One policy.
Bare minimum.

Website

This website introduces The Stupid App and its apps. It has no accounts, forms, purchases, or mailing list sign-up. Fonts and page resources are served from this site.

OVERPAID calculator

The calculator at /overpaid/en/quiz/ runs entirely in your browser with the public price catalog. What you tick is kept only in the part of the address after “#”, which browsers never send to the server, and from there you can hand it to the OVERPAID app on your phone. Web Analytics counts each step of the calculator as a page, without knowing what you ticked.

Visits

We use Cloudflare Web Analytics to see how many visits each page gets and where they come from. It uses no cookies, stores nothing in your browser and doesn’t build a profile to follow you across sites. Cloudflare receives technical visit data, such as the page, the referring site, the browser and approximate country, and shows us only aggregate figures. We haven’t added advertising pixels or our own cookies.

Hosting and security

The website is hosted on Cloudflare. To deliver and protect these pages, its infrastructure processes technical request data, such as IP addresses. Its security features may use essential cookies when needed. See Cloudflare’s privacy policy.

DON’T privacy

DON’T stores your press count, nickname, acceptance of the Terms, pending presses, and earned badges on your device. You can play without an email address or password.

Counter and leaderboard

To provide the world counter and leaderboard, the app creates an anonymous technical identifier in Supabase. It stores your chosen nickname, presses, weekly and total scores, batches used to prevent duplicates, nickname reports, and technical data needed to authenticate and protect the service. The top ten nicknames and scores are public inside the app.

Country

The app sends the country of the region set on your device (a two-letter code, for example ES) and stores it with the anonymous identifier. We use it for aggregate statistics by country and, in the future, for country leaderboards. We do not use GPS or your IP address to obtain it. You can change it by changing your device region, and it is deleted with “Delete my data”.

Purpose and retention

Technical progress is processed to provide the game and leaderboard. Your nickname is published when you accept the Terms of Use. Profile data and batches remain while the anonymous profile exists and are deleted when you choose “Delete my data.” Reports may be retained while needed for moderation, security, and abuse prevention.

Providers and location

Supabase hosts authentication and the database in its London, United Kingdom region. Cloudflare delivers and protects this website. Cloudflare and Google handle support email. These providers may process the data needed for their services under their own policies and security measures.

Device features

The surprise at press 5 is a screen-only flash. The app does not request camera access or capture photos or video. The accelerometer detects a shake on your device and its measurements are not sent. Presses trigger haptics. Theme and language follow device settings.

Control and deletion

You can change your nickname, block names, report content, and delete the anonymous identifier, score, nickname, and local progress from the app. You can also use the deletion page. Uninstalling the app may remove your access to its anonymous identifier.

Ads and payments

The leaderboard may display a banner served by Google AdMob. No ads appear on the button screen or during the challenge. Before requesting ads, we check privacy choices through Google UMP. Where applicable, you can change them through “Ad privacy choices” on the leaderboard. We request non-personalized ads and do not request cross-app tracking authorization.

The advertising SDK may process IP addresses and inferred approximate location, app or device identifiers, advertising interactions and diagnostic information to serve and measure ads and prevent fraud. We do not send AdMob your nickname, score or personal best. See Google’s privacy policy.

The one-time “No ads · Support the team” purchase removes ads. Apple or Google handles payment; we do not receive card details. The app queries product and transaction status and stores the ad-free entitlement locally. Restore it with the same store account. Deleting progress does not cancel a purchase; refunds and commercial records are managed by the store.

Your 15- and 60-second challenge personal bests stay on your device and are removed by “Delete my data.” Sharing a result or a badge opens the system share menu and sends the image or text only to the destination you choose. We do not include a separate analytics tool.

THE SAFE privacy

THE SAFE works without an email, a password or a visible account. So that the safe is the same for everyone and each person gets one guess a day, the app creates an anonymous technical identifier.

What we store on the server

• The anonymous identifier and an automatic alias (for example PLAYER 7F3A) that can’t be changed and contains nothing about you.
• Your guesses: the combination, the safe and the day (UTC). They’re needed to enforce one guess a day and to make sure no combination is tried twice.
• If you open a safe: that it was you (your alias is shown) and, if you choose to sign it, the name you type. Signatures are reviewed before they appear.
• Aggregated counts of repeated combinations and technical counters that limit abuse.
• If you turn on “Safe alerts”: the device’s notification token and language.
• Minimal usage events to know whether the app works: first open, first guess, coming back another day, sharing, seeing an opened safe, starting and finishing a purchase, and turning on alerts. We don’t use third-party analytics.

What stays on your device

Preferences (sound, alerts, finish, frame), the latest safe information so it can be shown offline, your personal stats, and the daily reminder, which is a local notification scheduled on the phone itself.

