Buddly — Privacy & Data Handling
Audience: children ages 2–6 and their parents/guardians. Last updated: October 28, 2026 · App version 1.0.0
Buddly is built to be private by default. It is an offline-first game with no user accounts, no logins, no payments, and no advertising. We do not use any third-party analytics, advertising, tracking, or attribution SDKs.
What data the app handles
Everything below is stored only on the device and is never transmitted by the app under its shipped configuration.
| Data | Why | Where it lives |
|---|---|---|
| Child profile: first name, chosen avatar, age band | Personalize the experience and per-child progress | On-device storage (app-private) |
| Game progress, stars, scores, rewards | Save play across sessions | On-device storage (app-private) |
| Custom puzzle photos (optional) | Turn a chosen photo into a jigsaw | On-device file storage |
| Profile picture (optional) | A small avatar photo chosen from the gallery or taken with the camera, behind the grown-ups gate | On-device file storage |
| Voice "cheer" recording (optional) | Play a parent/child-recorded "well done!" | On-device file storage |
| Crash diagnostics (last 20 errors) | Help a parent/developer diagnose a problem | On-device storage |
What we do not do
- We do not collect, sell, or share personal information.
- We do not show ads or use ad networks.
- We do not include analytics or tracking SDKs.
- We do not require an account or an internet connection to play.
Permissions, and why
- Photos: Android's system picker grants Buddly access only to the picture a player or grown-up selects. Buddly does not request broad photo-library access. Images stay on the device.
- Camera: when a player takes a photo for a custom puzzle or a grown-up takes a profile picture. Images stay on the device.
- Microphone: only for the optional "record your own cheer" feature, behind the grown-ups gate. Audio stays on the device and is excluded from any data export.
- Vibration: gentle haptic feedback during play.
Parental controls
- A grown-ups gate (a math question with a typed answer and a lockout after repeated wrong tries) protects Settings, data export/import, the daily play-time limit, and voice recording.
- Parents can export a profile's game progress (share it only with people you trust), import it on another device, and reset all progress at any time. Device-level settings are not imported.
Optional crash reporting (off by default)
The app can forward crash diagnostics to a parent-configured https endpoint (expo.extra.crashWebhook). This is empty/disabled in the shipped build. If you enable it, payloads are PII-scrubbed (file paths and URIs removed, fields allowlisted, lengths capped) before sending — but you remain responsible for choosing a privacy-reviewed endpoint and for any COPPA/GDPR-K obligations that transmitting children's diagnostics may create.
Data at rest
On-device data uses the platform's app-private storage and is not included in Android device backups (allowBackup=false). It is not separately encrypted at rest beyond the OS sandbox; on a non-rooted device it is not accessible to other apps. Encrypting the profile registry with the platform keystore (expo-secure-store) is a tracked future hardening item (see SECURITY_ASSESSMENT.md, finding L-02).
Contact
Publisher: Buddly. For privacy questions, email [email protected].
This document describes the app's behavior as implemented and is provided to support the store listing and parents' understanding. It is not legal advice; consult counsel for your specific COPPA/GDPR-K compliance obligations before release.