← back

Privacy Policy

Last updated: August 4, 2026

baba.gg UG ("baba", "we", "us") operates the baba mobile application and the website baba.gg. This Privacy Policy explains how we collect, use, and protect your personal data when you use our services.

1. Controller

baba.gg UG
Parkaue 34, 10367 Berlin
Germany
Email: hello@baba.gg

2. Data We Collect

Category	Data	Purpose	Legal Basis (GDPR)
Account	Phone number, display name, profile picture, bio, favourite sports, languages, home base	Account creation, SMS verification, identification, and personalisation	Art. 6(1)(b) — contract performance
Location (foreground)	GPS coordinates (when app is in use)	Show nearby sports locations, enable check-ins, calculate distances	Art. 6(1)(a) — consent
Location (background, optional, iOS only)	Region monitoring around lobby venues you have joined, active only within ~2 hours of lobby start time. Not collected on Android — Android uses foreground location only.	Automatically check you in when you arrive at a lobby you've joined	Art. 6(1)(a) — explicit opt-in consent
Usage & Analytics	Feature interactions, screen views, anonymized event data	Product improvement and understanding how features are used	Art. 6(1)(f) — legitimate interest
Device	Device type, OS version, push notification token	Push notifications and app compatibility	Art. 6(1)(a) — consent (notifications); Art. 6(1)(b) — contract (compatibility)
Social	Friend connections, lobby participation, group membership, lobby chat messages	Core app functionality (finding and playing with friends), and showing you at the venue of a lobby you have joined	Art. 6(1)(b) — contract performance
Player awards	MVP votes cast after eligible lobbies, final award winners, lifetime Best Player / Nicest Player totals	Let players vote on post-game awards and display lifetime award counts on profiles	Art. 6(1)(b) — contract performance
Activity	Online status (last-active timestamp), notification preferences (quiet hours, per-type settings)	Show online friends, respect notification preferences	Art. 6(1)(b) — contract performance

3. Third-Party Services

We use the following third-party services to operate baba. Your data may be processed by these providers:

Service	Provider	Purpose	Data Region
AWS (Cognito, SNS, DynamoDB, S3, CloudFront, EventBridge, Pinpoint)	Amazon Web Services EMEA SARL	Authentication, SMS verification codes, database, file storage, scheduling, push notifications	EU (eu-central-1, Frankfurt)
PostHog	PostHog Inc.	Product analytics	EU (eu.posthog.com)
Google Maps	Google LLC	Map display, directions	Global (US-based, EU SCCs apply)
Amazon Location Service	Amazon Web Services EMEA SARL	Address search & reverse geocoding (see section 4)	EU (eu-central-1, Frankfurt)
Apple Push Notification service (APNs)	Apple Inc.	Push notifications on iOS	Global
Firebase Cloud Messaging (FCM)	Google LLC	Push notifications on Android	Global (US-based, EU SCCs apply)
Expo	650 Industries Inc.	App updates and build services	US (EU SCCs apply)

For US-based providers, data transfers are safeguarded by EU Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework where applicable.

4. Location Data

Foreground location. baba uses your device location while the app is actively in use to show nearby sports locations, calculate distances, and let you check in manually. Foreground location access is optional — you can deny or revoke permission at any time in your device settings. Without it, some features (check-in, nearby locations) will be limited.

What others can see. When you join or check in to a lobby at a venue, baba shows other users that you are there. baba never shows your live position: what is shared is the venue of the lobby you have joined, not where you actually are. Two different surfaces show it, with different audiences:

• On the map, your profile picture and name at a venue are shown only to people you are friends with on baba. Everyone else sees an anonymous participant count for that venue, and not your identity.
• In the lobby itself, your profile picture and name appear in its participant list, which is visible to anyone who can open that lobby — including people you are not friends with.

You stop being shown once you leave the lobby or once the lobby ends, and check-ins expire automatically two hours after you check in.

