Busted: Privacy Policy

Effective date: 7 October 2026

Busted is a party game played on one phone passed around a group. We built it to need as little data as possible. This page explains exactly what the app does with data, in plain words.

In short

• You do not create an account. We never ask for your name, email, phone number or location.
• Player names never leave your phone. They are not sent to our servers or to any service we use.
• We measure how the app is used with anonymous, random identifiers, and we collect crash reports so we can fix bugs.
• We do not use advertising, we do not track you across other apps and websites, and we do not sell data.
• Your IP address is not stored in our analytics.

Who is responsible

The app and this policy are provided by Asena Yangın, an individual developer ("we", "us"). For privacy questions or requests, write to asestudio21@gmail.com.

What stays on your phone

These are stored only on your device and are never uploaded:

• The player names you type, and the settings of your last game (pack, number of players and agents, duration). The last game is kept so the next round can be pre-filled for 30 minutes.
• Your language choice and whether you have seen the intro.
• Whether you allowed notifications. The "time is up" alert is a local notification created on your phone.
• The summary picture. It is created on your phone and only leaves it if you choose to share it with the share sheet.

A game in progress is held in memory only. If you close the app it is gone. Deleting the app deletes everything above.

What we collect

1. Usage analytics (PostHog, EU cloud)

When you use the app it sends short event records, for example "a pack was selected", "a round ended" or "the paywall was viewed". Each event contains only:

• the event name and a few non-personal values, such as number of players, number of agents, game duration, pack id, mission id and its outcome (completed, failed or caught), or an error type;
• an anonymous identifier: your random RevenueCat app user id, or a random id generated on your phone if that is not available;
• your app language, your platform (iOS or Android) and the app version;
• a random session id.

Events never contain player names or any text you type. We turn off IP-based location lookup and we have switched on PostHog's option to discard IP addresses, so your IP address is not stored with your events. We use this data to understand how the game is used, find missions that are too easy or too hard, and see where players stop, so that we can improve the app.

2. Crash and error reports (Sentry, EU region)

If the app crashes or hits an error, a report is sent with technical details: the error and its stack trace, the device model, the operating system version, the app version and the environment. We have switched off Sentry's collection of personal data, so reports do not contain your IP address or any user information, and they never contain player names.

3. Purchases (RevenueCat, Apple, Google)

Busted offers an optional subscription ("Party Pass") that unlocks more packs. Payments are handled by Apple or Google, we never see your card or payment details. RevenueCat, a service that manages subscriptions for us, receives your anonymous app user id, your purchase and subscription status and the receipt data it needs to tell whether you are subscribed. RevenueCat may also process technical details such as your IP address as described in its own privacy policy.

When you start a round with a premium pack, the app sends your RevenueCat anonymous id to our server so we can check that your subscription is active before sending the missions.

4. Our server

To start a round the app asks our server (hosted on Railway) for the list of packs and for the missions of the round. The request contains the language, the chosen pack, the number of players and agents and whether Chaos Pairs is on. It does not contain player names. Your IP address is used for a moment to limit abuse (rate limiting) and is kept in memory only. Our hosting provider may keep ordinary technical server logs.

What we do not collect

Names of players, your name, email address, phone number, contacts, photos, precise or approximate location, advertising identifier, or any data from other apps. The app does not use your microphone or camera.

Why we process this data

• To run the game and check subscriptions (providing the service you asked for).
• To fix bugs and keep the app stable, and to understand and improve the game (our legitimate interest, in a way that has minimal impact on you).

We do not use your data for advertising and we do not "track" you in the sense of Apple's App Tracking Transparency, so the app does not show a tracking permission prompt.

Who receives data

We share data only with the services that help us run the app (processors): PostHog (analytics), Sentry (crash reports), RevenueCat (subscriptions), Apple and Google (app stores and payments), and Railway (hosting of our server). Where the data is processed:

• PostHog (analytics) and Sentry (crash reports): European Union.
• RevenueCat (subscriptions) and Railway (our server): United States.
• Apple and Google: worldwide, under their own policies.

So if you live outside the United States, your purchase status and the requests the app sends to our server are transferred to the United States. We rely on the safeguards each provider describes in its own privacy policy:

• PostHog: https://posthog.com/privacy
• Sentry: https://sentry.io/privacy/
• RevenueCat: https://www.revenuecat.com/privacy/
• Railway: https://railway.com/legal/privacy
• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

We do not sell data and we do not share it for advertising.

How long we keep it

• Analytics events: up to 12 months.
• Crash reports: up to 90 days.
• Subscription records: as long as RevenueCat and the stores keep them to manage your subscription and meet legal obligations.
• Data on your phone: until you delete the app or its data.

Your rights

Depending on where you live (for example under the EU/UK GDPR, the Turkish KVKK, or US state laws) you may have the right to know what data we hold about you, to have it corrected or deleted, to object to its use, and to complain to a data protection authority.

Because there are no accounts and the identifiers are random, we usually cannot tell which analytics records belong to you. Write to asestudio21@gmail.com with your request and we will help wherever it is technically possible. You can also delete the app to remove everything stored on your phone, and cancel a subscription in your App Store or Google Play account settings.

Children

Busted is not directed at children under 13. We do not knowingly collect personal data from children under 13. The app is not in the Kids category. If you believe a child has given us personal data, contact us and we will delete it.

Security

Data is sent over encrypted connections (HTTPS). Premium mission content is only sent after a server-side subscription check. No system is perfectly secure, but we limit what we collect so there is little to protect.

Changes to this policy

If we change what the app collects we will update this page and the effective date, and for significant changes we will tell you in the app.

Contact

Asena Yangın, developer of Busted Email: asestudio21@gmail.com