Privacy notice

Updated 22 October 2026

Who is responsible

AR AI LABS LTD, company number 17483830, is responsible for personal information collected through Blade Buds. Its registered office is Suite A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE. Contact support@bladebuds.com for support or privacy requests.

The short version

Play as a guest without an account. Sign in only if you want cloud saves across devices. We use your verified email for sign-in, not marketing; the adult mobile news list is a separate choice. Your account, scores and Google profile details are not public. Share a result or visit our community only when you choose. Never send passwords or identity documents to us or post them in Discord.

Playing

Guest progress and game settings stay on your device. When signed in, personal Mastery progress, Endless best, Daily results, grades, streaks and attempt dates also sync to our Cloudflare D1 database so you can resume on another device. We do not upload swipe paths or a history of every individual cut, import contacts, or use advertising profiles. Cloudflare delivers and protects the website and processes IP addresses and technical request details. Protected test versions also use Cloudflare Access email sign-in. Short crash descriptions and code/page locations are sent to Cloudflare Worker logs for a few days to help fix errors.

Optional accounts

We store your verified email, an internal player ID, account creation/update times, login sessions and the personal progress described above. Google sign-in supplies its verified identity and may supply a display name and profile picture; we do not publish them or request access to Gmail, contacts or Drive. We keep linked-provider identifiers and authentication tokens needed for sign-in. Google and email sign-in can access the same account when their verified email matches. We process these details to provide the account and save service you request, relying on performance of our agreement with you. No password or marketing subscription is created.

Sign-in protection

Email codes expire after five minutes, are stored as hashes and allow limited attempts. Resend receives the address and code to deliver the transactional message. Cloudflare Turnstile checks browser/connection information before sending a code. Account sessions can record your IP address and browser/device user-agent; authentication rate-limit entries can also contain IP addresses. These account records are separate from the hashed waitlist security identifiers below. We rely on legitimate interests in preventing abuse, protecting accounts and keeping the service reliable. We do not enable email open or click tracking.

Mobile news

The optional mobile mailing list is for adults aged 18 or over. If you sign up, we process your email, optional device preference, signup source, consent version and timestamps, and confirmation/unsubscribe state. We rely on your consent to send the mobile launch news you requested, which may include beta invitations. Confirm through the email we send. You can unsubscribe at any time using the link in each email. Joining the list does not affect free play.

Security and delivery

We use Cloudflare D1 for accounts and the optional mailing list, and Resend for requested emails. The optional mobile news form also uses Cloudflare Turnstile. Its waitlist rate-limit identifiers are derived from IPs and email addresses using a keyed hash; raw IP addresses are not stored in the waitlist rate-limit tables. This does not describe account-session metadata or provider logs. Message queues retain mailing-list delivery state so requests can be retried safely. We rely on legitimate interests in protecting the service and delivering requested messages for these security and reliability operations. Email open and click tracking are not enabled.

Support

Email sent to support@bladebuds.com is forwarded by Spaceship to an owner-controlled Google Gmail inbox. We use the information you choose to send to answer your request and protect the service, relying on our legitimate interests in providing support. Send only the details needed to explain the issue; do not send passwords, payment details or identity documents.

International processing

Our Cloudflare D1 database is configured for the EU. Resend stores message content and delivery logs in the United States even though the sending domain uses its European region. Cloudflare and Resend provide data-processing terms that include Standard Contractual Clauses and the UK Addendum for restricted international transfers. Hosting, delivery and support providers may process information outside the UK. Contact support@bladebuds.com for information about, or copies of, the safeguards applicable to your data. Google may process sign-in information globally under its own privacy policy at https://policies.google.com/privacy.

Retention

Account identity, linked sign-in details and cloud progress are kept until you delete the account so you can return to your save; there is no automatic inactivity deletion. Sessions normally expire after 30 days and may renew while you use the service. Codes expire after five minutes. Routine account cleanup removes expired sessions/codes, account rate-limit entries older than 24 hours and separate Daily reservation/mail-budget entries older than 35 days. Your saved profile still keeps the latest Daily result and personal progress. Unconfirmed mailing-list records expire after seven days. Unsubscribing cancels queued messages immediately; unsubscribed records are removed after 30 days. Completed/cancelled mailing-list jobs are removed after seven days, failed jobs after 30 days, and rate-limit buckets expire. Confirmed subscriptions are reviewed every six months and after mobile launch. Aggregate event totals, if enabled, contain no identifiers and last about 13 months. Resend Free message/log retention is normally 30 days; provider backups have separate periods. We review support correspondence when resolved and delete ordinary resolved messages within 90 days. Necessary legal, security or privacy-request records may be kept longer with restricted access.

Deleting your account

Use Delete account in the player screen after signing in recently. This removes your account, linked sign-in records, sessions, cloud save and account-linked Daily reservations from our active database. It also removes that account’s cached progress from the device where you delete it; your separate guest save remains. Other devices may retain offline copies: clear their game/site data to remove those. Provider delivery logs and backups follow their own retention periods and are not erased instantly. Deleting an account does not unsubscribe a separately joined mailing list; use its unsubscribe link. Contact support@bladebuds.com if you cannot access the account or need help with a data request.

Your choices and rights

You can withdraw mailing-list consent without affecting earlier lawful processing or your ability to play. Depending on applicable law, you may request access, correction, deletion, restriction or portability of your information, or object to processing based on legitimate interests. Contact support@bladebuds.com. We verify only what is necessary to protect the information. You may complain to the UK Information Commissioner’s Office or your local data-protection authority.

Children

We use high privacy settings for all players: guest play remains available, accounts and scores are private, and there is no in-game chat, contact import or advertising profiling. Signing in is optional; it does not require a real-name form or location. The optional mobile mailing list is for adults aged 18 or over. A parent or guardian can help a younger player understand sign-in and contact support@bladebuds.com about their information. Do not publish an address or submit identity documents.

External links

Google processes sign-in information under its own privacy notice. Discord and social platforms are separate services with their own terms, privacy notices and age requirements. Joining or opening them is optional. Our gameplay clips are hosted as video files rather than embedded social-platform players. Sharing a result is your choice; check its contents and recipient before sending.