Privacy Policy
Last updated 14 October 2026
Baik is a dua card deck at baikapp.com, operated by Methodas Tech ("we", "us"). This policy explains what we collect, why, and what you can ask us to do about it. It is written to meet Malaysia's Personal Data Protection Act 2010 (PDPA).
You can use Baik without an account
The deck, the daily dua, the finder and the situation shortcuts all work without signing in. If you never make an account, we never learn your name or your email address. What you save stays in your own browser.
What we collect, and why
| What | Why |
|---|---|
| Your name | To address you in the app and on your receipt. |
| Your email address | It is your sign-in. We send the confirmation link, password resets, and payment receipts to it. |
| Your password | Stored only as a scrypt hash with a random salt. We cannot read it, and neither can anyone who obtains the database. |
| Your saved duas, notes and recents | So they follow you between devices when you are signed in. |
| Your plan and payment records | To know whether Premium is open on your account, and to answer questions about an order. |
| Your phone number | Only when you pay. ToyyibPay requires it for the receipt. We pass it on and keep it with the order. |
We never see your card or banking details. Payment happens on ToyyibPay's own pages. Baik receives only the result: whether an order was paid, for how much, and a reference number.
What we do not do
- We do not sell or rent your personal data to anyone.
- We do not run advertising, and we do not use advertising or analytics trackers.
- We do not build a profile of you, and we do not read what you search for in the deck.
Cookies
Baik sets one cookie, baik_session, after you sign in. It holds a signed token that says which account you are, nothing else. It is HttpOnly and Secure, so it cannot be read by scripts in your browser, and it expires after 30 days. Signing out removes it.
Your browser also keeps some choices on your own device — your view, your text size, unsent notes. That never reaches us.
Where your data is kept
Baik runs on Microsoft Azure. Accounts and orders are stored in Azure Table Storage in the Southeast Asia region (Singapore). Email is sent through Azure Communication Services with data held in the Asia Pacific region. We chose these so your data stays in the region rather than crossing to Europe or the United States.
Who else handles your data
| Who | What they receive |
|---|---|
| Microsoft Azure | Hosting and storage for everything above. |
| ToyyibPay | Your name, email and phone number when you pay, so they can take the payment and issue a receipt. |
| Google Fonts | Your browser requests the typefaces from Google's servers, which means Google sees that request. No account data is involved. |
How long we keep it
- Your account — until you ask us to delete it.
- Payment records — kept after deletion of the account where Malaysian tax and accounting law requires it, currently seven years. These records are kept apart and are not used for anything else.
- Unconfirmed sign-ups — an account whose email is never confirmed is removed.
Your rights under the PDPA
You may ask us to show you what we hold about you, correct anything wrong, delete your account and its data, or stop processing it. Write to the address below and we will answer within 21 days. We may ask you to confirm you control the email address before we act, so that nobody else can make the request on your behalf.
Children
Baik is not aimed at children under 13, and we do not knowingly open accounts for them. If you believe a child has made an account, write to us and we will remove it.
If something goes wrong
If a breach puts your personal data at real risk, we will tell affected users by email, describing what happened and what to do about it, without waiting to be asked.
Changes
If this policy changes in a way that affects you, we will say so in the app before the change takes effect. The date at the top always shows the current version.
Contact
Questions, or any request about your data: methodastech@gmail.com.
You may also complain to the Personal Data Protection Commissioner of Malaysia.