Privacy

Baumy Olympics (www.baumy.tech) is a private app for the people who live in one house. The house's owner runs it for the household. It is not a commercial service: nobody pays for it, and there are no customers.

• Your account: your email address, your name, whether you confirmed your email, and when you signed up. With a password, we keep only a hash of it (Better Auth), never the password itself.
• Google sign-in, if you use it: your Google account id, name, email, the link to your profile picture, and the sign-in tokens Google returns.
• Passkeys, if you add one: its public key (the private key never leaves your device), the name you gave it, its credential id, whether it lives on one device or is synced, whether it is backed up, how the browser reaches it (its transports), the authenticator's model id (AAGUID) and when you added it.
• Two-factor, if you turn it on: your authenticator secret and your backup codes, both stored encrypted; a count of wrong codes, and a temporary lock after too many; and, for each browser where you ticked "Trust this device", a record that lets it skip the code for 30 days.
• Sessions: one per signed-in device, with its IP address, its browser name (user agent), when it signed in and when it was last used. Settings, Security lists your devices by a name worked out from the browser (for example "Chrome on macOS") and when each was used; it does not show the IP address or a place.
• "Confirm it's you": when you sign in or confirm it is you before a sensitive change (for example a kiosk PIN), which way you used (passkey, two-factor code, Telegram, password or Google) and when, for that one signed-in device, so it does not ask again for 10 minutes. Never the password or the code itself. It goes when that device signs out, and the audit log keeps that you confirmed and how. For two-factor codes, we also keep which 30-second code you last used to confirm, so the same code cannot be used twice.
• Your member profile: display name, colour, the gallery character you picked (if any), your role, your kiosk PIN (as a hash only), your Telegram user id if you link Telegram, and whether your membership is switched off. A drawn character chosen before characters moved to the gallery (hair, skin and shirt) is still stored on it but is no longer shown or used.
• The game: chores, every completion (who did it, who logged it, when, from which screen, any note, confirmations and disputes), points, streaks, point adjustments, and the pot contributions (amount and who paid).
• The board: notes (title, text, colour, author) and reminders, with who has read each note and each reminder, and when.
• Proof photos you attach to a chore.
• Avatar images: the pixel characters an admin adds to the household's gallery (up to three poses each, cleaned, 48 to 64 pixels tall), who added each, and which one each member picked. The files as uploaded are not kept.
• The audit log: who changed what, when, from which screen, and a copy of what was entered: for example a note's text (also after the note is deleted), shopping items, a calendar event's title, times, place and description, and earlier display names. Passwords and PINs are never in it. Retried requests are remembered, with their result, so they do not run twice.
• Rate-limit counters: to slow down password guessing and abuse, short-lived counters keyed by IP address (and by member).
• AI usage counts: how many Baumy commands and voice clips each member used, with token counts and clip lengths. Not what you said.
• Kitchen screens: each paired iPad's name, who paired it, when it was last seen, and a hash of its device token.
• Connected chatbots: if you connect one (for example claude.ai), its name, what you allowed it to do, and hashes of its tokens.

• The database is Neon Postgres in Frankfurt (AWS eu-central-1), in the EU.
• The app runs on Vercel. Its server code runs in Frankfurt (fra1). Vercel's network in front of it, and its request logs (for example the IP address and page of each request, kept for a short time), are not tied to one region.
• Proof photos and avatar images are stored in Vercel Blob in Frankfurt (fra1). The store is private: an image is only shown through the app, to household members and the paired kitchen screen (avatar images also to a founder setting up the household, so they can pick one).
• Calendar events live in the house's Google Calendar; the app has no calendar of its own, but the audit log keeps what was entered when an event is added or changed through the app. The shopping list lives in baumy-brain (below).
• Some services below (Google, Anthropic, Groq, Resend) are US companies, so what they receive leaves the EU.

• Google sign-in: if you use it, Google tells us your name, email and picture, and Google knows you signed in here.
• Google Calendar: the house calendar is shared with a Google service account made for this house. Events you add or change (title, times, place, description) go to Google, tagged with your member id so the app can show your colour.
• Anthropic (Claude): when you ask Baumy something, Anthropic receives what you typed (or the transcript of what you said), the date and time, your member name, the housemates' names and the chores, and whatever the app looks up to answer (for example chores, scores, notes, calendar events, the shopping list or, when you ask what is kept about you, the counts, dates and names in that summary).
• Groq: when you hold the microphone, Groq receives the audio clip, with the housemates' and chores' names as a spelling hint, and sends back the text.
• Resend: sends the account emails (confirm your address, reset your password, password changed, a password or a passkey was added to your account). It receives your email address and that email.
• baumy-brain and Telegram: baumy-brain (brain.baumy.tech) is the house's Telegram bot, which the same owner runs. The shopping list belongs to it, so items you add or tick off here are sent to it. It can also read the chores, scores, notes, reminders, the calendar, the pot, claims waiting for confirmation and the chore weights, and may post them in the house's Telegram group. It runs messages through its own calls to Anthropic. If you link your Telegram account, we keep your Telegram user id, and the bot can do things in this app for you when you ask it, or for another housemate after a confirm button. Everything in Telegram also passes through Telegram. If Sign in with Baumy is switched on and you use it, the bot messages you the sign-in's device name (for example "Chrome on macOS") with the numbers to tap; the request (device name, the numbers and what you answered) is deleted by the daily clean-up once it is more than 24 hours old (so within two days), and a record that it was asked for, with the asking device's IP address, stays in the audit log. baumy-brain keeps its own copy of the device name and the numbers, in the pending sign-in card it sends and in its log. Confirming it's you from Telegram works the same way, for the device you are already signed in on.
• Chatbots you connect: a chatbot you connect (for example claude.ai) sees what its tools read for you, and can only change things if you allowed that when you connected it.
• Vercel and Neon host the app and the database, so they hold the data above on our behalf.

