Privacy Policy

The short version

• There is no sign-up. Baddi never asks for your name, your email, your birthday, or a password to work.
• Your Pal, your credits and your progress live on your phone first. The app works with no network at all.
• There is no advertising SDK and no third-party analytics in Baddi. Nobody is building a profile of you from this app. Since version 0.1.18 the app can send us crash reports and a few gameplay counts with no account or device ID attached, and you can switch that off in the app. See Diagnostics below.
• The only things that leave your device are the save file that backs up your Pal, a one-line record of finished arena matches, a deliberately rounded location — and only while you are actively searching — the diagnostics above unless you turn them off, and a bot-check token that carries nothing about you. All of it is set out in full below.
• Since version 0.3, your Baddi also has a profile other players can see: friends see its name, look, level and room, and everyone else sees only its look, under a handle made from its form, on the weekly boards and when they fight it as a ghost. Nothing about you is on it. See Friends, boards and ghosts below.

What stays on your phone

Almost everything. Baddi keeps three kinds of thing in your device's own storage, and none of it leaves unless the cloud backup described below is switched on:

• Your Pal — its name, colours, shape, personality, which elements it belongs to, which moves it knows, and its four care meters (Food, Clean, Joy, Energy).
• Your wallet — credits you have earned, and the cosmetics you have unlocked or bought.
• Your progress — arena wins and losses, your login streak, and today's missions.

Deleting the app deletes all of it. No copy is left on your phone.

What reaches our servers

Baddi keeps a backup of your Pal so that a lost or replaced phone does not mean a lost pet. To do that without a login screen, the app creates an anonymous account the first time it runs — a random identifier with no name attached to it. That identifier is the only handle we hold for you.

Against that identifier we store:

• Your Pal save file. Its name, colours, shape, personality, elements, the moves it knows and has equipped, what it is wearing, its four care meters (Food, Clean, Joy, Energy), how much XP it has earned, your running step total, and the last time you opened the app. This is what lets your Pal come back to you on a new phone. Your credit balance and your arena record are not part of it.
• A line per finished arena match. Who won, and both players' Pal name, level, shape and elements. Nothing about the person behind either Pal, and nothing said during the match.
• Your purchased credit balance, if you have ever bought credits. This one is deliberately kept on our side — see Purchases below for why that is good for you.

Every one of these rows is locked to your account at the database level. Another player's app cannot read your save, your matches or your balance, and neither can anyone who is not you. The one thing other players can see is your Baddi's profile, described next.

Friends, boards and ghosts

From version 0.3, Baddi has friends, weekly leaderboards and ghost battles. For those to work, every account with a cloud backup also has a small profile, made automatically. It holds:

• Your Baddi's name and look: its form, colours, eyes, wearables, title and room furniture, its level, how many forms it has found, and the moves it has equipped. No care meters, no credits, and nothing about you.
• A friend code: eight random letters and numbers that someone needs to add you as a friend.
• When you last played, to the minute, which your friends see as “3 h ago”.

Who sees what:

• Friends (people who added your code, or whose code you added) see your Baddi's name, its look and level, its room, and when you last played.
• Everyone else sees only your Baddi's look, under a handle their own phone makes from its form (like “Droplet #4821”), on a weekly board you have a score on and when they meet your Baddi as a ghost. They never see its name, your friend code or when you last played.

Alongside the profile we keep:

• Your friends list, and the gifts friends send each other: who sent it, to whom, on which day, and whether it was collected.
• Your best score each week on each game's board, and which weekly prizes you have been paid.
• Ghost fights: when someone fights your Baddi as a ghost, which two accounts fought and who won, so we can tell you how your ghost did and pay its defences. You see how many fought it and how many it beat, never who they were.

A Baddi that has not been played for 30 days stops being offered as a ghost. You can remove a friend at any time, and it removes you from their list too. Deleting your account deletes the profile and every one of these records with it.

Diagnostics

From version 0.1.18, the app sends two kinds of report to our own database (the same Supabase project as your backup, and nowhere else):

• Crash reports. When something in the app breaks: the kind of error, its message (with anything that looks like an email address or a token removed first), and the part of our code it came from.
• Gameplay counts. A short, fixed list of moments: the app opening, finishing onboarding, a finished battle and whether it was won, an arcade score, an Incubator roll, a level-up, turning reminders on, and which credit pack was bought. They tell us whether a change made the game better or worse, and whether a price is fair.

Each report carries the app version, whether the phone is an iPhone or an Android, and a random ID the app makes up fresh every time it starts. It does not carry your account ID, your device ID, your Pal's name or anything you typed, so no report can be tied back to you or to your other reports on another day. The app can write these reports but never read them back.

To stop them, turn off Settings → Cloud & Account → Share diagnostics. Nothing is sent after that, and anything waiting to be sent is thrown away.

Reminders

If you turn on reminders, your phone itself schedules them from your Pal's care meters as you leave the app, and clears them when you come back. No server sends them, and nothing about them leaves your phone. They stay off until you say yes, and Settings → Notifications turns them off again, one by one or all at once.

Keeping bots out

Creating your anonymous account is the one moment a script could do real damage — it could mint thousands of them. So the app runs a Cloudflare Turnstile check when it first starts, and usually without showing you anything at all.

Turnstile runs in a hidden browser view inside the app, on a page we host. Cloudflare looks at the request and hands back a short token, which the app passes to our database to show that a person is behind it rather than a script. The token contains nothing about you — no name, no email, and no device identifier that we keep. It is single-use, it expires within minutes, and it is never attached to your Pal.

If the check cannot finish on its own, Settings shows a Verify this device row so you can complete it by hand. Ignoring it costs you only the cloud backup — the app stays fully playable either way.

