Privacy Policy

• Account and authentication information: name, email address, workspace/organization name, and password (stored as a salted hash — we never store or can see your plain-text password).
• App and organization information: the apps you add, your organization name, and how your account is structured (one organization per account today).
• Store listing and competitor information: any store URL you submit to add an owned app or track a competitor.
• Questions you ask Base AI (see Section 5 for what we do and don't retain from these).
• Support requests you send us.

When you add an app or a competitor, Base Momentum reads that app's public store listing page — the same page anyone can already view without an account. We classify every piece of evidence we retrieve as Observed, Authorized, Estimated, or Unavailable, and we never treat "couldn't retrieve this" as if it were a negative signal about your app.

Standard technical logs (IP address, request timestamps, user agent) are kept briefly for security, rate-limiting, and abuse prevention — not for tracking or profiling.

Your subscription status, plan (Free, Pro, Studio, or Enterprise), and billing period dates are stored so we can enforce your plan's limits and show you accurate billing information — see Section 6 for what we receive from Paddle specifically.

• We do not scrape or collect any non-public data about you, your app, or your competitors.
• We do not access a developer console account unless you explicitly connect one through a dedicated authorization flow — and that connection only ever grants access to your own app's data, never a competitor's.
• We do not sell your data to third parties.
• We do not run advertising trackers or ad networks — Base Momentum has no ads.
• We do not store your full payment card number, CVV, or other raw payment credentials — see Section 6.

• To provide the service: computing your Momentum Score, App Doctor diagnosis, and other features from the evidence we've gathered.
• To operate your account: authentication, session management, and enforcing your plan's limits.
• To communicate with you about your account, billing, or support requests.
• To maintain security: detecting and preventing abuse, fraud, and unauthorized access.
• To improve Base Momentum, using aggregated, non-identifying information where possible.

When you use Base AI, we record metering information — which organization and app, which plan you were on, when, and whether a real AI provider was used — so we can enforce your plan's usage limits and understand cost over time. We deliberately do not store the text of your question or Base AI's response. Only the metering record above is kept; the conversation content itself is not retained.

Paid subscriptions are processed by Paddle.com Market Limited, acting as the Merchant of Record for Base Momentum. When you subscribe, your payment details are collected and processed directly by Paddle under its own privacy policy — Base Momentum receives only subscription status, plan, and billing-period information from Paddle, never your card number or full payment credentials.

Base Momentum uses a small number of essential, first-party cookies to keep you signed in securely: an httpOnly access-token cookie and an httpOnly refresh-token cookie, both readable only by our own servers and never by page JavaScript, plus a third cookie holding your display name so a page can greet you without an extra request — this one is not httpOnly since it holds no sensitive information, only your name. All three are marked Secure in production and required for the service to function. We do not use advertising cookies, third-party tracking pixels, or cross-site analytics cookies.

We share information only with:

• Paddle.com Market Limited, for payment processing as our Merchant of Record (Section 6).
• Infrastructure providers (hosting, database) who process data on our behalf under contractual confidentiality obligations, and never for their own purposes.
• Law enforcement or regulators, only where legally required.

We never sell personal information.

We keep your account and app data for as long as your account is active. If you cancel your subscription, your data isn't deleted — it's simply restricted according to your new plan's limits (see our Terms of Service, Section 5). If you delete your account, we remove your personal data within a reasonable period, except where we're required to retain records (for example, billing history) for legal or accounting purposes.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise any of these rights, email info@kabooshegames.com.

We use industry-standard practices to protect your data: encrypted connections (HTTPS) everywhere, hashed/salted passwords, rate limiting and account lockout against credential-stuffing attempts, and strict organization-level data isolation so one workspace can never see another's data. No system is perfectly secure, but we treat billing and account data as security-critical by design, not as an afterthought.

Base Momentum is a business tool intended for app developers and is not directed at children under 16.

We'll update the "Last updated" date above whenever we make a material change to this policy, and where required, notify you directly.

Questions about this policy or your data? Email info@kabooshegames.com.

This Privacy Policy is issued by Mohammed Almadhoun, who operates Base Momentum as an individual. See our Terms of Service for the governing law that applies to your use of Base Momentum.