Last updated October 30, 2026 · BAD ADS by OTECH Labs
BAD ADS is a game about beating ads, so we keep this short and we don't do what the ads do: no ad networks, no ad trackers, and we never sell your data or track you across other companies' apps and websites. This page says what the game stores, why, for how long, and how to delete it.
Device ID. The first time you play, your browser (or the app) gets a random ID, kept on the device with your save. It counts your Daily tries, verifies scores, checks reward codes and stops abuse. It isn't tied to your name, email or IP address. Clearing your browser's site data, or deleting the app, gives you a new one (and a fresh save).
Gameplay events. A handful of anonymous events (a run started or ended, a fight or mini-game finished, a card pick, how long the first tap took) are sent with your device ID and the game details: scores, times, choices. We use them to balance the game. They contain no names or emails.
Visits. Each time the game's site opens we note, with your device ID: when, the page it opened on, the name of the site or app that linked here (like x.com, not the post), any campaign tag in the link, the kind of device, system, browser or app (like “phone, iOS, Facebook app”, never the full browser string), and the country and region our host looks up from the connection. The IP address itself isn't kept. We use visits to see how people find the game. Bots and our own staff's browsers are left out.
Hashed network. When you start a ranked run or a 1v1, post a score, win a sponsor reward, or report a name, a sponsor bot or a bug, we keep a salted one-way hash of your network (your IP address, or the block it belongs to), never the address itself. It limits abuse, like one household farming rewards or Daily tries. It can't be turned back into your IP address.
Scores. Posted scores are shown on the leaderboards with the name you picked. Replays of verified runs (your inputs, not video) are kept to check scores and power the “challenge a friend” links and 1v1 ghosts. A 1v1 duel's page shows the name, damage and cards of the player who set it, and the names and damage of everyone who answered, to anyone with its link.
Your look and your squad. Once you change your bot's look, the look you have on (paint, trim, hand trim, visor, head piece, emblem, finisher, title and banner, and the mastery steps you've earned in it) is saved with your device ID and shown next to your name on the leaderboards, 1v1 pages, squad pages, your player card (/p/ and your name) and shared-link previews. The list of looks you own is saved with your device ID too, to count how rare each look is; your player card shows your three rarest and how many you own. Wins the server checked in a look (from replayed Ladder, Daily, World Boss, Street and 1v1 runs) are kept with your account, or your device ID as a guest, and shown on your player card. Signed in, the first-edition numbers you earn (“#37 to earn this”) are kept with your account and shown on your card. A look that only comes from a purchase is shown only if the purchase is on record; for that, a purchase made in the app without an account is linked to your device ID. If you join a squad, its page shows the squad's name and each member's name, look and World Boss damage that week to anyone with its invite link. Squad names are picked from preset words. Leave a squad any time from its page.
Bug reports. If you report a bug, we keep what you wrote and the kind of problem, plus the screen you were on, your device type and screen size, your browser's details (its user-agent string: browser, system and their versions), the fight you were in, your device ID, your account if you're signed in, and the hashed network. We use them to fix the game and pay bug rewards.
Email and password. Your email address and a password, stored as a one-way hash by our sign-in library. We email you a link to confirm the address, and a reset link if you ask for one; we store whether the address is confirmed and that you said you're 13 or older.
Apple or Google. If you continue with Apple or Google (where offered), we get your account ID with them, your email and your name (Apple lets you leave the name out; Google also sends your profile picture). Sign in with Apple also lets you hide your email: then Apple gives us a private relay address that forwards to you, and we never see the real one.
X. If you continue with X, we get your X user ID, display name, username, profile picture and, if X has confirmed it, your email. X's sign-in tokens are stored encrypted. We never post to X or read your posts.
Cloud save and sessions. Your game progress is saved to your account so you can play on other devices. Sign-in sessions record when they were made, plus the IP address and browser they came from, for security.
