Privacy policy

Effective November 9, 2026

Busted only works if you can trust it. This page explains, in plain words, what the app collects, why, who sees it, how long we keep it, and how to delete it.

1. Who we are

Busted is run by Kareem Jandali (the developer of Busted), based in Ontario, Canada ("we", "us"). We are responsible for the personal information described here. Our privacy contact can be reached at bustedapp.help@gmail.com.

2. How detection works

When you turn Busted on, iOS installs a VPN configuration for the app. Despite the name, it doesn't send your internet traffic to us. The check runs on your phone and does one thing: it looks at website name lookups (called DNS lookups, like "example.com") and checks each one against a list of known adult sites that is stored on your phone.

• Every lookup is answered by your network's own DNS server (your Wi-Fi's or mobile carrier's, the same one your phone uses without Busted). If that server is slow (no answer within about half a second) or doesn't answer, the lookup is also passed on unchanged to Cloudflare's public DNS (1.1.1.1), and the first usable answer is used. Nothing is blocked or changed unless you turn on the optional porn blocker (see below).
• If a lookup isn't on the list, Busted forgets it straight away. It isn't saved on your phone and isn't sent to us.
• If a lookup is on the list, Busted sends a small "match" to our server so your chats can be told. If your phone is offline, the match waits on your phone until it can be delivered, then is removed from the phone.

The optional porn blocker. It's off unless you turn it on in Me. While it's on, your phone itself (not our server) stops sites on the list from loading by answering their lookups with an address that goes nowhere, sends Google and Bing searches to their SafeSearch versions, and gives the signal Apple documents for networks that filter content, so iOS may ask you to turn off iCloud Private Relay on that network. All the blocking happens on your phone; turning it off puts everything back to normal.

Busted's VPN setting is used only for the check on your phone. We don't sell, use or disclose data from it to third parties for any purpose; lookups only go to the DNS server that answers them.

Busted only sees lookups made on the phone where it's turned on. It doesn't read the pages you visit, your messages, your photo library or anything else on your phone. The only photos it ever handles are the ones you pick yourself to send or use as a picture (see below).

Busted on a computer

You can also put Busted on a Windows PC and link it to your account. You link it yourself: the computer shows a code, and you enter it in Busted on your iPhone (Me, then Computers) after reading what it does. Nothing is linked without that step.

On the computer, Busted runs as a background program and does the same single thing as on the phone: it looks at website name lookups and checks each one against the list of known adult sites, which is stored on the computer.

• Lookups are answered by your network's own DNS server, the one the computer uses without Busted. A lookup that isn't on the list is forgotten straight away: it isn't saved on the computer and isn't sent to us.
• So that lookups keep going through Busted, it changes three things on the computer while it's installed: the computer's lookup settings point to Busted; other programs can't send lookups to a different lookup service; and Chrome, Edge, Brave and Firefox are set to use the computer's normal lookups, which is why they show "Managed by your organization". Busted also answers "not available" to a short, fixed set of lookups that software uses only to switch to a different lookup service. Removing Busted puts all of these back exactly as they were.
• Other people who use the computer. Busted is installed for the whole computer, but a visit only counts while the Windows account that linked it is the one signed in and using it. Lookups made while someone else is using the computer, or while it's locked, are not counted, not saved and not sent. Anyone who signs in can open Busted from the icon by the clock and see whose account the computer is linked to. If your porn blocker is on, it applies to the computer for everyone who uses it.
• Busted on the computer doesn't read the pages you visit, your files, your screen or what you type.

3. What we collect and why

Match events ("hits")

Only when a lookup matches the list: the time, the site's main domain (for example "example.com"), and which of your devices it came from. Why: to work out whether you visited a site, and when.

Visits

Matches close together count as one visit. A visit record belongs to you (not to a chat) and keeps the time and the site's main domain. It also notes whether it was detected or confessed, and whether you disputed it, with the reason you chose, and how your friends voted and the result. Why: to post the alert in your chats, restart your streak, and build your calendar, the leaderboard and the nightly and weekly reports. A forgiven visit doesn't count against you.

Because match events and visits relate to your sexual behaviour, we treat them as sensitive information and only collect them with your express consent (see section 8).

Blocked tries and the porn blocker setting

Only if you turn on the porn blocker: each time it stops a listed site, the time and the site's main domain (for example "example.com"), and which of your devices it came from; and whether the blocker is on or off, with when you last changed it. Why: to tell your chats that you tried and the blocker stopped it, to tell them when you turn it off, to show "Blocker on" on your profile, and to list the sites the blocker stopped in My activity (only you see that list). A blocked try isn't a visit and doesn't restart your streak. Like visits, blocked tries are sensitive information and covered by your consent.

