Is Baron App, Inc. covered by California DROP?
Yes — in DROP scope. Baron App, Inc. is listed on the 2026 California Data Broker Registry. Registered data brokers must process deletion requests submitted through DROP, starting August 1, 2026.
Unverified: we have not confirmed this broker in DROP's own in-app broker list (that list is only visible inside DROP). Registry data last modified July 29, 2026.
The broker answered “No” (or did not answer) for regulation under FCRA, GLBA, IIPPA, CMIA and HIPAA. Other exemptions (for example publicly available information or data you gave the business directly) can still apply.
Registration information
| Registered name | Baron App, Inc. |
|---|---|
| Doing business as | — |
| Website | candl.app cameo.com |
| Privacy rights / deletion page | https://legal.cameo.com/privacypolicy |
| Contact email (as registered) | safety@cameo.com |
| Phone (as registered) | 855-770-1024 |
| Address (as registered) | 320 North Elizabeth Street, First and Second Floors, Chicago, IL, 60607, UNITED STATES |
| Registry years found |
Earlier years are matched to previous CPPA/DOJ registry files by name or website and may miss renamed companies. |
Data categories it reports collecting
The registry asks every broker Yes/No questions about these specific categories. It does not list everything a broker collects.
| Personal information of minors | No |
|---|---|
| Account logins / account numbers with security codes | No |
| Government-issued ID numbers | No |
| Citizenship / immigration status | No |
| Union membership status | No |
| Sexual orientation | No |
| Gender identity / expression | No |
| Biometric data | No |
| Precise geolocation | No |
| Reproductive health care data | No |
Who it says it sold or shared data with (past year)
| A foreign actor | No |
|---|---|
| The federal government | No |
| Other state governments | No |
| Law enforcement (except when required by subpoena or court order) | No |
| A developer of a generative AI system or model | No |
Regulation under other privacy laws
| Fair Credit Reporting Act (FCRA) | No |
|---|---|
| Gramm-Leach-Bliley Act (GLBA) | No |
| California Insurance Information and Privacy Protection Act (IIPPA) | No |
| California Confidentiality of Medical Information Act (CMIA) | No |
| HIPAA (HIPAA) | No |
Consumer request metrics it reported
Shown exactly as reported. Column labels are the CPPA's; they reference 2024 even though the CPPA page describes this registry as covering 2025 activity.
| Requests to delete - Total requests received | 0 |
|---|---|
| Requests to delete - Total requests received - Complied in whole | 0 |
| Requests to delete - Total requests received - Complied in part | 0 |
| Requests to delete - Total requests received - Denied | 0 |
| Requests to delete - The number of days to respond substantively to a request to delete in 2024 - Mean | 0 |
| Requests to delete - The number of days to respond substantively to a request to delete in 2024 - Median | 0 |
| Requests to know what personal information is being collected - Total requests received | 0 |
| Requests to know what personal information is being collected - Total requests received - Complied in whole | 0 |
| Requests to know what personal information is being collected - Total requests received - Complied in part | 0 |
| Requests to know what personal information is being collected - Total requests received - Denied | 0 |
| Requests to know what personal information is being collected - The number of days to respond substantively to a request to know in 2024 - Mean | 0 |
| Requests to know what personal information is being collected - The number of days to respond substantively to a request to know in 2024 - Median | 0 |
| Requests to know what personal information is sold or shared - Total requests received | 0 |
| Requests to know what personal information is sold or shared - Total requests received - Complied in whole | 0 |
| Requests to know what personal information is sold or shared - Total requests received - Complied in part | 0 |
| Requests to know what personal information is sold or shared - Total requests received - Denied | 0 |
| Requests to know what personal information is sold or shared - The number of days to respond substantively to a request to know what personal information is sold or shared in 2024 - Mean | 0 |
| Requests to know what personal information is sold or shared - The number of days to respond substantively to a request to know what personal information is sold or shared in 2024 - Median | 0 |
| Requests to opt out of sale or sharing - Total requests received | 0 |
| Requests to opt out of sale or sharing - Total requests received - Complied in whole | 0 |
| Requests to opt out of sale or sharing - Total requests received - Complied in part | 0 |
| Requests to opt out of sale or sharing - Total requests received - Denied | 0 |
| Requests to opt out of sale or sharing - The number of days to respond substantively to a request to know in 2024 - Mean | 0 |
| Requests to opt out of sale or sharing - The number of days to respond substantively to a request to know in 2024 - Median | 0 |
| Requests to limit the use and disclosure of sensitive personal information - Total requests received | 0 |
| Requests to limit the use and disclosure of sensitive personal information - Total requests received - Complied in whole | 0 |
| Requests to limit the use and disclosure of sensitive personal information - Total requests received - Complied in part | 0 |
| Requests to limit the use and disclosure of sensitive personal information - Total requests received - Denied | 0 |
| Requests to limit the use and disclosure of sensitive personal information - The number of days to respond substantively to a request to know in 2024 - Mean | 0 |
| Requests to limit the use and disclosure of sensitive personal information - The number of days to respond substantively to a request to know in 2024 - Median | 0 |
Additional comments from the broker
Candl is a birthday reminder app to help individuals keep track of their contacts’ birthdays. When a user signs up for Candl, they must provide their phone number and birth day and month. They can also grant Candl access to contacts in their address book; if they do, Candl will store the phone number(s) and birth day and month, if any, associated with each of those contacts. When a user gives the app access to contact information in their address book, if that user has the Birthday Network feature enabled, Candl stores and periodically syncs from that address book each contact’s day and month (but not year) of birth in its Birthday Network in association with the contact’s phone number; the app does the same for the user’s own birth day and month. If another Candl user has the Birthday Network feature enabled and gives Candl access to the same contact without an associated birthday, Candl will share the prevailing birthday from the Birthday Network with that other Candl user. Because Candl is designed to collect only limited personal data, Baron App has little insight into the contacts included in the Birthday Network or the app users accessing that data, and does not independently verify the identity of app users beyond validating that they can receive text messages at the phone number they use to sign up for the app. Users of the app must represent and warrant that they will not use Candl, and will not assist or encourage any third party to use Candl, to access or attempt to access any information (including birthdays and phone numbers) associated with any individual they do not personally know, and that they will not use Candl, and will not assist or encourage any third party to use Candl, to extract, export, withdraw, or otherwise remove any information from the Candl app or attempt to do any of the foregoing.
Sources
- California Data Broker Registry (CPPA) — registry CSV, last modified July 29, 2026, retrieved October 17, 2026
- How DROP works (privacy.ca.gov)