Short, because there is little to say.

• No cookies. None are set, by us or by anyone else.
• No analytics, no tracking, no ads. There is no script on these pages that reports what you do.
• Nothing from third parties. Fonts, images and scripts are all served from this site. Your browser is not sent anywhere else to load a page.
• No forms and no accounts. There is no backend to send anything to.

One thing is saved, and it stays in your browser: if you choose Light or Dark with the theme switch, that choice is kept in your browser’s local storage so the page looks the same next time. It is never sent to us. Clearing your site data removes it.

One thing we cannot avoid: like every website, these pages are delivered by a hosting provider (Vercel). To send you a page, its servers see your IP address and which page you asked for, and may keep that in their own logs. We add nothing on top of it.

Links to GitHub take you to github.com, which has its own privacy policy. Nothing is loaded from GitHub until you follow one.

The demo is the real app with its engine swapped for sample accounts. It runs entirely in your browser. It connects to no platform, and anything you type into it stays on your device.

• It runs on your machine. Your accounts, drafts and settings are kept in one folder on your computer. We run no server that receives them.
• It talks to the platforms you connect, and only those. When you add a Bluesky account, baddie talks to Bluesky. What each platform does with your data is covered by that platform’s own policy.
• Tokens are encrypted. Access tokens and app secrets are encrypted with AES-256-GCM before they are saved.
• No telemetry. The app does not report usage, crashes or anything else to us.
• An AI agent only sees what you allow. If you connect one, the posts and messages it reads go to the AI service you chose, under that service’s terms. That is your decision, per kind of action, and it is off until you set it up.

The details, including what baddie does not protect you from, are in the security policy. The code that does all of this is public on GitHub.

A hosted version of baddie is planned. It will need a real privacy policy, because it will hold tokens on a server. That policy will be published here before the service opens. Until then, this page is the whole story.

Questions or corrections: open an issue on GitHub.