Basis, purpose and retention

We process this data to provide the game you ask for by using the app. Guesses and safes are kept while the game exists because they make up each safe’s public history (without data that identifies you). Events and technical counters are kept only as long as their purpose requires.

Providers and location

Supabase hosts the database and anonymous authentication in its European London region (United Kingdom). If you turn on safe alerts, they’re delivered through Expo’s push notification service (United States) and Apple Push Notification service or Google’s Firebase Cloud Messaging. Cloudflare serves this website. Each provider processes the data its service needs under its own policies.

Ads

If you don’t support the app, at most one full-screen ad a day may appear, and only after a wrong guess. Never while you type a code or when a safe opens. Ads are served by Google AdMob. Before requesting ads we check your choices with Google UMP, and you can change them from Settings. We request non-personalised ads, we don’t ask for permission to track you across apps, and the app doesn’t use the Android advertising ID. Google’s SDK may process IP address, derived approximate location, technical identifiers and diagnostics to serve and measure ads and prevent fraud (Google’s policy). We don’t send your alias or guesses to AdMob.

Purchases

“Support THE SAFE” is a one-time purchase that removes ads and unlocks cosmetic extras; tips are optional and unlock nothing. No purchase gives guesses, hints or advantages. Apple or Google handle payment: we never receive card details. The app stores on the device whether you’re a supporter, and you can restore it with the same store account.

Control and deletion

In Settings, “Delete my data” deletes the anonymous identifier, alias, alert tokens and local data. Your past guesses and usage events are unlinked from you so tried combinations keep counting for everyone; if you opened a safe, the archive will show “anonymous”. More on the deletion page.

Children

The app doesn’t ask for age or personal data and is meant for a general audience. Signatures are reviewed before they’re published.

OVERPAID privacy

OVERPAID works without an account, email, bank access or reading your inbox. What you pay and for which services is stored only on your device.

What stays on your device

• Your subscriptions: service, plan, price, frequency, billing dates, notes and reminders.
• Your answers to savings questions (for example, whether you need 4K or how many people watch at once) and your savings history.
• Settings (country, currency, reminders) and a copy of the public price catalog so the app works offline.
• Renewal reminders are local notifications scheduled by the phone itself.

We have no server holding your data: we cannot see, sell or lose it.

What is downloaded from our server

The app downloads the public catalog of services, plans and prices, and an icon for each service. The request only includes the catalog version it already has, never which subscriptions you have. We fetch the icons once from each service’s website and serve them from our own storage: your phone never contacts the brands’ sites.

Providers and location

Supabase hosts the catalog and icons in its European region in London (United Kingdom); like any web server it receives the IP address and technical data needed to respond. OVERPAID uses no analytics, ads or tracking tools, and does not ask for cross-app tracking permission.

Purchases

OVERPAID PRO is a one-time purchase. Apple or Google handle payment: we never receive card details. The app stores on the device whether you have PRO, and you can restore it with the same store account.

Control and deletion

In Settings you can export your data to a file, import it on another phone or delete it all. Uninstalling the app removes it too.

NOT BAD privacy

NOT BAD works without an account, email or ads. Your results are stored on your device.

What stays on your device

• Your daily results: score, categories, duration and how each game went.
• Your streak, personal bests, the level of each game and your practice runs.
• Settings (language, haptics, colour games, country in stats) and a random ID created on the phone itself. That ID is not the device’s, your store account’s or an advertising ID.

What is sent to our server

If you are online, when you finish the daily challenge the app sends, once: the random ID, the date, the challenge version, the score from 0 to 100, how long it took, the app version and, unless you turn it off in Settings, the country code set on the phone. It is used only to work out where you rank (“Top 18% today”) and aggregate statistics. Your answers and per-game details are never sent. The app also downloads the game’s public settings and the day’s challenge.

How long it is kept

Anonymous scores are kept for 24 months from the challenge date and then deleted automatically, together with their weight in each day’s statistics. What is on your phone stays until you delete it or uninstall the app.

The app has a closed list of anonymous usage events ready (for example “challenge started” or “challenge finished”), but they are not sent today. If we turn them on, we will update this policy first.

Providers and location

Supabase hosts the anonymous scores and settings in its European region in London (United Kingdom); like any web server it receives the IP address and technical data needed to respond. NOT BAD uses no ads or tracking tools, and does not ask for cross-app tracking permission.

Purchases

NOT BAD PRO is a one-time purchase. Apple or Google handle payment: we never receive card details. The app stores on the device whether you have PRO, and you can restore it with the same store account.

Control and deletion

In Settings, “Delete all my data” removes what is stored on the phone and the scores linked to your ID on our server; if you are offline, the server deletion is retried the next time you are online. If you uninstall the app without deleting first, the phone data is removed and the anonymous scores remain with no way to link them to you.

Children

The app doesn’t ask for age or personal data and is meant for a general audience.