Privacy policy

Who this policy covers

Busted App LLC, a Minnesota limited liability company formerly named Coach Henry LLC, provides the Busted app and website. This policy covers app users, team members, email and text recipients, website visitors, and people contacting support. Federal tax records may still identify the company as Coach Henry LLC.

Information we handle

• Account and profile. A generated account identifier, chosen name, preferences, and profile image if supplied. If you choose Sign in with Apple, we process the Apple-linked identifier and information Apple provides with your permission to retain or restore your account. If you delete an account that is linked with Sign in with Apple, we also revoke Busted’s Sign in with Apple authorization.
• Protection and accountability. Screen Time authorization, protection state, session times, device check-ins, confirmed protection-off events, selected recipients, alert wording, and delivery or read status. These records describe protection, not what you viewed. We also keep your iPhone’s time zone (for example, America/Chicago) to count days and months and to time weekly recaps; people connected to you receive it with your profile stats.
• Teams and conversations. Invitations, memberships, team names and photos, messages, replies, reactions, notification preferences, and read activity. Profile stats, standings, weekly awards, and recap entries are built from protection and participation records.
• Contact information. Names, email addresses, and phone numbers provided for accountability alerts. An app user may add an email contact without a Busted setup email; recipients can stop these emails using their private unsubscribe link. Text recipients must personally opt in and verify their number.
• SMS permission. The invitation connection, name and number, exact disclosure and version, source, timestamps, verification-provider reference and outcome, and opt-out events. Twilio processes verification codes; we do not store the code itself. Private management links use tokens or token hashes to authorize changes.
• Purchases. Apple transaction identifiers, plan, purchase environment, entitlement, renewal, expiration, and revocation information. Apple processes payments; we do not receive full payment-card details.
• Technical and support information. Push-notification tokens, installation identifiers, request and error details, support correspondence, and network information such as IP addresses processed to deliver and secure the service. Our sign-in provider keeps the internet address and device type a session started from, for security.
• App usage events. A short list of in-app events tied to your account, such as which setup steps you finished, the answer to a permission prompt, whether turning protection on worked, and when the Pro screen was opened or a purchase was tried. We use them to find and fix problems and improve the app. They never include browsing, messages, or alert wording. They are kept while your account exists and are deleted with it. They are never used for advertising.
• Reports and blocks. If you report a message or a person, we keep the report: the reason, any note you add, the names involved, and the text of the reported message. Reports are emailed to our support inbox and read by the Busted team to enforce the Terms of Use and Community guidelines. Blocks and account suspensions are recorded so they stay in effect. A report, and anything we must preserve by law, may be kept after either account is deleted.
• Age and agreement. When you start Busted, it asks your birth month and year, or, where the law asks for it, Apple shares your age range. Your birth month and year are never sent to us. We keep whether you are under 18, whether you answered or Apple did, and which version of the Terms of Use, Privacy Policy and Community Guidelines you agreed to and when. We use this only to meet age and parental-consent laws; it is not shown to other people or used for advertising. If you are under 13, Busted deletes the account, and this iPhone keeps a note, which never leaves it, so Busted stays closed until the month you turn 13.

VPN and DNS processing

The optional VPN is a filtering service. In the current app, selected DNS traffic passes through Busted’s VPN gateway. Domain names must be processed to resolve and filter requests. The gateway forwards permitted lookups to Cloudflare’s family-filtering resolver and applies supported SafeSearch or restricted-mode responses. A fallback resolver may be used when the gateway cannot be reached.

Ordinary browsing traffic in the current DNS-only configuration travels directly from your phone. We do not inspect page contents, record full visited URLs or search terms, or create a per-user browsing-history report. A domain lookup can still reveal a service your device is contacting, including lookups made by background apps; it is not proof that a page was visited.

The gateway maintains a shared, temporary DNS-answer cache without a record of which user asked for a cached name. It also processes device public keys, assigned tunnel addresses, connection endpoints, entitlement and usage records, protection events, and delivery receipts to operate filtering and accountability. The private device key stays on the device. Older app versions may use different routing; keep Busted up to date.

We use VPN data only to provide, secure, troubleshoot, and limit abuse of the filtering and the alerts you ask for. We do not sell, use, or disclose VPN data to third parties for any other purpose, and we never use it for advertising or profiling or provide it to data brokers. Protection on and off events go only to the people you choose, through Apple’s push service, Twilio, and Brevo. Lookups are forwarded to Cloudflare’s family-filtering resolver without your name or account identifier. Operational hosting and DNS providers process the traffic needed to deliver the service; their practices are described below. See VPN & filtering for limits and controls.

