Questions & answers

Fair question — Badger isn’t quite like anything else on your phone, and that’s rather deliberate.

• At its heart Badger is a place to chat with the people you know and care about — in groups and one-to-one. Think of it less as a social network and more as a cosy back garden you only ever invite friends and family into.
• There’s no endless feed of strangers, no algorithm deciding who you should follow, no numbers going up. You add the people you actually want, and that’s the whole guest list. If they’re not in one of your groups or chats, they simply aren’t in your Badger.
• It’s completely private, too — every message, photo, video and file is end-to-end encrypted, so what happens in your Badger stays strictly between you and your people. Not us, not anyone.
• You can share your mood, what you’re up to, a little status, where you are — or none of it at all, because it’s all up to you. It’s a gentle way to feel close to your people without having to message them every five minutes.

So that’s Badger: small, private, and made of only the people you’ve chosen. That really is the whole point.

No. Badger is built so that we can’t, and that’s the single most important thing to understand about it.

• The rule is simple: the only people who can ever see anything you share in Badger are the people you chose to share it with. Not us, not an advertiser, not a government, not someone who ran off with our entire database. Nobody else, ever.
• And it isn’t just your messages — it’s everything. Your photos, your videos, your files, your voice notes, the lot. Every last byte is end-to-end encrypted: scrambled on your phone, and unscrambled only on the phones of the people you sent it to. Everywhere in between, our own servers included, it’s meaningless gibberish.
• Your mood, your status and your emoji are on their way into that same encryption — the scrambling is built and running, and the last piece is switching our own apps over to read it. Until that lands they’re shared only with the friends you’ve chosen, but we could still technically read them.
• It’s locked with keys that only your own devices hold, using the same calibre of encryption banks and governments trust. Nobody can crack it — not us, not an advertiser, not a hacker holding our whole database. The gold standard for this is Signal, and for your messages and media we are as secure as them. There’s simply nothing there for anyone to read, hand over, mine, or sell.
• Where you are works differently, and we’d rather say so plainly than bury it. Your location is held on our servers in a form we could technically read. So instead of leaning on the maths for it, we lean on doing less: we only ask your phone where it is while somebody you’ve allowed is actually looking at the map, we keep only where you are now rather than a trail of everywhere you’ve been, and we never use it for advertising. And there’s a switch: in Ghost Mode, nobody — not even us — can know where you are. That isn’t a setting that hides you from your friends while we quietly carry on collecting; your phone simply stops telling anyone, us included.

Privacy isn’t a box you tick in Badger — it’s the ground the whole thing stands on. For your messages and media it lives in the maths, today. For your location it lives in how little we ask for, and in a switch that stops us asking at all.

We completely understand the worry — “share my location” sets off alarm bells, and quite rightly. But Badger works nothing like the creepy tracker you might be picturing.

• Nothing is ever quietly running in the background watching you. Badger only shares where you are in the moment when someone you’ve allowed is actually looking at the map — then it goes straight back to sleep. There’s no company dashboard watching your dot drift about all day, and the people you share with only ever see where you are now, never a trail of everywhere you’ve been.
• You’re in charge of every last bit of it. Share your location with one group but not another. Flip on Ghost Mode to vanish from the map entirely while still chatting away. Or share no location at all — plenty of people use Badger purely for the groups and the chat.
• Nobody can add you, follow you, or see you without you agreeing to it first. There’s no search and no directory, so you can’t be stumbled upon, and everything is off until you switch it on.
• And in Ghost Mode, nobody — not even us — can know where you are. Your phone stops sending, and stops asking. It isn’t a filter we apply at our end after collecting your position anyway; there is nothing to filter, because nothing leaves your phone.
• Being honest about the one thing we don’t do: your position is held on our servers in a form we could technically read, unlike your messages and media, which are end-to-end encrypted today and genuinely unreadable to us. So for location we rely on collecting as little as possible, keeping only where you are now, never using it for advertising — and on that switch.

It’s really the opposite of being tracked: you decide who sees what, and when — and you can pull the plug whenever you like.