Check-ins, and when Busted is off or paused

Your phone tells our server whether Busted is on, paused or off, along with your app version, the device type (for example "iPhone"), your battery level, whether it's charging, and whether Busted started right after the phone was turned on. When Busted stops, it may also send a short technical code saying why. We also keep a record of each time you turned Busted off or paused it, or your phone stopped checking in. Why: so your chats can be told when you pause or switch Busted off, or when your phone stops checking in, and so a dead battery or a restart isn't mistaken for Busted being turned off. If your phone stops checking in with a low battery, your chats see the battery level. That's part of what you agree to.

When Busted was off (or your phone didn't check in) for more than 30 minutes, the app asks you why and whether you slipped. We save your reason, your answer and when you gave it, and your chats see them. If you say you slipped, or don't answer within 24 hours, that time counts against your streak (we save when it started and ended). Time your phone was dead or restarting isn't counted.

How the app is working

To find and fix problems, the app and the VPN part send us iPhone's own crash, freeze and performance reports (Apple's MetricKit; no outside analytics company), how long server requests and screens take to load and whether they failed (only the request's name, like "my_home", never what was sent), and numbers about website lookups: how many there were, how long they took, and how many went to Cloudflare. Never which sites. These are sent only after you agree to the consent screen. Why: to keep Busted fast and working.

Computers you link

For each computer you link, we store: the name you gave it (only you see the name), that it's a Windows PC, the Busted version and Windows version on it, when it was linked, and a scrambled copy (a hash) of the keys the computer made for itself, so we can recognise it. The keys themselves never leave the computer.

While it's linked, the computer sends: matches and blocked tries, the same as your phone (the time and the site's main domain); a check-in every few minutes saying that Busted is working and whether you are the one using the computer right now; and a note when Busted on it goes to sleep, shuts down, is turned off, is removed, wasn't working for a while when the computer was in use, or has its browser setting turned off or on. We use these to tell your chats what you agreed they'd be told (section 5) and to avoid telling them about ordinary sleep and shutdowns.

The computer keeps a small diary for itself (one line a minute: the time, whether Busted was working, whether you were using the computer). It contains nothing about lookups or websites, stays on the computer, and is deleted when you unlink or remove Busted.

When a computer asks for a linking code, we keep a scrambled copy of its network address for one hour, only to stop anyone requesting codes in bulk. A few times a day the computer also checks our website for a newer version of Busted and downloads it if there is one. That request says nothing about you or your account, and we don't keep a log of it.

Account information

• Your Sign in with Apple user ID.
• The name Apple shares, if you allow it. We only use it to suggest your display name. Busted doesn't ask Apple for your email address.
• The display name you pick, and a short bio if you write one (up to 150 characters). Your friends see both on your profile, with your streak, badges, clean days, visits, whether Busted is on, whether the porn blocker is on (the same things the leaderboard shows them) and the date you started using Busted. We also keep names you used before, only so we can remove them from old chat messages if you delete your account.
• Your time zone, so your streak days and reports line up with your own day.
• The last streak badge you reached, when you last opened your updates (the bell) and when you last read each chat, so we can show what's new.
• When you last had the app open (updated about once a minute while it's open), and whether you show when you're active, so friends can see when you're active (you can turn this off in Me).
• A record that you confirmed you're 18 or older and agreed to the consent screen, with the date and the version of the screen you agreed to.

Why: to create and secure your account, show your name to your friends, work out your streak, and keep proof of your age confirmation and consent.

Things you create in your chats

Chat names and settings (for chats you run), chat messages, emoji reactions, confessions, disputes, your votes on friends' disputes (shown with your name to the people in the chat), the people you block, and any reports you file. Why: this is the app itself. Messages and reactions are shown in the chat where you posted them. Blocks and reports are private to you and to us.

Pictures and GIFs

Your profile picture, a chat's picture (set by its admin) and photos you send in a chat. Only the photo you pick leaves your phone: Busted makes a smaller copy and removes its location and camera details first. Before any picture is sent, your phone checks it for nudity and refuses pictures the check flags; pictures you receive are checked again on your phone and hidden if flagged. The check happens on your phone and nothing about it is sent. No automatic check is perfect, so you can also report a photo, or the person who posted a picture. Pictures are stored privately: your profile picture is seen by your friends, and a chat's picture and photos by that chat's members. When you delete a photo message, change your picture or delete your account, no one else can see the file any more, and it is deleted from our storage. If someone has reported it and the report hasn't been reviewed yet, we keep it privately until it has been, then delete it. GIFs come from GIPHY: when you search for one, your search words go from your phone to GIPHY, and when a GIF is shown, your phone loads it from GIPHY. We store only which GIF was sent. Why: so you and your friends can share pictures in your chats.