Address search and geocoding. Location search and the custom map pin are powered by Amazon Location Service (see section 3), which resolves text and coordinates into addresses. What is sent to it: the text you type in location search, together with the map position used to bias results towards the area you are looking at; the coordinates of a custom map pin you drop; and, if you tap "use my location", your current position, so that it can be shown to you as an address. When you create a lobby at a custom pin, our servers look up that pin's address and store the resulting street and city alongside the lobby; a city you choose in city search is stored on your device. Other lookups are only used to show you an address at the time you ask for it.

Background location (used by Auto check-in on iOS only — optional, opt-in). If you explicitly enable the optional "Auto check-in" feature, baba will check you in automatically when it detects that you have arrived at a venue of a lobby you have joined. On iOS, this is done via OS-level geofences registered around those venues, so the operating system can wake the app and check you in when you physically arrive; on Android, it relies on foreground (in-app) location only, and no background location is collected. Auto check-in:

• is off by default on both platforms and must be explicitly enabled by you in Settings or when prompted;
• only monitors venues of lobbies where you are an accepted participant, and only within approximately two hours of the lobby start time;
• on iOS, uses OS-managed region monitoring, not continuous GPS polling, to minimise battery impact;
• records a consent event on our servers, on both platforms, at the moment you enable or disable it (auditable under GDPR);
• can be revoked at any time from the in-app notification settings or your device's location settings; revoking on iOS immediately clears all registered geofences.

Background location coordinates collected on iOS are never stored beyond the single check-in event they trigger.

5. Push Notifications

We send push notifications to inform you about friend activity, lobby invitations, and check-ins. You can opt out at any time via your device settings or within the app's notification preferences.

6. Analytics

We use PostHog (EU cloud) for product analytics. Analytics are disabled in development builds. We do not send your name, email address, or phone number as event properties.

The events we collect include:

• Feature usage events (e.g. "lobby created", "check-in completed", "friend request sent") with non-identifying properties such as sport type, lobby ID, or visibility.
• Screen views — when you navigate between screens (e.g. Home, Map, Profile), we record the screen name. This lets us measure session duration and feature adoption.
• Account identifier — once you sign in, PostHog associates events with your internal baba user ID (a pseudonymous UUID), not your name or email. This lets us calculate metrics like weekly active users and feature retention without storing personal data in analytics.
• Invite conversion — when you sign up via an invitation link, your sign-up event includes a has_inviter flag (true/false) and the invite code, so we can measure aggregate invite conversion. The inviter's identity is not included as an event property.

You can opt out of analytics at any time via the Privacy settings in the app. Opting out stops all event collection from your device, including the items above.

7. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Location check-ins: Automatically expire after 2 hours.
• Lobby chat messages: Retained for the lifetime of the lobby and deleted when the lobby expires.
• Player awards votes: Retained for up to 30 days after the voting window closes, then automatically deleted. Lifetime award totals remain on active profiles until account deletion.
• Online status: Retained for 10 minutes, then considered stale.
• Analytics data: Retained for up to 12 months, then anonymized or deleted.
• Waitlist emails (collected via the pre-launch website form, which is no longer offered): Retained until you request removal.
• Profile pictures: Deleted within 30 days of account deletion.

8. Your Rights (GDPR)

As a user in the EU, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time (Art. 7(3))
• Lodge a complaint with a supervisory authority (Art. 77) — for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit

You can exercise your right to access, portability, and erasure directly in the app via Privacy settings (data export and account deletion). For all other requests, contact us at hello@baba.gg.

9. Age Requirement

baba is intended for users aged 17 and above. We do not knowingly collect data from anyone under 17. If you believe someone under 17 has provided us with personal data, please contact us and we will delete it promptly.

10. Push Notification Preferences

You can configure notification preferences within the app, including quiet hours (with timezone) and per-type toggles (e.g. friend requests, lobby updates, check-ins). These preferences are stored on our servers so they persist across devices.

11. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest (AWS managed keys), and access controls. Authentication is handled by AWS Cognito with industry-standard protocols.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or email. The "last updated" date at the top reflects the most recent revision.

13. Contact

baba.gg UG
Parkaue 34, 10367 Berlin
Germany
Email: hello@baba.gg