What your people can see

Connected people, including every member of a team you join, can see your name, profile photo, protection-status alerts, chosen alert wording, and what you share in chats. They can also always see your profile stats: current and longest streak, whether protection is on now, times protection was turned off and time protected this month, total time protected, and when your last alert was sent. Stats can’t be hidden; to stop sharing them, leave the team or remove the connection. Weekly recaps may include protection-based awards and the app’s optional mugshot-style entries. These are not clinical assessments or evidence of browsing behavior. Your team does not receive DNS queries or a browsing log.

Messages and alerts can appear in lock-screen previews, inboxes, or shared devices. Recipients can copy or forward them. Team chat is stored on our backend; it is not represented as end-to-end encrypted.

How we use and share information

We use information to provide blocking and accountability, connect people, deliver messages, verify consent and purchases, honor opt-outs and deletion requests, address abuse, and maintain the service. We may disclose information when required by law or needed to protect people, our rights, or the security of the service.

• Apple provides Screen Time, Sign in with Apple, push notifications, and purchase services.
• Supabase hosts app identity, records, and backend processing.
• OpenAI Sites and Cloudflare host this website and its consent storage.
• OVHcloud hosts the VPN gateway. Cloudflare provides upstream family-filtering DNS. Where separately enabled, the app’s DNS protection can use AdGuard’s resolver.
• Twilio processes phone verification, text delivery, and messaging opt-outs. Brevo processes accountability email delivery, delivery or suppression feedback, and the report emails sent to our support inbox.
• Microsoft 365 hosts our support inbox, including chat reports and support messages.

Each provider receives only what it needs to run its part of Busted and is bound by terms that require it to protect that information at least as well as this policy does. In particular, see Cloudflare’s public resolver privacy information and AdGuard DNS privacy information. Information may be processed in the United States and other countries where providers operate.

We do not sell personal information or share it for cross-context behavioral advertising. Mobile information and SMS consent are not shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data is not sold, rented, or transferred to another brand or campaign. Service providers may process consent and contact information only as needed to deliver and manage the Busted messaging service or meet legal obligations.

Children and teens

Busted is for people 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from them. Users aged 13 to 17 need a parent’s or guardian’s permission.

Where the law requires it, Apple tells the app a user’s age range (for example, 13 to 15) and whether a parent or guardian has approved. Busted uses this only to apply age requirements and parental choices. It is not used for advertising or shared. The age range itself is not stored on our servers; we keep only whether you are under 18 (see Age and agreement). Where these laws apply, the app also sends us Apple’s app transaction identifier so that, if a parent or guardian withdraws approval through Apple, we can suspend the account; we keep a record of Apple’s notice. If we learn that we have information from a child under 13, we delete it. A parent or guardian can contact support@getbusted.org about a teen’s account.

Storage and retention

The app stores preferences, selected blocking tokens, cached information, and local session history on the device. Backend records support accounts, conversations, consent, subscriptions, protection, and delivery. We keep these records while needed for those purposes, dispute resolution, security, and applicable obligations; we do not promise one deletion deadline for every category.

On the VPN gateway, completed or inactive runs and their associated events are normally pruned after 90 days. Unacknowledged, unretired delivery records may remain longer. Routine heartbeat, permission, and error event rows are pruned after 24 hours, and device-removal markers after seven days. These periods apply to the gateway records, not every app record, backup, provider log, or message a recipient already received.

If a report shows possible child sexual exploitation, we report it to the National Center for Missing & Exploited Children as US law requires and preserve the related accounts, profile and team photos, and conversations for at least one year, even if an account is deleted. Preserved copies are used only for that report and any legal process.

We retain consent and suppression evidence as needed to document permission and prevent unwanted messages. Account deletion removes associated active account records and requests removal of gateway credentials and device history, with retries if the gateway is unavailable. Backups, security logs, legally required records, and recipients’ copies may remain for their applicable retention periods.

Your choices and requests

You can manage protection, recipients, alert wording, team membership, and your account in the app. Text recipients can reply STOP or use their private consent link; email recipients can use the unsubscribe link. See account and data deletion. Removing the app does not automatically delete server data or cancel an Apple subscription.

Contact support@getbusted.org to request access, correction, deletion, a copy of your information, or help exercising rights available where you live. We may verify your identity or authority. If we cannot fulfill a request, we will explain the applicable reason and any available review process. Do not send browsing history, passwords, or payment details.

Website privacy and security

We do not add advertising trackers to the website. Hosting services may use essential cookies and technical logs for delivery and security. Consent forms use bounded requests and short-lived hashed network identifiers for abuse prevention. Private receipt tokens remain in URL fragments and are not deliberately sent in ordinary page-request URLs. Protect these links: anyone with one may be able to change the associated permission. The website does not track visitors across other sites, so it does not respond differently to browser Do Not Track signals.

We use HTTPS and access controls. No service guarantees absolute security. Busted is for voluntary use, not covert surveillance. Contact us if someone submitted information without authority, including a child’s information. We may update this policy and will revise its effective date; material changes will be communicated as appropriate.