Location, and Nearby Match

Baddi asks for your location for exactly one feature, and only at the moment you tap to search for someone nearby. If you never use Nearby Match, the app never asks.

When you do search, your position is rounded to about a kilometre before it leaves your phone, whatever radius you pick. That places you in a neighbourhood, never at an address. The app does not keep your precise position at all: whether two players are close enough to match is worked out from the rounded positions alone. The rounding is fixed once, when your search starts, and never updated as you move, so it cannot be followed. That rounded position is broadcast to the other people searching in the same pool, and it is not written to our database. It exists only for as long as your search is running, and it is gone when you stop.

We never store a location history, and we never see where you have been.

The camera, and why there isn't one

Baddi does not use your camera. There is no camera code in the app, it never asks for the permission, and no image from your phone ever reaches us. Your Pal follows you by reading tilt and orientation from the motion sensors, and by where your finger touches the screen — nothing else.

Settings has a row called Camera View. That is our name for how closely the room frames your Pal on screen — a framing choice, not the device camera. It is named for what the picture looks like, and this paragraph is here because that name could reasonably lead you to think otherwise.

Steps

If you take your Pal for a walk, the app reads your step count and your Pal gets a little happier. Your phone reports a total, not a route, and we never see your pace, your path or your workout.

One thing worth being straight about: that running step total is part of the Pal save file described above, and so it is included in the cloud backup. It is a number that goes up, sitting beside your Pal's name. It is not a movement history, but it is not purely local either, and we would rather say so than let a permission prompt imply otherwise.

Bump Match

When you bump phones with a friend, the two devices talk directly to each other over your local network. That match does not pass through our servers and is not stored by us — only the result line described above is.

Purchases

Purchases are handled entirely by Apple (App Store) or Google (Google Play). We never see your card, your name or your billing address; neither store gives them to us.

On iPhone, what we do receive is the signed record the App Store issues for each purchase. We check Apple's signature on it before adding the credits to your account's backup. We keep the transaction identifier, the product, and Apple's signed record, so that your purchased credits can be restored to a new phone and so that nobody can forge a purchase. On Android, Google Play confirms the purchase on your phone, and your purchased credits are backed up with the rest of your save. That record is read-only from your app: no phone can write to it, including yours.

Refunds are the store's to grant, under its policy, not ours. A refund is requested from Apple or Google, whichever store you bought through.

The same applies if you subscribe to Baddi+: the store tells the app whether the subscription is active and when the current period ends, so the app knows to unlock it. We still never see your payment details. What the subscription includes, how it renews and how to cancel it are set out in the Terms of Service.

Linking an account, or not

You can leave your anonymous account exactly as it is forever. If you would rather be able to recover your Pal on a new phone without the anonymous identifier, you can optionally attach an email address, an Apple Account, or a Google account. That is the only circumstance in which we ever hold an email address for you, and it is used to sign you back in and nothing else.

If you use Sign in with Apple to link, you choose what — if anything — Apple shares with us, including Apple's private relay address if you prefer it.

Deleting your data

There are two different things you can delete, and they are worth telling apart.

Delete the app and everything on your phone goes with it, immediately. The backup row on our side stays where it is, keyed to an identifier that is now gone from your device. If you never linked an email or a social account, that identifier exists nowhere else — nobody, including us, can tie it back to you.

Delete your account — in the app, under Settings → Delete Account — and the rest goes too. This erases the account itself and everything we hold for it: your Pal and its save, its level and collection, your credits, your purchase records, your match history, and your Baddi's profile, friends, gifts, weekly scores and ghost fights. It happens immediately rather than on a 30-day clock, and it cannot be undone. We keep no copy to restore from, because the rows are deleted rather than flagged.

If you signed in with Apple, Apple asks you to confirm as you delete, and we then revoke the app's Sign in with Apple access, so Baddi drops off the list of apps using your Apple Account.

Two things about that worth reading before you tap it. Credits you bought with real money are gone permanently — they cannot be restored by us and there is nothing left on our side to refund against. And the App Store receipt for those purchases is Apple's record rather than ours; it is not something deleting your account removes, and it is not something we can act on once our own ledger is gone.

Reset Pal is a different thing entirely: it starts your Baddi over on that phone and keeps the account. If you want the account gone, that is Delete Account.

You can also just email us at hello@gnarlux.com and ask, and we will do it for you. We will action a request within 30 days and write back to confirm.

Children

Baddi is not directed at children under 13, and we do not knowingly collect personal information from them. The app never asks for a name, an email address or a birthday to function, so it gathers almost nothing about anyone of any age. If you believe a child has linked an email address to an account, write to us and we will remove it.

Where your data is kept

Backups and match records are held with Supabase, our database provider, and App Store transactions are confirmed with Apple. One more company sees a request from the app (two, on versions before 0.1.17), and neither is given anything about you:

• Cloudflare runs the bot check described under Keeping bots out. It sees the request and issues the token. It is not told who you are, and there is no account of yours to tell it about.
• Google, for versions before 0.1.17 only: those served the app's typeface through Google Fonts, which meant Google saw that request — including your IP address — when the app started. From 0.1.17 the typeface ships inside the app and Google is not contacted. Nothing about your Pal or your play was ever attached to that request.

We do not sell your data, we do not share it with advertisers, and we do not use it to train anything.

Gnarlux is established in Estonia, so that database sits in the EU too — it runs in Ireland. Estonian law is what this policy and our terms are governed by, and the clause setting that out, along with what it does not take away from you as a consumer, is in the Terms of Service.

Changes to this policy

If what the app collects changes, this page changes with it, and the date at the top changes too. If a change is significant, the app will say so in the release notes rather than quietly updating a page nobody re-reads.

Contact

Questions, corrections, or a deletion request: hello@gnarlux.com