If you want Badger maps to work with your friends Badger needs to you turn on Location Always in settings. However, there are two very important things to realise about this.

• Badger doesn’t actually use your location all the time. It sits in the background not using up any battery while it’s in your pocket, or you’re using other apps on your phone. Only if somebody in a group or a chat that you’re a member of is actively looking at the map for that group or chat, Badger gets a little background nudge to wake up and send your position so that they can know where you are. You can control how often it gets nudged in the Location part of your own settings. The default is once a minute which hardly uses any battery at all.
• This is all — like everything else in Badger — completely under your control. If you’ve turned off location sharing permissions in your settings or on one particular group or chat then Badger doesn’t get the nudge and doesn’t wake up. Same thing if you’ve turned on Ghost Mode. It only wakes up if somebody you have permitted to see your location is actively looking at the map. Nobody except those people you have agreed to share locations with can ever see your location.

We take privacy and security very seriously here at Badger. It’s safe, secure and private to set “Always” in the location settings on your phone — and it won’t eat your battery either!

They’re the gentle heartbeat of Badger — a way to say how you’re doing without having to actually say anything.

• Your mood is a colour and a feeling you can set — happy, frazzled, cosy, whatever fits. It tints your dot on the map so your people get a sense of how you are at a glance.
• Your status and activity fill in the picture — a little “at the gym”, “heads-down”, “on the train” — so friends know whether to wave or to leave you be.
• None of it is compulsory, and all of it is yours to control. Set as much or as little as you like, change it whenever the mood takes you, or show nothing at all.

It’s the difference between a map of dots and a map of people. That’s rather the magic of the thing.

Short version: the ads are about as nosy as a billboard on a bus stop — and you can switch them off entirely. Here’s the longer version.

• They’re not personalised. Badger explicitly asks the ad network for non-personalised ads. They aren’t built from a profile of your behaviour — they’re the same ads anyone with your chosen interests would see.
• The only hint they get is one you choose to give. In Settings you can tick a few broad interest areas — Sports, Music, Travel, that sort of thing — and those tick-boxes are the only signal that’s ever passed along, so the ads lean vaguely relevant instead of totally random. Tick nothing and they stay generic.
• However, we recognise that adverts about things you’re just not interested in are pretty irritating. You have the option to set two sets of custom interests.
• These things and your broad interests are uploaded to the ad server but we don’t send your id, your location, anything at all that would identify you. As a result, you can get adverts which might actually be relevant to you but without the pain of your entire life being mined by Meta, Google and X.
• Your private life stays out of it. Ads are never based on your messages, your photos, or where you are. The only thing that ever leaves your phone for an ad is that short list of interest words — and since your messages and media are end-to-end encrypted, there’s nothing else there for anyone to mine even if they wanted to.
• No ad company gets to know you. We hand over your chosen interest words and nothing else — no name, no email, no contacts, no location, no identity.

And if you’d rather see none at all, Badger Plus clears them away completely. Ads are simply how we keep Badger free for everyone who’d rather not upgrade — never a reason to give your privacy away.

🧪 Alpha note: we’re still tuning the ads during the alpha, so you may spot test ads even though every tester is on Badger Plus right now — that won’t happen once we launch.

Yes — Badger is free to use, and the bits that matter most are free forever.

• Making groups and chats, seeing your people on the map, sharing your mood and location, going full Ghost — all free. No catch, no trial that quietly runs out.
• The free version shows the odd ad to help keep the lights on, and there’s an optional upgrade — Badger Plus — that clears them away and adds a few nice extras (longer videos, bigger files, polls). It’s there if you fancy it, and entirely skippable if you don’t.
• We’ll never lock your friends, your messages, or your privacy behind a paywall. The important stuff is free because that is the whole point of Badger.

So: free to use, with a little upgrade for anyone who wants to go further. No pressure either way.

🧪 Alpha note: during the alpha everyone’s on Badger Plus for free, and the purchase flow isn’t switched on yet — and you may spot the odd ad even on Plus while we’re testing them.

