Privacy Policy

Version 2026-10-11 · Effective 11 October 2026

The short version. We collect what we need to run Badde for you: your Google name and email, what you ask Badde, your reminders, your messages to friends' Baddes and the devices you add. “Hey Badde” is detected on your phone, and your WhatsApp, calls, contacts and calendar are read on your phone to answer you, not copied to our servers in bulk. We don't sell your data or use it for ads. You can delete your account and data at any time.

1. Who is responsible for your data

Shift Connect Solutions, Kampala, Uganda, is the data controller for MyBadde. Contact us about privacy at support@mybadde.com. This policy is written to meet Uganda's Data Protection and Privacy Act, 2019 and its Regulations, and we apply the same protections to users in other countries.

2. What we collect and why

Your account

From Google sign-in: your name, email address, profile photo link and Google account ID. We use them to create your account and sign you in. We never see your Google password.
Settings you choose: your time zone, your assistant's name, your public handle and display name.
Agreement records: which version of our terms you accepted, when, and the IP address and app/browser you accepted from, so we can show what you agreed to.

Using Badde

Conversations: when Badde needs our server to answer, the app sends your question and up to the last ten turns of the conversation (which can include things Badde just read to you). We store your question and Badde's answer in your Badde inbox so you can see them again.
Reminders, goals and routines you create, and whether you completed them.
News updates you schedule (the topics and times).
Messages between Baddes: the people you connect with and the messages you exchange, so they can be delivered and read aloud.
Devices: the phones signed in to your account (model, app version), PCs you link, and routers you add, including their address and login. Router passwords are encrypted before we store them.
Device commands you give (for example “restart the router”) and their results.
Marketplace interest: which products you asked to be notified about.

Technical data

Our servers log the IP address, time and page or feature requested, to keep the Service secure and fix problems.
Website demo: we don't store demo chats. We count messages per IP address in memory for the current day only, to apply the free limit.

3. What stays on your phone

Wake word: “Hey Badde” is detected entirely on your phone. Audio is not sent to us while Badde is waiting for its name.
Speech: after the wake word, your phone's speech-recognition service (usually Google's) turns your words into text. That service is covered by its provider's privacy policy. We receive only the text, and only when the request needs our server.
Notifications, call log, contacts and calendar: read on your phone, only with your permission, to answer you (for example “what did I miss?” or “call Sarah”). We don't upload them in bulk. What Badde reads to you may be included in the conversation turns described above.
Phone control: if you turn on Badde's accessibility feature, it is used only to carry out the actions you ask for, such as closing an app.

4. Our legal grounds

Consent - you agree when you sign up, and you grant each phone permission separately. You can withdraw consent by turning permissions off or deleting your account.
Providing the Service you asked for under our Terms of Service.
Legitimate interests - keeping the Service secure, preventing abuse and fixing faults.
Legal obligations - when the law requires us to keep or disclose information.

5. What we don't do

We don't sell or rent your personal data.
We don't use it for advertising, and we don't let advertisers track you in MyBadde.
We don't read your conversations for any purpose other than running, securing and fixing the Service, unless you ask us to or the law requires it.

6. Who we share it with

Hosting: Contabo GmbH, which runs the servers our data is stored on, acting only on our instructions.
Google: to verify your sign-in; when you ask Badde to play something on YouTube, the search words are sent to YouTube's search service; and the topics of news updates you schedule are looked up on Google News (without your name or account).
People you choose: friends you connect with receive the messages you send them, your display name and handle.
The authorities: only when Ugandan law or a valid court order requires it, or to protect someone from serious harm.
A new owner: if Shift Connect Solutions is reorganised or sold, under this policy, and we will tell you first.

Badde's replies are currently produced on our own servers. If we start using an outside AI provider to answer you, we will update this policy and ask you to accept the new version before your conversations are sent to it.

7. Where your data is stored

Our servers are in the European Union (currently France), where data protection law offers protection at least equal to Uganda's. Backup copies are also kept on a secured, access-restricted computer of Shift Connect Solutions in Uganda. All connections between the app, the website and our servers are encrypted (HTTPS/TLS).

8. How long we keep it

Account data, conversations, reminders, messages and devices: for as long as you keep your account.
When you delete your account, it is erased from our live database immediately. Backups roll off within 30 days.
Server logs: up to 30 days.
Security audit entries (for example “account deleted”) stay in our records after deletion, without your name, email or any link to you.

9. Your rights

Under the Data Protection and Privacy Act you can:

ask for a copy of the personal data we hold about you;
have it corrected if it's wrong;
have it deleted - you can do this yourself on your account page or in the app;
object to or ask us to stop processing it;
withdraw consent at any time (this doesn't affect processing already done).

Email support@mybadde.com and we will reply within 30 days. If you aren't satisfied, you can complain to Uganda's Personal Data Protection Office (pdpo.go.ug).

10. Children

MyBadde is for people aged 18 or over. Younger people may use it only with the consent and supervision of a parent or guardian. If you believe a child is using MyBadde without that consent, contact us and we will delete the account.

11. Security

We protect your data with encryption in transit, encrypted storage of device passwords, a hardened server with key-only access, automatic security updates, rate limits and audit logs. No system is perfectly secure: if a breach affects your personal data, we will tell you and the Personal Data Protection Office as the law requires. See our Security Guidelines.

12. Changes

When this policy changes in a way that matters, we will ask you to read and accept the new version. The version and date are at the top of this page.

13. Contact

Shift Connect Solutions, Kampala, Uganda · support@mybadde.com