Privacy policy
Draft: should be reviewed by a lawyer before publishing.
Who is responsible
Steve Entertainment S.L. (Badan Studios brand), tax ID B19722198, registered at Calle Almendros 1B, 28270 Colmenarejo (Madrid), España. Contact: dibsy@badanstudios.com.
What data we process
What you give us when using dibsy!: the name you choose, your colour and profile photo, the groups you belong to, the chores you create, claim or complete, the proof photos you upload, chat messages and the reports you send us. Also an account identifier and minimal technical data (device type and app version) so it works and so we can fix problems. If you sign in with Apple or Google, we receive their identifier and, if you share it, your email. If you turn on notifications, we store your device's push token, and if you buy something, the status of that purchase (more on this below). Chat messages are end-to-end encrypted: they are encrypted on your phone and only the phones of the people in the group can read them; we only store encrypted text and cannot read it. If you report a message, your phone sends us its text so we can review it.
What we use it for
To provide the service (groups, board, chat and ranking), send you notifications if you turn them on, unlock what you buy, keep it secure, handle your reports and improve the app. Only if you give us permission (checkbox when signing up or in My profile → Email updates) will we use your email and name to send you news, offers and updates about dibsy! and other Badan Studios games. If you join the website waitlist, we only use your email to tell you when the app launches. We don't sell your data or use it for personalised advertising.
Push notifications
If you allow notifications, we store a push token for your device linked to your account so we can let you know, for example, about a buzz (when someone in your group reminds you about a pending chore), when someone steals one of your chores or when the group's week closes. They are sent through Expo's push notification service, which delivers them via Apple Push Notification service (iPhone) or Google Firebase Cloud Messaging (Android). You can turn them off in the app settings or your phone settings, and when you sign out we remove the token from your account.
Purchases and subscriptions
If you buy dibsy!+ (your personal subscription) or a Boost for a group, the payment is processed by Apple (App Store) or Google (Google Play): we never see your card details. We receive the purchase status (which product, the dates and whether it's active) through RevenueCat, our subscription management provider, to unlock the features you've paid for. Legal basis: performance of the contract (Art. 6.1.b GDPR).
Legal basis
Performance of the contract you accept by using the app and making purchases (Art. 6.1.b GDPR) and our legitimate interest in security and improving the service (Art. 6.1.f GDPR). We keep purchase records to meet our tax and accounting obligations (Art. 6.1.c GDPR). Push notifications are only sent if you allow them on your device. Marketing emails are based on your consent (Art. 6.1.a GDPR and Art. 21 of Spain's LSSI): it's optional, you can use the app without giving it and withdraw it at any time from My profile or with the unsubscribe link in every email. We record when you gave or withdrew it so we can prove it.
Who else sees your data
People in your groups see your name, colour, photo, what you do and what you write in that group. We use providers that process data on our behalf: Supabase (database and files, hosted in the European Union), Expo (app updates and sending push notifications), Apple Push Notification service and Google Firebase Cloud Messaging (delivering notifications to your phone), RevenueCat (subscription and purchase management), Vercel (website) and, if you allow marketing emails, an email delivery provider. When you buy something, Apple or Google process the payment under their own terms and privacy policies.
International transfers
Some of these providers may process data outside the European Economic Area (for example, in the United States). When that happens, they do so with the safeguards provided for in the GDPR, such as standard contractual clauses or, where applicable, the EU-U.S. Data Privacy Framework.
How long
As long as you have an account. If you delete it in the app (My profile → Delete my account), we delete your profile, points, photos and consent history; messages you sent remain without an author. When you sign out, we remove that device's push token from your account. If you withdraw your marketing consent, we stop emailing you right away. We keep purchase records for as long as tax and accounting law requires. Some backups may take up to 30 days to disappear.
Your rights
You can access, rectify and erase your data, object to or restrict its processing, ask for its portability and withdraw your consent at any time (without affecting what was done before). To delete your account, do it yourself in the app: My profile → Delete my account. You can download a copy of your data yourself in the app: Settings → Download my data. To request a copy of your data or exercise any other right, write to dibsy@badanstudios.com; we'll reply within one month at most. If you think we haven't handled it properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Minimum age
dibsy! is not aimed at children under 16. If you're under 16, you need permission from a parent or guardian.
Changes
If we change this policy we'll let you know in the app. Last updated: October 2026.