Privacy policy
Effective and last updated November 4, 2026
BuddyPad is made by Built By Mo LLC. "We" below means that company. BuddyPad is free for now. We don't show ads, we don't sell your data, and we don't track you across other apps or sites.
To reach us about anything here, email buddypad@builtbymo.dev.
Built By Mo LLC, 2108 N St Ste N, Sacramento, CA 95816. Because we don't track you across other sites or apps, a browser's Do Not Track signal doesn't change anything we do. No other company collects your activity across other sites through BuddyPad or this website. This website sets no cookies.
What we keep, and why
Your sign-in. Apple or Google tells us your email address and your name, and gives us an id for your account. If you use Hide My Email, we see Apple's relay address. We use these to sign you in, and we show your name to the buddies you invite. You can change the name in the app. If your provider gives no name, we use the part of your email before the @ until you change it. If that email is one of Apple's Hide My Email addresses, we use "BuddyPad user" instead. Built By Mo's other apps use the same sign-in system, so if you use one of them with the same Apple or Google account, it shares this sign-in record. It can't read your BuddyPad data. If you sign in with Apple, we also keep a token from Apple, so we can cancel it when you delete your account. Our sign-in system also records when you signed in, and the IP address and device type of each session.
What you write. Your goals and everything on them: notes, links, steps, status, due dates, progress, and the history of when those changed, including the goal's first title even if you rename it. Also your comments, reactions, nudges, check-ins and suggested edits.
Proof photos. Only photos you choose to add to a goal. Your phone shrinks each one and strips its location and other camera details before it uploads.
BuddyPad uses your camera only when you take a proof photo or scan an invite, and your photos only when you pick one.
Your buddies. Who you're paired with, who you've removed, your streak, and the invites you've sent.
Your settings. Your time zone and week start, so your days and streak count correctly. Your notification choices, quiet hours and reminder times.
Your phone's push token. Firebase gives your phone this id so we can send it notifications. We keep it with which kind of phone it is and when it was last seen, and only while notifications are on for BuddyPad. If you turn them off, we remove it the next time you open the app.
If you connect a tool. For each token you make, we keep its name, its permissions, when it was last used, and a one-way hash of it, so we can't read the token back. For each webhook, we keep the address you gave us, a signing secret, and a log of delivery attempts. We also keep the token's last 4 characters and when it expires. A webhook sends the event type, the time and ids, including your buddy's user id. It doesn't send words.
Activity records. For everyone, we keep 30 days of records of who did what and when, as ids. A tool you connect later can read them.
Plain server records. A short list of recent actions so a retried save doesn't happen twice. Counts of API requests per token. A one-way hash of your IP address when someone opens an invite preview, so nobody can guess codes. Someone could work out the address from that hash by trying every address, so we treat it as personal data and delete it within about two days.
Reports. When you report a buddy, a comment, a nudge, a check-in answer or a photo, we save what we need to act on it: your name and user id, theirs, the list you share, the goal involved, the words reported, where a reported photo is stored, and anything you wrote. We email that to our support inbox, with both people's sign-in email addresses. If someone reports you, the same goes for you. The other person isn't told.
Your phone also keeps your session, a few small settings like which tab you were on, and reminder text. Your phone's own backup may copy them. They go from the phone when you uninstall the app.
What your buddy can see
A buddy sees your name, the goals you share with them, the photos and full history on those goals, which weeks you were active, and the conversation between the two of you on those goals. They never see goals you haven't shared, or who else you share a goal with. When you send an invite, whoever accepts the link first becomes your buddy and gets the goals you ticked. Until then, anyone with the link sees your name and those goals' titles, status and progress. No goal is ticked until you tick it.
A tool you connect can read your goals, your buddies' shared goals and your conversations. Depending on its permissions, it can also change or delete goals and message your buddy as you. It can't see photos.
If your buddy connects a tool, it can read what your buddy sees of you. We don't control that tool. That tool can be anything, including an AI assistant. We don't tell you when your buddy connects one.
A tool you connect is your choice, and what it does with the data is up to whoever runs it. Revoke the token in the app to stop it reading. Webhooks keep sending until you delete them in the app.
Who it goes to
We use these companies to run BuddyPad. We only use companies whose terms require them to protect your data at least as well as this policy does. They get what they need to do their job. Some of them, Apple and Google especially, also run their own services under their own privacy policies, and keep some technical data to run and improve those services.
- Supabase stores the database, the photos and the sign-in records. Supabase also sees the IP address of anyone opening an invite page.
- Cloudflare hosts this website, the public API and the webhook sender. It sees the IP address and request of whoever connects, and what the public API sends back. It also looks up the hostname of any webhook address before we send to it.
- Google, through Firebase Cloud Messaging, delivers notifications. A notification's text goes through it: your buddy's name, a goal's title, and up to 178 characters of a message, or a check-in answer or a reaction, plus the ids of the notification, the goal and your list with that buddy. We clear that text from our queue when the notification is finished. If notifications are off for BuddyPad, we send your phone none. Firebase also creates an installation id when the app starts, even before you allow notifications, and Google keeps it under its own terms. Deleting your BuddyPad account doesn't remove it from Google.
