Launch transparency. This policy describes only the processing currently enabled in the first public version of the service. A future feature will be covered only once it is enabled and described here.
1. Scope
This policy applies to BAOApp — Plus qu'un trajet, including the BAO Moov application and the product surfaces on baoapp.africa. It does not apply to BAO Technologies’ separate corporate website. Essential browsing features remain available in guest mode without creating an account.
2. Data controller
The current activity is carried out under the responsibility of Yabyoure Philippe OUEDRAOGO. BAO Technologies is a single-member limited liability company formed in Burkina Faso and not yet registered with the RCCM. No RCCM or IFU number is stated until it has been officially assigned.
3. Optional BAO ID and authentication
A BAO ID account is optional. When it is created or accessed, BAO processes either an email address or a phone number, the associated one-time sign-in code, a technical account identifier and the information required for the session. The profile may include a display name and selected preferences. BAO does not request a traditional password. At launch, email and phone accounts are not linked, merged or transferred: using a different identifier may create or retrieve a separate account.
4. Favourites, history and data stored on the device
For a signed-in user, favourites or bookmarks may include a label, a custom name and coordinates. Synced history may include origin and destination names and coordinates, journey type, duration and an estimated fare. The app also stores some useful items locally: recent searches for 72 hours, saved trips, route caches and reminders scheduled on the device. Saved trips are kept in separate local spaces for the guest and for each technical account identifier. Legacy global data with no identified owner is quarantined out of display and assigned to neither the guest nor the next account. Reminders are associated with their local owner; at bootstrap and on identity changes, inherited reminders with no owner or reminders belonging to the space being left are sanitised or cancelled. On the Web, account-specific responses are not reused from cache for another account. In these local flows, no content from the guest space is migrated to BAO ID.
5. Location, routes and maps
With device permission, precise location may be used in the foreground to detect a city, show the current position or calculate a route. BAO does not request background location tracking at launch and does not record continuous GPS traces on its servers. To calculate a route, origin and destination coordinates, travel mode and, when needed, planned time pass through a Supabase function to Mapbox; the BAO account identifier is not sent to Mapbox. Native maps use Apple MapKit on iOS and Google Maps on Android. In the verified Final mobile RC, the application may contact the public Project OSRM service only to calculate selected public bus-line geometries from stop coordinates; this flow sends neither the user’s GPS position nor their account identifier. The public web surfaces on baoapp.africa load no interactive map and contact neither OpenStreetMap tile servers nor Project OSRM.
6. Community contributions and moderation
A community contribution requires a BAO ID and acceptance of the applicable terms version, currently UGC-2026-08-18. BAO processes the structured report content, its precise location and line or stop context, together with associated confirmations, denials, abuse reports, blocks and moderation decisions. The report location is visible in the service; the link between the contribution and its author’s account remains private. The applicable rules are set out in the terms of use.
7. Analytics, diagnostics and advertising
At launch, BAO enables no product analytics, no BAO-operated remote diagnostics or crash collection, and no BAO advertising or tracking. On Android, however, the Google Maps SDK may automatically process, as part of Google’s documented service operation, technical data including request and device metadata, IP address, a Maps SDK pseudonymous identifier, crash metrics and, when those interactions occur, map interaction events such as pan or zoom. This SDK processing is neither BAO product analytics nor a BAO advertising or tracking path. The public pages on baoapp.africa enable no audience measurement tool or advertising cookie; only a language preference may be kept in the browser’s local storage. BAO does not sell personal data. Historical technical telemetry surfaces are closed, and their data is not used as traction evidence, a commercial KPI or for a commercial offering.
8. Protection against technical abuse
The app creates a random installation identifier stored locally and sent to the Supabase route function solely to rate-limit abusive requests. In the current flow, this identifier is not stored in the BAO database, logged by that function or sent to Mapbox.
9. Service providers
BAO uses Supabase for authentication, the database and server functions; Resend to deliver email sign-in codes and Twilio to deliver SMS sign-in codes through Supabase Auth; Mapbox for some route calculations; Apple MapKit and Google Maps for native maps; Project OSRM only for selected public line geometries in the native application; and Vercel to host baoapp.africa. Public Product Site pages contact neither OpenStreetMap tile servers nor Project OSRM. Voluntarily opening a Google Maps link sends the request to Google. These providers may receive the technical data strictly necessary to deliver their service, including the IP address and standard request information.
10. Processing locations
The currently verified region of the Supabase database project is eu-west-1, in Ireland. This does not mean that all Supabase services or all other providers process data only in Ireland or the European Union. Depending on the service used and its infrastructure, processing may take place outside Burkina Faso. BAO does not state a single processing location until each provider’s terms and configuration have been confirmed.
11. Retention
BAO keeps data for as long as necessary to provide the service, maintain security, handle requests and meet its obligations, without applying one period to every category. Local recent searches expire after 72 hours. Local route caches vary by mode, from a few minutes to seven days. Favourites, synced history and the profile remain linked to the account until they or the account are deleted. A report may cease to be visible without immediately erasing items needed for moderation, security or administrative integrity. Where necessary, some administrative references are retained in detached or anonymised form.
12. Account deletion
Account deletion removes the authentication account, profile, favourites or bookmarks, synced history, subscriptions and private links to contributions. Contributions and administrative references may be deleted or detached where retention is necessary for security, moderation or administrative integrity. The public Delete an account resource lets you send a request to contact@baoapp.africa. BAO may request limited verification; never send a password or OTP code. Data stored only on the device, such as some reminders, caches or saved trips, may need to be removed separately from the app or device settings.
13. Your rights and contact
You can request access, correction, deletion or, where applicable, exercise another right concerning your data by writing to contact@baoapp.africa, preferably from the address linked to the account or by including the associated phone number. BAO may perform limited verification of the requester’s identity. Portability is provided where the applicable conditions are met.
14. Security and changes
BAO applies access controls, separates private identities from public content where possible and limits the data sent to each provider. No system can guarantee absolute security. This policy will be updated before a new or materially changed processing activity is enabled; the date at the top identifies the applicable public version.