Badger has to keep the lights on somehow, and we’d far rather that came from the people who love it than from quietly harvesting everyone’s data. So the free version carries a few ads, and Badger Plus takes them away and throws in some nice extras besides.

• No ads. The obvious one — Badger Plus is completely ad-free.
• Longer videos — send clips up to five minutes, instead of thirty seconds.
• Bigger files — attach up to 10 MB rather than 1 MB.
• Longer voice notes — up to ten minutes, for when a text just won’t do.
• Polls — ask your group a question and let everyone tap their answer.

And because it’s us, the ads on the free version are kept well clear of your private life: they’re never built from your messages — we genuinely couldn’t read them if we tried. Upgrading just means you’d rather not see ads at all, and fancy a few extra bits while you’re there.

You can upgrade any time from Settings, and the price you see is always your own app store’s real, local price — never a number we’ve plucked out of the air.

🧪 Alpha note: during the alpha, every tester is on Badger Plus for free so you can try the lot — the real purchase flow isn’t switched on yet. And while we’re busy testing ads you may still see them even on Plus, which certainly won’t happen once we launch.

No. There’s no big search box full of strangers, and that’s very much on purpose.

• Anyone can create a Badger account. What nobody can do is find you. There’s no directory, no name search, no “people you may know” — so having an account and being reachable are two completely different things here.
• Badger only ever connects people who’ve actually chosen to connect. Somebody sends you an invite, you accept, and now you’re in each other’s world. No requests from people you half-remember, no being findable by anyone who happens to type your name or email.
• How do we know who you know? This is a hard problem and we’ve settled on the “circle of trust” being your contacts. If you’ve got somebody in your contacts and there is an email attached, you probably know them. Hard to be certain but this is where we have settled.
• It means you can’t be added, followed, or stumbled upon by a stranger. The only way someone ends up in your Badger is because one of you invited the other, and the other said yes.
• There is one way for strangers to get in touch with you. Every user has a BadgerCode. You can find it on your settings screen (tap your avatar on the hub screen). It’s a six character code — A to Z and 2 to 9 which stops those pesky 0 and 1 being mistaken for a 0 and I. You can attach that to your signature on emails or posts on other social media sites (”Contact Me on Badger: ABC345”) and people can ask to chat with you. They don’t see any of your information at all until you accept the invite. Don’t want to talk to them? Don’t accept.
• So what if you sign up before anyone has invited you? Nothing bad happens — you’ll just have a very quiet app. But you can start inviting other people to Badger. Set up a group to coordinate a soccer team, make a group for your family, start a direct chat with a friend. They’ll get an invite if they’re not already on Badger and can download the app. Badger offers you a box for an invite code if somebody has emailed you one, and you can hand out your BadgerCode.
• Yes, it’s a touch more deliberate than tapping “follow”. But that little bit of friction is exactly what keeps Badger feeling like your people — not the whole internet.

Being un-searchable isn’t a missing feature. It’s one of the best things about the place.

They’re close cousins, and the honest answer is: not much — it mostly comes down to how many people are in the room.

• A chat is a one-to-one conversation — just you and one other person. A quiet word between the two of you. Share some jokes, set up a meeting, discuss politics. Like a DM in BlueSky but fully encrypted like Signal.
• A group is the very same idea with more people in it — a family, a five-a-side team, a book club, whoever. Everyone in the group shares the same messages, the same map, the same little moods and statuses. Think of a group like a little social media site that just contains the people that you know and like. Again, only those people in the group can read the messages and see the photos.
• Everything else behaves identically in both: they’re private to the people in them, your messages, your pictures and GIFs, your location is shared only on the terms you choose, and you can slip into Ghost Mode in either one.

So don’t overthink it — a chat is really just the smallest possible group. Start one with a friend, or gather your people into a group; Badger doesn’t much mind which.

However, you can’t invite people to a Chat. But that’s more privacy and security. If you’re chatting one to one with somebody, you don’t want the other person to have invited somebody else to listen in.

Ghost Mode is Badger’s “I’m here, but leave me be” button — and it’s one of our favourite little touches.