There are no ads, and nothing is sold or shared for marketing. The app has no analytics and no tracking scripts, loads no third-party scripts, and serves its fonts itself. The sign-in library's own telemetry is switched off.

Only cookies the app needs to work. None of them track you, so there is no cookie banner.

• baumy.session_token: keeps you signed in, for up to 30 days after you last used the app. On the live site its name starts with __Secure-.
• baumy.session_data: a signed copy of your session that saves a database read, for 5 minutes.
• baumy.last_login_method: how this browser last signed in (email, Google or passkey), so the sign-in page can say "Last used", for 30 days. Not a secret.
• baumy.two_factor: between your password and your two-factor code, for at most 10 minutes.
• baumy.trust_device: only if you tick "Trust this device"; it lets this browser skip the two-factor code for 30 days, renewed each time you sign in with it.
• baumy.passkey_challenge: the one-time challenge while you use or add a passkey, for 5 minutes.
• Short-lived helper cookies during a sign-in, for example the Google round trip.
• baumy_login_request: only while you sign in with Baumy from Telegram; it proves the approval is for this browser, and goes after 150 seconds (a request lasts 2 minutes). A session made that way is marked with baumy.dont_remember and ends when the browser closes, or after a day at most.
• baumy_kiosk_pairing: only on an iPad showing the code to become the kitchen screen; it proves an admin’s approval is for that iPad, and goes after 11 minutes or once it is paired. The server keeps that request, with the iPad’s browser name and its network (the first part of its address only, never the whole address), so the admin approving it is warned if they are on a different network. It is deleted after 24 hours.
• baumy_kiosk: only on a paired kitchen iPad; it signs the device in, for a year.
• baumy_kiosk_member: on the kitchen iPad, who tapped their avatar (a member id, never a PIN), for at most 20 minutes.
• baumy_kiosk_walk_in: on the kitchen iPad, the member who just tapped their avatar (a member id), so their character walks in once; the screen clears it straight away, and it lasts 60 seconds at most.
• baumy_refresh: set by the kitchen screen for 10 seconds so its refresh fetches a fresh shopping list.

The kitchen screen also stores its offline page in the browser, so it can say it is offline.

• Sessions end when you sign out, or 30 days after you last used the app on that device. When you sign a device out in Settings, Security, its session ends at once, but a page it already has open can keep working for up to 5 minutes. It cannot change your sign-in settings in that time: those check the session in the database each time. Signing devices out, or changing or resetting your password, also forgets every device you trusted for two-factor.
• Proof photos are deleted 90 days after their claim was settled.
• Avatar images are kept while the household has them; archiving one only takes it out of the gallery.
• Password-reset and confirmation links expire.
• Rate-limit counters are deleted automatically: the sign-in library clears its own after they expire, and the app's own go at the latest 7 days after their last use.
• Everything else stays while the household uses the app and is not deleted automatically, including the audit log. A deleted note is hidden everywhere but stays in the database.

• You can change your display name, colour and character yourself in Settings.
• Settings, Your data, shows a summary of what is kept about you, as counts, dates and names (never an IP address), with the rules above; Baumy tells you the same when you ask "what do you keep about me?" on your own phone or computer. Only you see it, never the kitchen screen.
• To leave, ask the admin. They can switch off your membership in the app straight away, which closes the hub to you.
• There is no delete-account button yet. On request, the owner deletes your sign-in account (email, password hash, Google link, passkeys, two-factor secret and backup codes, and sessions) directly in the database; the passkeys, two-factor and sessions go with the account. A trusted-device record expires by itself within 30 days.
• Your member entry stays, because the household's history points at it: your past chores stay in the season's score history (everyone's scores are rebuilt from it), and the audit log keeps its copies, including your earlier names. The admin can rename the entry, change its colour and avatar, and unlink your Telegram account in the app; your PIN hash, your gallery pick and any old drawn character stay on it unless the owner clears them in the database.
• For a copy of what we hold about you, or anything else removed, ask the owner. They will tell you honestly what can be done.

Talk to the owner, in the house or in the house's Telegram group. If this page changes, its date changes and the house hears about it. See also the terms.