On the website, payments go through Stripe. In the iPhone app they go through Apple's App Store, and in the Android app through Google Play; RevenueCat checks those purchases for us. We store what you bought, the price, its status (paid or refunded) and the payment's reference (Stripe's IDs, or the store's transaction ID) so we can deliver it and restore it on your other devices. If you buy in the app without an account, the purchase is filed under an anonymous purchase ID that RevenueCat makes for the app, and it moves to your account if you sign in. RevenueCat gets the store's receipt and your account ID (or that anonymous ID). We never see or store your card number or your Apple or Google payment details; Stripe's, Apple's and Google's privacy policies cover what you give them.
If you allow notifications in the iPhone or Android app, OneSignal sends them for us. OneSignal keeps your phone's push token and an ID we give it: “user:” and your account ID if you're signed in, or “device:” and your device ID if not. Its app code also sees basic details like your phone model, system version, language and time zone, and, like any service your phone connects to, its IP address. We keep your notification choices and time zone (so the Daily reminder arrives in your morning), whether the app can get pushes, the notifications in the game's bell, and a log of what we sent and whether it went out. Turn them off any time in your phone's settings.
If your account has an email address, OneSignal sends our emails for us, from hello@badads.lol. Emails about your account always come: confirming your address, resetting your password, a welcome when you sign up, receipts for purchases on the website, and confirmation when you delete your account. Game news and reminders (a weekly prize waiting, a reminder after a few days away, real news about the game) come only if you say yes: we ask once, right after you make an account (“Get game alerts?”), and you can turn them on or off any time in Settings → Notifications. In some places, the EU for example, we ask your birth month and year first, because game news by email there is for players 16 and up. They come one a week at most, and every one has an unsubscribe link. We keep that choice, when and where you made it (the country, never your IP address), and a log of what we sent (the kind of email, when, and whether it went out, with only your address's domain, not the address). OneSignal gets your address to deliver each email and may record whether it was delivered or opened. Links in our emails aren't tracked.
Businesses (and people) who sponsor a bot send us a name, a logo, the bot's lines, an optional reward and link, and a contact name and email. Once a person on our team approves it, the name, logo, lines, reward and link are shown in the game to everyone. The contact details stay private: we use them for approval, receipts and support. Player reports about a sponsor bot (the reason, your device ID and hashed network) are kept so we can review it. Reward codes record the device that won them, when, and when a business marked them used.
We count visits with Vercel Web Analytics, on the website and in the apps: which pages are viewed, the page that sent you here, your browser, operating system and type of device, and your approximate country. Vercel Web Analytics sets no cookies and does not use advertising IDs. Vercel tells visits apart with a code made from the request that resets every day, so it can't follow you from one day to the next or across other websites, and we only see totals. The site may also set __vdpl, a strictly necessary Vercel cookie that keeps you on one version of the site.
Vercel hosts the game and counts visits, Neon runs its database, and Stripe handles payments on the website. In the apps, Apple and Google handle purchases (and Sign in with Apple or Google, if you use it), RevenueCat checks app purchases, and OneSignal sends notifications and emails. X handles X sign-in. They process data only to provide those services to us.
A job runs every day and deletes what's past its time:
Totals that don't identify anyone (like how many fights a sponsor bot had) are kept. Account data, your cloud save and your notification choices: until you delete your account. Purchase records are kept as long as tax and accounting law requires, without your name or email once you delete your account. Sponsor requests and contact details are kept with the sponsor's payment records; once the bot has ended, email us to delete the contact details.
BAD ADS is made for players 13 and up, and you can play without giving us personal information. Accounts are for players 13 and up too (X requires 13+ as well). BAD ADS isn't meant for children under 13, and we don't knowingly collect personal information from them; if you think a child under 13 has given us some, email us and we'll delete it.
We don't use advertising or cross-site tracking cookies. Our hosting (Vercel) may set __vdpl, a strictly necessary cookie that keeps you on one version of the site. It expires quickly. We count page views with Vercel Web Analytics, which doesn't use advertising IDs. The game also saves your progress in your browser's local storage.
What we store on your device, and the cookies Stripe, X, Apple and Google set when you pay or sign in with them, is on the cookies page.
BAD ADS is operated by Otech Labs LLC, 33 W Palmer St, Danielson, CT 06239. If this policy changes, we'll update the date at the top and, for big changes, say so in the game. Questions: support@otechlabs.io.