• Switch on Ghost Mode and you disappear from every map everywhere completely. Even if you’ve previously agreed to share location. Your friends can still chat with you, you’re still very much part of your groups — you’re just not showing up as a dot anywhere. Like slipping off to a quiet corner of the party without actually leaving.
• It’s instant and it’s total. While you’re a ghost, Badger parks your location (at the North Pole: say “hi” to Santa) and shares nothing at all — not an approximate location, not a “last seen”, nothing. And you can flit in and out of it whenever the mood takes you.

Some days you want your people to know where you are and what you’re doing. Some days you really don’t. Ghost Mode is there for the second kind of day.

Privacy and security is at the heart of the design of Badger but we’re not going to hide any areas where your security and privacy might be compromised despite all our best efforts.

Firstly, and most importantly, if you care about security, you should always be aware that you’re exposed to the $5 Wrench

Nobody can get round the $5 wrench attack. Badger, Signal, Telegram…every E2EE app and program an be attacked by a nefarious actor hitting you or somebody you’re messaging with a $5 wrench. Never forget this.

With that said, here are some other security and privacy things to be aware of.

• The deepest one, said plainly: you're trusting us to build the app honestly. End-to-end encryption scrambles your data before it leaves your phone — but the app doing the scrambling is one we wrote, and a dishonest version could betray you before anything is ever encrypted. That's true of every closed-source encrypted app, WhatsApp included. So we're commissioning an independent security audit — you don't have to take our word for it, you can take an expert's.
• Messages, media, moods, status are all stored on our servers completely encrypted and unreadable to us or anybody else. However, if you have given permission to share your location then your latitude and longitude — and what you're up to, "walking" or "at the shops", which is often more telling than a dot on a map — are written in plain text while somebody is watching you on a map. We never store the history of your location, it's just the current position. This is what makes the map work. Flip on Ghost Mode and both vanish: your position reads as the North Pole and your activity is wiped.
• Why isn't it encrypted? Well, at some point one has to make a pragmatic choice about the complexity involved in storing one small bit of reasonably rapidly updating information in a way that it can be read by other people in your friends groups but not by us. For lots of interesting (to us) cryptographic reasons, this is very hard and likely to be fragile. So we have solved that problem a different way. Ghost Mode.
• So what happens in Ghost Mode? As soon as you turn it on, your position is written to the data base with a latitude of 90 degrees north (i.e. the north pole). Our servers (and everybody else) sees your location as the North Pole and, unless you're actually at the North Pole, your location is totally hidden. Your privacy is completely secure.
• We can see the envelope, even though we can't read the letter. Your messages, media and moods stay encrypted to us even if our entire database walked out the door. But who's in a group with whom, and roughly when and how often messages fly, is something our servers can see — because that's how we deliver them. We never sell it or mine it. But we can see it, a court could compel it, and a serious breach could expose it. Your content: never. The shape of your conversations: yes.
• If Badger is presented with a Lawful Access Request by Law Enforcement or Government, then we are required to comply with it. There's a limit to what we could supply since all content that is posted on Badger is completely inaccessible to us or Law Enforcement. However, we would have to supply meta data such as who you are messaging, and who you are in groups with and the count and frequency of messages. Unlike WhatsApp, we don't mine this data for advertising reasons but we do have to release it if requested by Law Enforcement. We might be keen on privacy and security here at Badger but we also respect the law. You should too.
• We do not proxy any of your web links. If you don't know what that means, you probably aren't going to worry about it but here are the gory details.
• Every message also sets off a notification, and those travel through Apple's and Google's notification systems. We send them with the preview encrypted so none of your content leaks but Apple and Google can see that your phone received something, and when. Every app on a modern phone works this way; there's genuinely no route around it.
• We all love a GIF. Sometimes the right GIF conveys a mood or a reaction better than words. However, we have to get our GIFs from somewhere and we use Giphy. When you post a GIF to a chat or a group, Giphy knows which GIFs you searched for and which GIF you chose. And when it appears on the group in other people's feeds, Badger has to load the GIF from Giphy. So an attacker who sees one badger user select a GIF and then soon after sees another set of badger users loading the GIF could reasonably infer that you're in a group with these other people. It's the meta data attack surface and there isn't much to be done about this except not using GIFs.
• When we check which of your contacts are already on Badger, your phone scrambles their email addresses first and only ever sends the scrambled version — the plain addresses never leave your device. Is that scrambling unbreakable? No — an email is guessable, so someone who got hold of our matching list could in principle grind through guesses to work out who's on Badger. But keep it in proportion: this is already far stronger than nearly every other messaging app, and if someone's that determined to learn who your contacts are, there are much easier ways — starting with the $5 wrench.
• Your keys never leave your phone, but your phone can. Anyone who gets into your unlocked phone — or a companion you've paired — holds the same keys you do, history and all. The reassuring flip side: those keys are locked into your phone's secure hardware and marked device-only, so they're never uploaded to iCloud or Google and never ride along in a backup. So lock your phone, only pair devices you trust, and if you lose one, remove it from your Devices list.
• When someone joins one of your groups, they can currently see what was posted before they arrived — we hand new members the back-story so the conversation makes sense. So adding someone shares the history, not just what comes next. Tightening this is on our roadmap (the "forward secrecy" work), so that in future new members start from the moment they join. For now, add people you'd have been happy to have there all along.
• There is a considerable amount of telemetry in the alpha and beta testing versions of Badger which does store considerably more data (although never the content of your messages or your media etc). Much of this will be removed in the production version but a small amount of anonymised logging will still be recorded to allow us to improve and optimise the app. Try as we might we can't work out an attack surface that this opens up but we thought it's best to be open and clear about it.

