• Sentry (USA) — error tracking and session replay. On-screen text is masked and media blocked before anything is sent. With analytics consent it also receives your account ID, email and username to identify errors; without it, only an opaque account ID. Data retained 90 days.
• Vercel (USA) — hosting, plus anonymous page-view and performance analytics. Sets no cookies and does not identify individual users.
• Stripe (USA) — payments and subscriptions, if you buy one. Receives your card details directly; Bobao never sees the full card number. Only active when payments are configured.
• Resend (USA) — sending transactional email. Receives the recipient address and message content for claim verification codes, shop-edit notifications, waitlist confirmations, and feedback you submit through the app.
• Groq (USA), or Google (USA) as a fallback — generating the AI community summary on a shop page. Receives the text of reviews for that shop and the display names attached to them. See section 10.
• Google Maps Platform (USA) — shop details and photos for shops not already covered by our own data.
• OpenStreetMap — Overpass and Nominatim, operated by the OpenStreetMap Foundation in the EU/UK, for nearby-shop search and geocoding. Receives search terms and approximate coordinates, not your identity.
• ipwho.is — coarse city-level location guess before you are asked for location permission. Your browser contacts it directly, so it sees your IP address. This happens before any consent prompt; if you would rather it did not, set your city manually and decline location.
• Square (USA) — only if purchase-verified stamps are switched on for your shop, in which case receipt data for a transaction you made is used to award a stamp. Off unless explicitly enabled.

Push notifications: we store a device token so notifications can be sent to your device. Sending is not yet switched on, so no notification provider currently receives anything.

10. AI-Generated Shop Summaries

A shop page may show a short community summary written by a large language model from the reviews people have left on Bobao. To produce it, the review text and the display name shown on each review are sent to the AI provider named in section 9.

This matters if you write reviews: your words and the name on your profile leave Bobao and reach that provider. Nothing else about your account is sent — not your email, not your location, not your other activity. Summaries are cached, so the same reviews are not sent repeatedly.

If you would rather your review was not included, delete it or ask us and we will remove it from the source set.

11. Children's Privacy

Bobao is not intended for children under 13, and we do not knowingly collect their data. If you are in the UK or EEA and under 16, please get a parent or guardian’s permission before using Bobao, unless your country sets a lower age.

If you believe a child has given us personal information, email us and we will delete it.

12. International Users

Bobao LLC is established in the United States, and most of the providers in section 9 are in the United States. If you use Bobao from the UK or EEA, your data is transferred there.

For those transfers we rely on the Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, incorporated into our agreements with those providers.

13. Changes to This Policy

We update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects you — a new category of data, a new provider, a new purpose — we will tell you in the app or by email before it takes effect, rather than relying on you noticing the date.

14. Contact Us

For anything in this policy, including exercising any right in section 7:

• Email: getbobao@gmail.com
• In the app: Account, then Settings, then Privacy
• Help centre: getbobao.com/support.html
• Account deletion: getbobao.com/delete-account.html

Bobao LLC is the controller of the personal data described in this policy, and is the company you are contracting with. Email reaches a person.