Security Guidelines

Version 2026-10-11 · Effective 11 October 2026

The short version. Download MyBadde only from mybadde.com. Protect your Google account with 2-step verification and lock your phone. Never share device tokens or router passwords. Badde will always ask for your fingerprint, face or screen lock before anything risky. We will never ask for your password, PIN or mobile-money code.

These guidelines are part of our Terms of Service. By using MyBadde you agree to follow the rules in section 2.

1. How we protect you

Google sign-in only. We don't store passwords for MyBadde accounts. Your Google account's own protections, such as 2-step verification, protect your Badde too.
Encrypted everywhere. The app, website and PC agent only talk to our servers over HTTPS. Router passwords are encrypted before they are stored.
Confirmation before risky actions. Before rebooting a router or restarting or shutting down a PC, the app asks for your fingerprint, face or screen lock, and our server refuses those actions unless they are explicitly confirmed.
Read-only by default. Badde reads router status with a fixed list of safe commands. It can't change your router's settings.
Limited PC agent. The PC agent can only open and close apps, open websites, lock, restart or shut down. It can't run other commands, and it connects out to us, so you don't open any ports.
Private network addresses are refused. Our servers won't connect to private or local network addresses on anyone's behalf.
Signed app with verified updates. The Android app is signed with our key. The app checks every update's checksum before installing it, and Android only accepts an update signed with that same key.
Hardened servers. Key-only server access, firewall, automatic security updates, rate limits on sign-in and chat, nightly backups and audit logs of important actions.
No money moves. Badde cannot send or receive money.

2. Your responsibilities

Your account

Turn on 2-step verification for your Google account and keep your recovery phone number up to date.
Use a screen lock (PIN, fingerprint or face) on every phone signed in to MyBadde. Anyone holding your unlocked phone can talk to your Badde.
Sign out of MyBadde on shared or public computers, and remove phones you no longer use from Devices.

Installing

Download the app and PC agent only from mybadde.com. Check the checksum on the download page if you are unsure.
Don't install modified versions of MyBadde from other websites, WhatsApp groups or file-sharing apps.

Devices

Only add devices you own or are authorised to manage.
For routers, create a separate read-only user for Badde rather than using your admin login, and allow API/SSH access only from the addresses you need.
Treat a PC agent device token like a password. Never share it or post it online. If it leaks, remove the PC in the app and add it again for a new token.
Check what Badde says it will do before you confirm a reboot or shutdown.
Vehicle features (when available) must only be used when it is safe and legal; Badde refuses driving-related commands unless the vehicle is parked.

Scams

Shift Connect Solutions and Badde will never ask you for your Google password, a verification code, your mobile-money PIN or bank details.
Be careful with messages that seem to come from a friend's Badde asking for money or codes - call your friend to check.
Don't tell Badde passwords, PINs or card numbers.

3. If something goes wrong

If you lose your phone, sign in to your Google account from another device and remove the lost phone (Google Account → Security → Your devices), then remove it from MyBadde Devices.
If you think someone used your Badde, remove unknown devices, change your Google password and email support@mybadde.com.
If a router or PC behaves unexpectedly, remove it from MyBadde, change its password, then add it again.

4. Reporting a vulnerability

If you find a security problem in MyBadde, please email support@mybadde.com with “Security” in the subject and enough detail for us to reproduce it. Please give us reasonable time to fix it before telling anyone else, and don't access other people's data, disrupt the Service or test against devices you don't own. We won't take legal action against good-faith research that follows these rules.

5. Changes

We update these guidelines as MyBadde grows. Important changes will be shown to you for acceptance in the app and on the website.