And that's it.

Another fair question — it sounds like we want to count your steps, and we honestly don’t. Here’s what it’s actually for.

• It’s how your marker knows whether you’re still, walking, running, cycling or driving — the little activity your friends see beside you on the map. Your phone already works this out with a tiny, low-power motion chip; Badger just reads the one-word answer (“walking”), never the raw sensor stream.
• It’s also one of Badger’s better battery savers. Knowing you’re sitting still lets Badger ease off the GPS until you’re moving again, instead of waking the satellites every minute regardless — and GPS is the hungry part.
• It never leaves your phone. Those motion readings are turned into a single word — your current activity — on your device, and only that word is ever shared, with the same people who already see you on the map. No step counts, no history, nothing sent to us.

And if you’d rather not, nothing breaks: Badger just falls back to guessing your activity from GPS, which is a touch less accurate and a little heavier on the battery. Your call, like everything in Badger.

Short version: you don’t lose your account, you don’t lose your groups, and you almost always get your history back too. There’s one honest edge to it, and we’d rather tell you up front than let you find it the hard way.

• Your account and your groups are fine. The list of who’s in a conversation was never the secret part — it lives on our servers. Sign in on a new phone and every group is right where you left it.
• Your message history usually comes back on its own. Your keys have only ever lived on your own devices — we’ve genuinely never held them — so a brand-new phone starts with none. It quietly asks the other people and devices in each conversation to re-send them, and any that happen to be online hand them back, encrypted, to your new phone alone. Your old messages come back too, not just the ones from now on. It can take a moment: someone who has the keys needs to be online to answer.
• The honest catch. If no device anywhere still holds a conversation’s keys — picture a quiet two-person chat where the other person left long ago — those messages can’t be brought back. Not by us, not by anyone. There’s no master key, and no backup we can reach into. It’s the flip side of nobody-but-you ever being able to read them, and it’s a trade we’d make every time.
• So do one small thing: add a second device. Sign in on a second phone, or on the web companion, and your keys quietly live in two places instead of one. Lose a phone after that and it’s a nuisance, not a loss. It’s the closest thing Badger has to a backup — and it costs nothing.

The very maths that keeps everyone else out of your messages is the reason we can’t magic back a total loss. A second device is the simple insurance — and we’ll gently nudge you toward one, not as a chore, but so your history stays yours to keep.