Privacy Policy

The short version

Orange Baton is a service with an account and a server. The jobs, stages, batons and notes your organization enters are stored on our servers so that everyone in the organization sees the same thing and the next person can be notified. We collect what running that needs, described below, and nothing for advertising. We do not sell data.

Who we are

Orange Baton is made by Daisuke Adachi, Japan (the “service provider”). This policy covers the Orange Baton iPhone app, its servers, and this website.

What we collect

Account: your name, email address and a password (stored hashed), the language you use, and whether you accepted the terms.

What you enter: organizations, their members, jobs (site, job, customer, memo), stages, workflow templates, batons and their notes and due dates, and the history of who passed what to whom. This is your organization’s business data; we process it only to provide the service.

Device and notifications: a push notification token for each device you sign in on, so that the next person can be notified, and the device’s platform, app version and language.

Server logs: the IP address, time and endpoint of requests to our servers, kept for a short time to run and secure the service.

Crash and error diagnostics: when the app or the servers hit an error, we may receive a technical report with the error, the device model, operating system and app version, and your account’s internal ID. These reports do not include your name, email address, password or the contents of your jobs.

What we do not collect

No location, no contacts, no photos, no advertising identifiers, and no analytics SDK in the app. The app does not read anything on your phone outside what you type into it.

How we use it

To create and manage your account and organizations; to show every member of an organization the same jobs; to send one notification when a baton is passed to you; to send the invitation email when you invite someone; to answer support requests; to find and fix errors; and to protect the service from abuse.

Who else is involved

Apple: the App Store distributes the app and handles the Team subscription under your Apple Account; we never see your payment details. Apple Push Notification service delivers the notifications.

RevenueCat: tells the app whether the Team plan is active. It receives the App Store receipt and an anonymous identifier for the installation, not your name or email.

Hetzner: hosts our servers and database, in Germany.

Cloudflare: relays traffic between the app and our servers and protects them from abuse.

Sentry: receives the crash and error diagnostics described above, if enabled.

Vercel: hosts this website and counts page visits in aggregate (Vercel Analytics). It sets no advertising cookies and does not track you across sites.

Where the data is

Our servers and database run in Hetzner Online GmbH's data centers in Germany. Wherever you use the service from, including Japan, your data is stored in Germany, where the EU General Data Protection Regulation applies. Traffic to our servers is encrypted, and they accept no connection that does not come through Cloudflare. Where personal data leaves your region through our other providers, we rely on the safeguards they offer, such as standard contractual clauses.

How long we keep it

For as long as your account exists. You can delete your account in the app (Settings, Profile, Delete My Account). That removes your personal data from our servers. An organization you own is deleted with its jobs; in organizations you joined as a member, the batons you held go to the owner and your name is removed from the history. Backups and logs are rotated within a limited time.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Most of this you can do in the app; for the rest, email us at the address below.

Security

Traffic between the app and the servers is encrypted. Passwords are stored hashed. No method of transmission or storage is completely secure, so keep your password to yourself and sign out of devices you no longer use.

Children

Orange Baton is a tool for work and is not directed at children under 13. We do not knowingly collect their data; if you believe we have, contact us.

Changes

If this policy changes, the new text goes up here and the date at the top changes with it.

Contact

Questions about this policy: support@orangebaton.com