How BaeMax handles your data.

Your primary app record is saved on your device. BaeMax does not maintain a readable central profile of your check-ins, cycle logs, tasks, or chats. Encrypted copies of data you share can be held by the relay for delivery to your partner.

On Android, BaeMax protects its main app-state records and private-chat history with authenticated encryption derived from a root key kept in device secure storage. Private-chat database records are migrated and verified before older plaintext columns and database free pages are purged. Generated thumbnails and lightbox previews are kept in memory instead of being persisted as readable JPEG previews. When you explicitly open an encrypted attachment, BaeMax may create a temporary decrypted file for the receiving Android app and clears its private temporary-open area on startup and background transitions.

• Mood & check-insBody and mood check-ins you choose to log. Selected fields are sent as encrypted payloads only when partner sharing is enabled.
• Cycle & period dataStart dates, period length, symptoms, flow, and daily logs. Stored on your phone unless you choose to share.
• Sleep & hydrationRecorded on your phone and included in encrypted partner updates only when the related sharing control is enabled.
• Tasks & care messagesShared to-dos and partner notes sync only through encrypted channels.
• SettingsMost preferences stay on device. Notification mute, detail, and quiet-hour preferences are also sent to the relay so it can apply them before sending a push.

Our server handles the delivery of messages, similar to how a postal service knows a letter was sent, when it was mailed, how big the envelope is, and where it's going — but cannot open the letter and read it.

When you enable notifications, BaeMax sends alert data through the Expo push service and Google Firebase Cloud Messaging on Android. This notification path is separate from end-to-end encrypted partner sync. Those providers process the push token, delivery metadata, and the notification text needed to deliver the alert.

Your cycle data is recorded on your phone. If you enable partner sharing, selected cycle details are included in encrypted partner-sync payloads; the relay cannot read those details. BaeMax provides estimates and summaries, not a diagnosis, contraceptive method, emergency service, or substitute for professional medical care.

When you pair with someone, BaeMax gives you a pairing code, QR code, or shareable link. This contains the shared secret your phones need to set up the private connection.

Android asks for permission when a feature needs protected device access. You can deny optional permissions, although the related feature will not work. BaeMax does not request contacts access.

• CameraUsed to scan pairing QR codes and capture an image when you choose a camera-based feature.
• Photos and videosUsed through the system picker when you choose media to send.
• MicrophoneUsed only while you record a voice message. Voice-message content is encrypted before relay upload.
• LocationUsed when you choose to attach a location or start live location sharing. Background location is used only while live sharing is active, with an Android foreground-service notification.
• ClipboardUsed only when you copy a pairing code or your user ID. Your phone's clipboard is managed by your operating system.
• NotificationsUsed for partner updates and reminders. You choose whether to enable them.
• BiometricsUsed for app lock. We never receive your fingerprint or face data.

BaeMax does not include advertising networks or a general-purpose analytics SDK. It uses service providers for push delivery, Android app distribution, optional maps, and beta email. BaeMax does not request contacts access and does not currently include Sentry or another remote crash-reporting SDK.

• Expo and Google Firebase Cloud MessagingProcess push tokens, delivery metadata, and notification text to deliver Android alerts.
• Google PlayDistributes the Android app and processes installation, update, security, and device information under Google's terms.
• Google MapsProvides map display for location features and can receive network/device information and the map area requested by the app.
• Your phone's OSHandles local and secure storage, camera, microphone, location, notifications, media picking, and biometric authentication.
• Our relay serverPasses encrypted messages between paired phones without reading them.
• ResendProcesses beta-waitlist email addresses, message content, and delivery details so we can send signup confirmations and notify the BaeMax owner about new signups.
• BrevoMay process the same beta-waitlist email and delivery details as a backup transactional-email provider if the primary email provider is unavailable.
• Apps you share toThrough your phone's share menu — those apps follow their own privacy rules.
• Image hostingIf you set a profile picture using a web link, your phone connects to the host directly. Our server does not see, store, or pass along your profile photo.

If you explicitly agree and sign up for the beta on our website, we store your email address, signup and consent times, privacy-notice version, an internal random ID, one-way confirmation and cancellation-token hashes, confirmation status, email-delivery status, and server-side request metadata such as IP address, an IP hash, masked IP, trusted proxy chain, browser family, and bounded user-agent text. This request metadata is used for abuse prevention and operational review, is not returned by the public signup form, and raw IP/browser details are not exposed in public website scripts. Resend processes the address and delivery details to send the confirmation; Brevo may process the same details as a fallback provider. You can confirm your signup from that email, remove your address with the cancellation link in that email, or email [email protected] from the address you joined with. After removal, we keep only daily signup and cancellation totals with no email address or other identifier.