Links and tags

When you send a message with a web link, your phone opens that page (only its top part, no scripts) to make a preview: the page's title, the site's name and one picture. Like any visit, the site sees your phone's internet address. If the link redirects, your phone checks each new address against Busted's list before following it, so making a preview never opens a listed site. The picture goes through the same nudity check and is stored like a photo; the preview is seen by the chat's members. Your friends' phones show that saved preview and don't contact the site unless they tap the link. Links to sites on Busted's list (or links that lead to one) can't be sent, and before any link opens, your phone checks where it leads and won't open one that ends up on a listed site. When you tag someone (@name or @everyone), we store who you tagged so their notification can say you mentioned them. When you delete a message, its preview and tags are removed and the preview's picture is deleted from our storage. Why: so links in your chats look and work like they do in other messaging apps, without exposing anyone to a listed site.

Push notification token

A token from Apple that lets us send notifications to your phone. Why: to send you alerts, reports and reminders. You can turn notifications off in iOS Settings at any time.

Muting a chat: if you mute a chat, we store until when it's muted, with your membership of that chat. Why: so we hold back that chat's notifications until then (tags, Busted alerts and dispute votes still reach you).

Reports and moderation

If someone reports a message, a bot message or a person, we see the report, the reason, the reported content and the chat it came from (for a report about a person, a chat the reporter shares with them) so we can review it. Why: to keep chats safe and to meet the App Store's rules for apps where people can post content.

Technical logs

Like any online service, our backend provider keeps short-term technical logs (such as IP address and the time of a request) for security and troubleshooting. We don't use them to track you.

4. What we never collect

• Your browsing history, or any website that isn't on the list of adult sites.
• The content of web pages you visit, your web searches, or anything you watch. The only page content we store is a link preview (title, site name and picture) for a link someone sends in a chat.
• Your contacts, your photo library (only the pictures you choose to send), your location or your microphone.
• Advertising IDs. There are no ads, no tracking and no outside analytics companies in Busted (crash and speed reports go only to us; see "How the app is working").
• Payment details. Busted has no money, betting or purchases.

5. Who can see your information

Your friends are the people you share at least one chat with. Chats are private, invite-only and hold up to 20 people. You can be in up to 10.

• Your friends see your streak, best streak, badges, clean days and visit counts on the leaderboard, whether Busted is on, paused or off on your phone, and your visits, confessions and disputes.
• When you visit a listed site, the Busted bot posts a plain message (for example "🚨 Ava visited a porn site.") in every chat you're in. The morning report at 10 AM (about the day before) and the weekly recap list who was caught, who stayed clean, who isn't set up and who has Busted off, plus that chat's streak leaderboard.
• By default, alerts say "a porn site", not the site's name. The admin of a chat can choose to show site names in that chat; the chat settings show which is on.
• Your chats are told when you pause Busted or switch it off, and are told if your phone stops checking in.
• If you link a computer: your friends can see that you have Busted on a PC and whether it's on, asleep or off, never its name. A visit on the computer posts the same alert as on your phone, and the alert's details say it was on your PC. Your chats are also told when Busted on the computer is set up, turned off, removed, wasn't working for a while when you were using it, or has its browser setting turned off. Sleep and shutting down are never posted.
• If you use the porn blocker: your friends see whether it's on or off (on your profile), your chats get a post when you turn it on or off, and when it stops a listed site the bot posts a plain message (for example "🛡️ Ava tried to open a porn site. The blocker stopped it.") in every chat you're in, with the site's name only in chats that show site names.
• Chat messages, photos, GIFs and reactions are seen only by the people in the chat where you posted them. Someone who joins a chat later only sees what's posted from when they join, including the Busted bot's messages. Your profile picture is seen by your friends.
• In a chat, its members see how far you've read (a small picture of you under the last message you've seen) and your emoji reactions.
• Friends see when you're active ("Active now" or "Active 5m ago", for up to a day) unless you turn off "Show when you're active" in Me; then you don't see theirs either. People who have a chat open see when you're typing in it. Typing signals go straight to them and aren't stored.
• Notifications about visits and confessions say who it was (for example "🚨 BUSTED! Sam just got caught" or "🙏 Sam confessed to a visit"), never the site. Notifications about blocked tries and disputes are generic. Other notifications say who (for example "📴 Sam turned Busted off"), never a site. Chat message notifications show who sent it and what they wrote (the sender's name, the chat's name, then the message, with any links replaced), or "Sent a photo" / "Sent a GIF". To keep them off your lock screen, set iPhone Settings → Notifications → Show Previews to "When Unlocked". When Busted catches you, you also get one reminder per visit ("🚨 You got caught. Your friends were told"), and when Busted is off or stops checking in on your phone you're told too.
• A small number of people at Kareem Jandali (the developer of Busted) can access the data when they need to, for example to handle a report, answer a support request or fix a problem.
• We may disclose information if the law requires it (for example a valid court order), or to report illegal content to the authorities. We'll only disclose what's required.

