BADTIME Privacy Policy

Last updated: October 17, 2026

This policy explains how BADTIME collects and uses information when you use the BADTIME mobile app and related services.

Who may use BADTIME

BADTIME is intended for people aged 13 and older. If the law where you live requires permission from a parent or guardian before you can use an online service, you must have that permission. We apply stronger privacy and communication protections to users under 18. If an age range reported by Google Play or Apple, or an earlier age record, shows that someone is under 13, BADTIME stops them from using the app and deletes their data: a guest profile immediately, and a registered account within minutes, without the usual cancellation period.

Information we collect

• Guest and account information: installation and guest identifiers; username, display name, email address, password-derived authentication data, friend code, your confirmation that you are at least 13 years old, and age-safety records.
• Region for age rules: to apply country-specific age rules, the app compares your device time zone and the region of your device language with the countries that have such rules (currently South Korea and Brazil). We store only which of those countries applied, never your location. Your device settings can be changed, so this is not location verification.
• App-store age range: where your Google Play or Apple account shares it (with your or your parent's permission, or where the law in your region requires it), the age range it reports (for example 13 to 15, or 18 and over), how the store determined it, and whether a parent or guardian has approved the app. We use it only to apply age protections, and only ever to make them stricter than your date of birth alone.
• Gameplay and progress: answers, scores, XP, levels, Mastery, streaks, achievements, game sessions, timing and integrity evidence.
• Profile and social information: avatar, bio, cosmetics, showcase, friendships, blocks, requests and privacy choices.
• Communications: chat messages, reactions, reports, support messages and media you choose to send, including photos or voice recordings.
• Technical information: IP address, session and installation identifiers, app version and platform, device time zone (for daily streaks), online status and the app section in use (visible only to BADTIME administrators), automatic error reports (the action and screen involved, the error message, app version, platform and player ID), request and security logs, and diagnostic details you include in a report.

How we use information

We use information to operate accounts and guest sessions; save progress; provide games, profiles, leaderboards, friends and chat; prevent abuse and cheating; investigate reports; provide support; maintain security; and comply with law. We do not sell personal information. BADTIME does not currently contain third-party advertising or behavioral advertising trackers.

Legal bases for processing

• Providing the service you ask for (GDPR Art. 6(1)(b)): guest and registered accounts, saving progress, games, leaderboards, friends, chat, support and account deletion.
• Legitimate interests (Art. 6(1)(f)) in keeping BADTIME safe, fair and working: security and rate limiting, fraud and cheating prevention, moderation, report handling, age-appropriate protections and diagnosing faults.
• Legal obligations (Art. 6(1)(c)): when the law requires us to keep, disclose or delete information.

BADTIME does not use your information for advertising or ask for consent to tracking.

Information you must provide

You must confirm that you are at least 13 years old to use BADTIME. This is a self-declaration that you make once for each account; it is not verified. A username, email address and password are required only to create a registered account; you can play as a guest without them. Other information, such as a bio, avatar or messages, is optional.

Automated checks

BADTIME automatically checks game results for impossible scores or timing. Results that fail these checks can be excluded from leaderboards or flagged for review by an administrator, who can restore them. These checks do not make decisions with legal or similarly significant effects on you.

Service providers and transfers

BADTIME's application server and database are hosted by Railway in its EU region (the Netherlands). Account and security emails are sent through Resend. Chat photos and voice recordings are stored with Cloudflare R2, and the badtime.app website is served through Cloudflare. Google and Apple process app-distribution and device-service information under their own policies. Railway, Resend and Cloudflare are based in the United States, so information may be accessed from outside the European Economic Area. Resend and Cloudflare process information under data processing terms that form part of their customer agreements; both are certified under the EU-U.S. Data Privacy Framework, and their terms also include the EU Standard Contractual Clauses. A data processing agreement with Railway, which would include the EU Standard Contractual Clauses, has not yet been signed. We are putting it in place and will update this policy when it takes effect. These providers process information on BADTIME's behalf. We may also disclose information when required by law or necessary to protect users, rights, safety or service security.

Public and shared information

Usernames, display names, avatars, selected cosmetics and eligible scores may appear on profiles or leaderboards. Information you post in Global Chat is visible to other users. Direct messages are shared with their participants. Privacy settings may limit some progression details, but they do not make public posts private.

Safety for younger users

For users under 18, BADTIME hides profile details from non-friends, keeps them out of Discover and out of adults' username search (unless they are already friends), blocks unsolicited private messages from adults, and turns off photos, voice messages and Global Chat. Global Chat is available only to users confirmed as 18 or over. In Brazil, users under 18 cannot send or receive private messages until BADTIME offers a parental consent process. In South Korea, the minimum age is 14. Blocking and reporting tools remain available. Do not share sensitive personal information in profiles or messages.

Retention and deletion

Account, profile, gameplay and communication data is generally kept while an account or guest profile remains active. Login sessions normally expire after 90 days. Email verification and security codes expire after 15 minutes, and short-term rate-limit records are normally removed after 48 hours. Registered users can request deletion in Account Settings; deletion is normally scheduled after a 24-hour cancellation period. Guests can delete their guest data immediately in Settings. You may also use our account-deletion page.

When someone is found to be under 13, we keep a one-way, keyed hash of the app installation and device identifiers for 30 days, so the same device cannot immediately start again. It contains no age or other account details and is deleted automatically after 30 days.

Deletion removes or anonymizes associated account, profile, progression, social and communication data. Moderation reports, anti-cheat evidence, security records, support history and administrator audit records may be retained after account deletion where needed to protect users, investigate abuse, maintain an accurate security record, resolve disputes or meet legal obligations. Identifying account links and profile labels are removed or anonymized where possible. Records kept after an account is deleted are permanently deleted 12 months after they were created, together with any chat photo or voice recording preserved with them.

Your choices and rights

You can edit profile and privacy settings, block or report users, remove messages where supported, and request account or guest-data deletion.

Under the GDPR you have the right to access your personal data, have it corrected, have it deleted, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests. To use these rights, email support@badtime.app; we may ask you to confirm that the account is yours and will reply within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk, or to the data protection authority where you live.

Security

We use technical and organizational safeguards, such as encrypted connections, hashed passwords and session tokens, and access controls for administrators, but no online service is completely secure.

Changes

We may update this policy as BADTIME changes. Material changes will be reflected by updating the date above and, where appropriate, notifying users.

Data controller and contact

The data controller for BADTIME is Denni Delin Nielsen.
Correspondence address: Rodosvej 68, 2. tv., 2300 København S, Denmark.
Privacy questions and requests: support@badtime.app.