- Apple delivers notifications to iPhones the same way, and handles Sign in with Apple.
- Google handles Google sign-in.
- Google Play gets your invite code when someone follows your invite link to install the app, so the app can read the code once after it installs.
- Google, through ML Kit, reads an invite QR code on Android phones. The scan happens on your phone. ML Kit also sends Google your phone's model and system version, details about the app, and performance numbers, so Google can diagnose and measure its tool.
- Cloudflare handles email sent to us and passes it along to our Gmail inbox, which Google hosts. SMTP2GO sends our replies. We use Anthropic's Claude to help us manage that inbox, so Anthropic may process what you send us.
- Resend sends us emails when something on the server breaks, including an account deletion that hasn't finished. Those emails hold error messages, not what you wrote. It also delivers each report to our inbox, and a report's email holds what's listed under Reports above.
If you email us, your message sits in our mailbox. If someone reports a problem, we can read the goals and conversation involved. We'd share your data beyond this in four cases: when the law requires it, including reporting child sexual abuse material to the National Center for Missing and Exploited Children; when someone's safety is in danger; to enforce our terms or defend a legal claim; and if BuddyPad or Built By Mo LLC is sold or merged, in which case the new owner has to keep to this policy until it tells you otherwise.
How we protect it
Everything between the app and our servers goes over HTTPS. Database rules keep each person's data away from other accounts. Photos sit in a private store and open only through a link that expires. We keep API tokens only as a hash. Backups are encrypted. No system is perfectly safe. If a breach affects your data, we'll tell you as the law requires.
Google sign-in
If you sign in with Google, Google sends BuddyPad your name, your email address, your Google account id, and the basic details in your Google profile, such as a link to your photo and whether your email is verified. Our sign-in system stores them with your login. We use your name, email and id to create your account, sign you in, and show your name to your buddies and to anyone holding an invite you send. We don't use your Google photo in BuddyPad. We don't ask for your contacts, your files, your calendar or anything else in your Google account. We don't sell this data or use it for ads. It goes only where this policy says: the companies above, your buddy, a tool you or your buddy connects, and a report if someone makes one. BuddyPad's use and transfer of information received from Google APIs follows the Google API Services User Data Policy.
How long things last
| What | How long |
|---|---|
| Your account and goals | Until you delete them |
| A goal you delete | 30 days, then gone |
| A photo | A removed photo goes within about a day. A photo on a deleted goal goes about 30 days later. |
| The link a phone uses to load a photo | 1 hour, even if the photo is removed or the list ends first |
| A conversation after you remove a buddy or unshare a goal | Stays stored but hidden, until the goal or the author's account is deleted |
| Notification text in our queue | Until the notification finishes. The empty record goes after 30 days. |
| An unused invite | A link lasts 14 days and a QR code 10 minutes. Either is gone 30 days after that. |
| A used invite | Until the person who sent it deletes their account |
| Connected tool events and delivery logs | 30 days |
| The IP hash from invite previews | About 2 days |
| Counts of API requests | About a day |
| An Apple token or sign-in we couldn't remove when you deleted your account | We try again every night until it works. If you sign in again first, we stop, because that's a new account. |
| Sign-in records (time, IP address, device) | Until your login is deleted |
| An account we closed for breaking the terms | Hidden right away. Deleted when the person asks, or 2 years after we closed it. If the person asks first, we still keep the account's id and the date we closed it until those 2 years are up, so that it stays closed. |
| Firebase's installation id | Under Google's terms. Deleting your account doesn't remove it. |
| Emails to us, and report emails | 2 years. We clear them by hand each month, so one can last a few weeks longer. |
| A report | 2 years, even if either person deletes their account |
| Backups | Up to 14 days. We keep 14 nightly encrypted copies on a computer we control. If we ever restore one, we delete again whatever you'd already deleted. |
We keep some things longer when we have to. If someone posts child sexual abuse material, the law requires us to report it and keep what we reported for at least a year. If there's a legal claim or a court order, we keep what's involved until it's over.
Supabase and Cloudflare keep their own logs, which include IP addresses, under their own terms. On our current setup those logs last up to 3 days. Resend keeps the emails it sends under its own terms and doesn't publish a fixed period. Apple and Google keep what they handle under their own terms.
Deleting your data
In the app, go to Me, then Delete account. If you no longer have the app, this page says what to do, and it lists exactly what goes and what stays. Wherever you live, you can ask us for a copy of your data, to fix it or to delete it. Email us from your sign-in address. We'll answer within 45 days and we won't treat you differently for asking. If we say no, tell us and we'll look again. A copy won't include reports other people made about you.
Children
BuddyPad is for adults, 18 and older. If you think someone younger has an account, email us and we'll delete it.
Where the law requires it, Apple or Google tells the app your age range. We use that only to decide whether you can use BuddyPad, and we don't keep it.
Where this applies
BuddyPad is available in the United States for now. Our service providers store and process data in the United States and possibly elsewhere.
Changes
If we change what we keep or who it goes to, we'll update this page and the date at the top. If it's a big change, like a new kind of data or a new use for it, we'll email your sign-in address or tell you in the app at least 30 days before it applies. We won't use what you've already given us in a very different way without your OK.