6. Service providers

We use a few companies to run Busted. They process data only on our instructions or to provide their service, and not for their own marketing.

7. Our pledge: no selling, no sharing

We never sell, rent or trade your data. We never use it or disclose it to third parties for advertising, marketing, profiling, data brokering or any other purpose beyond the service providers listed above. We don't use your data for anything except running Busted for you and your friends. Sharing alerts with your own chats is the feature you agree to, not a disclosure to a third party.

8. Your consent

Before Busted turns on, the app shows a consent screen that explains what's detected, what's sent, who sees it, how to pause or quit, and that your chats are told if your phone stops checking in. Nothing is pre-ticked. Detection only starts after you tap "I agree" and approve the VPN configuration in iOS. The porn blocker is separate and off by default: the first time you turn it on, the app explains what it blocks and what your friends will see before anything is blocked or shared.

Linking a computer has its own consent screen on your iPhone, shown before you enter the computer's code. It explains what the computer checks and sends, what your chats are told, that only visits made while you're using it count, and the browser setting on Windows. The computer is linked only after you tap "I agree" and enter the code.

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies. Because match events and visits are sensitive, we rely on your express consent to collect them and share them with your friends. If you're in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25) also applies.

If Busted becomes available in the European Union or the United Kingdom, the GDPR / UK GDPR will apply. Match events and visits are "special category" data (data about a person's sex life), and we process them only on your explicit consent. Account data is processed to provide the service you asked for, and reports and security logs to keep the service safe.

9. How long we keep data

Weekly figures on the leaderboard reset every Monday; all-time totals stay. We may keep a small amount of information longer only if the law requires it, for example after reporting illegal content to the authorities.

10. Deleting your account

You can delete your account in the app: tap your picture at the top left of Home to open Me, then Delete account. You don't need to email us. Deleting your account:

• takes you out of every chat (if you ran a chat, the longest-standing member takes over; chats with nobody left are deleted);
• deletes your account and everything linked to it: hits, blocked tries, visits, records of when Busted was off or paused, devices, bot messages about you, chat messages, reactions, pictures you uploaded and reports you filed;
• removes your name from past daily reports and weekly recaps;
• revokes Busted's access to your Sign in with Apple account.

Deletion is permanent and can't be undone. Deleting your account also removes Busted's VPN setting from the phone you deleted it on, so detection stops there. If Busted is set up on any other phone, delete the app on that phone too.

11. Withdrawing consent and other choices

You can withdraw your consent at any time:

• Pause Busted in Me. Detection stops and your chats see that you paused.
• Turn off the porn blocker in Me. Sites load normally again and your chats see that you turned it off.
• Remove Busted from your phone. Your chats will see that Busted is no longer on.
• Unlink a computer in Me, then Computers, on your iPhone, or remove Busted on the computer itself (the Busted window, or Windows Settings, then Apps). The computer's settings go back to how they were, it stops sending anything, and your chats are told it was removed.
• Leave a chat. That chat no longer gets your alerts or sees your messages. People you still share another chat with remain your friends.
• Delete your account (see above).

You can also turn off notifications in iOS Settings, block people, and change your display name or bio (an empty bio removes it).

12. Your rights

You have the right to ask what personal information we hold about you, to get a copy, and to ask us to correct it. You can see what Busted has sent about you (matches from the last 90 days, and your devices) in the app under Me → My activity. You can withdraw consent at any time. Depending on where you live, you may also have the right to ask us to delete or move your data, or to object to some uses. Email bustedapp.help@gmail.com and we'll answer within 30 days. We may need to confirm it's really you first.

If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d'accès à l'information. In the EU or UK, you can contact your local data protection authority.

13. Security and data breaches

We protect your data with encryption in transit, strict access rules so people can only read data from their own chats and friends, and limited staff access. Your phone uses its own secret code to send matches, separate from your login, and we only store a scrambled (hashed) copy of it.

No system is perfectly secure. If a breach of security safeguards happens and creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected as soon as possible, as PIPEDA requires (and to the Commission d'accès à l'information for Quebec residents, and to EU/UK regulators where the GDPR applies). We keep a record of every breach.

14. Adults only

Busted is only for people aged 18 and over. We don't knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we'll delete it. If you think this has happened, please email bustedapp.help@gmail.com.

15. Where your data is stored

Your account and chat data are stored in Canada (Supabase, Canada Central region). Apple, GIPHY and Cloudflare operate worldwide, so the limited data they handle (sign-in, push notifications, GIF searches, DNS lookups) may be processed outside Canada under their own safeguards.

16. Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects what we collect or who sees it, we'll tell you in the app and ask for your consent again before it applies to you.

17. Contact us

Questions, requests or complaints: bustedapp.help@gmail.com
Kareem Jandali (the developer of Busted), Ontario, Canada