1. Who we are
Baro is a service operated by muraddah ("muraddah", "we", "us", "our"), trading as Baro. This Privacy Notice explains what personal data we collect, why we collect it, how we use and share it, and your rights.
2. Controller
muraddah is the data controller responsible for the personal data described in this notice. Contact us at support@baro.app for any privacy questions or to exercise your rights.
3. Personal data we collect
- Account data: email address, display name, password hash, and (if you use Google or Apple sign-in) the basic profile information those providers share with us.
- Learning progress: XP, daily streak, English level, completed lessons, quiz results, and Baro Pro subscription status.
- Support and communications: messages you send to us and any AI tutor conversations.
- Device and technical data: standard server logs including IP address, browser type, device identifiers, and timestamps used to keep the service secure and reliable.
- Microphone audio (optional): when you use Pronunciation Coach, audio is processed in your browser using the Web Speech API. We do not store recordings.
- Order and billing data: handled by Paddle (see §5). We receive limited order metadata (subscription status, plan, renewal date) — we never receive or store full card numbers.
4. Purposes and legal bases
- Provide the service (create your account, save progress, sync across devices) — legal basis: performance of a contract.
- Personalize lessons to your English level — legal basis: performance of a contract.
- AI tutoring — your messages are sent to AI providers to generate replies — legal basis: performance of a contract.
- Process payments for Baro Pro — legal basis: performance of a contract and legal obligation (tax/invoicing).
- Service security, fraud prevention, and abuse detection — legal basis: legitimate interests in keeping Baro safe.
- Product improvement and analytics — legal basis: legitimate interests.
- Customer support — legal basis: legitimate interests and performance of a contract.
- Marketing emails (only if you opt in) — legal basis: consent, which you can withdraw at any time.
5. Who we share data with
We do not sell your personal data. We share data only with the following categories of recipients, under contracts that require them to protect it:
- Paddle.com Market Limited ("Paddle") — our Merchant of Record. Paddle handles checkout, billing, payment processing, sales-tax compliance, invoicing, refunds, and subscription management. When you purchase Baro Pro, Paddle receives your name, email, billing address, payment details, and order metadata. See Paddle's privacy notice.
- Hosting and infrastructure providers — to run our servers and database.
- Authentication providers (Google, Apple) — only if you choose to sign in with them.
- AI providers — to generate AI tutoring responses from your prompts.
- Email and push notification providers — to deliver service and reminder messages.
- Professional advisers (legal, accounting) and authorities where required by law.
6. International transfers
Some of our service providers (including Paddle) may process data outside your country of residence, including in the United States and the United Kingdom. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
7. Data retention
We keep your account and progress data while your account is active. You can delete your account at any time from the Profile screen or via our Delete Account page, after which we delete or anonymise your personal data within 30 days, except where law requires us to retain it (for example, payment records that Paddle and we must keep for tax purposes).
8. Your rights
Subject to applicable law, you have the right to: access your data, correct inaccurate data, request deletion, restrict or object to processing, request portability, and withdraw consent at any time. You also have the right to lodge a complaint with your local data-protection supervisory authority. Email support@baro.app to exercise these rights — we respond within one month.
9. Children
Baro is not directed to children under 13. If we learn we have collected data from a child under 13 without parental consent, we will delete it.
10. Security
We use encryption in transit (HTTPS), access controls, and other appropriate technical and organisational measures. No system is 100% secure, but we work hard to protect your information.
11. Cookies
We use essential cookies and local storage to keep you signed in and remember your preferences. We do not use third-party advertising cookies.
12. Changes
We may update this policy. Material changes will be announced in the app.
13. Contact
Questions? Email support@baro.app. Controller: muraddah, trading as Baro.