Privacy, in plain words

What baff.gg stores about you, why, who else gets to see it, and how long it stays. We wrote it by reading our own code. If something here stops being true, that’s a bug, and we want to hear about it.

Last updated October 20, 2026. baff.gg is in alpha and changes often, so this page changes when the app does.

The short version

We will never sell your data, and we don’t share it with anyone for advertising.
There are no ads, no analytics and no tracking scripts in baff.gg. Our web server doesn’t keep a log of visits.
We store what the app needs to work: your account, your profile, and the messages and files you send. Your email address and date of birth are never shown to other people on baff.gg.
Messages aren’t end-to-end encrypted. They’re stored on our server so they reach your other devices. Our staff don’t read them unless someone reports them.
A few other companies see a little: Cloudflare stores files, Resend sends emails, VerCaptcha checks you’re a person, and emoji, GIFs and link preview pictures load from other websites. All listed below.
You can download a copy of your data and delete your account from User Settings.

What we store

Everything below lives in our database on our own server, except files, which are stored with Cloudflare (see other companies).

What	Why	How long
Your account Email address, username, display name, date of birth, and your password as an Argon2id hash (never the password itself).	Logging in, account emails, and the age checks below.	Until you delete your account.
Your profile Avatar, banner, pronouns, About Me, profile colors, status and custom status.	So people you talk to know who you are.	Until you change or remove it. Your 6 most recent avatars are kept for Recent Avatars; older ones are deleted.
Login sessions A fingerprint (SHA-256 hash) of each session, not the session itself.	Keeping you logged in on each device.	Logging out deletes it. Otherwise it stops working after 30 days.
Email links Fingerprints of the links in verification and password reset emails.	Checking the link you click.	Verification links work for 24 hours, reset links for 1 hour and only once.
Messages and files What you send in servers and DMs, with files, reactions, pins and replies. Editing replaces the text; old versions aren’t kept.	Showing the conversation to the people in it, on any device.	Until you, a moderator, or our staff after a report delete it. Deleting removes it and its files right away (but see backups below). Files someone bought with Baffles are kept for that buyer, and the files of a reported message are kept until our staff handle the report.
Friends, servers and DMs Friend requests, which servers you’re in, your roles and nicknames, which DMs you have open.	Your friends list, server list and DM list.	Until you change them.
Your app state The last message you read in each channel, notification settings, muted and pinned channels, bookmarks, reminders and your favorite GIFs.	Unread markers and notifications that follow you between devices.	Until you change them. A reminder goes when you mark it done.
Push notification devices For each device you turned push on: the address your browser’s push service gave us, its encryption keys, and a label like “Chrome on Windows”.	Sending notifications when baff.gg is closed.	Until you turn push off or remove the device, the push service tells us the device is gone, or sending fails 8 times in a row.
Bot commands A record of each slash command or button you use with a bot.	Matching the bot’s answer to your command.	Deleted after a day.
Baffles Your balance, every Baffle that moved in or out of your account, and what you bought.	Keeping balances correct and letting you keep what you bought.	We keep this history. Bought posts stay in your library even if the seller deletes them.
Reports When you report a message, a person or a server: your reason, your note and when. The first report also saves a copy of what was reported as it was then. For a message: its text, its files with their names, who sent it, and the server and channel (or that it was a DM). For a person: their username, display name, avatar, banner, About Me, pronouns and custom status, and the server you reported them from. For a server: its name, icon, banner, owner, member count and Discovery listing.	So our staff can act on it, even if it’s changed or deleted afterwards.	Until our staff handle the report, then 90 more days, then it’s deleted with its copy.
Account suspensions If our staff suspend your account: until when, the reason they give you, when and by whom.	To keep you logged out until it ends, and to tell you why by email (to a verified address) and when you try to log in.	Until it ends or staff lift it. The record of the staff action stays in our staff log.
Network fingerprints When you sign up or log in: a keyed fingerprint (HMAC-SHA256 with a secret only our server has) of the IP address the request came from, and one of its network (the first three parts of an IPv4 address, the first 48 bits of an IPv6 one), with when we first and last saw them. Never the address itself.	To spot new accounts made from the same network as a suspended one, which our staff then look at. Nothing happens to an account automatically, and staff only see which accounts share a network, never an address.	90 days after we last saw it from your account, or until you delete your account. If your account is suspended (or was in the last 90 days), deleting it doesn’t remove them: they’re kept until 90 days after we last saw them.
Signup records When an account is made: the same keyed fingerprint of the IP address it came from, and when. If an address is refused for making too many accounts, a short reference code for it and how often it was refused.	To limit how many accounts one network can make in a short time, so nobody can mass-produce accounts. A refused person gets the code so our support team can lift the limit for shared networks like schools and offices; staff only ever see the code.	30 days, even if the account is deleted sooner (otherwise deleting accounts would make room for more).
Job applications Your answers on baff.gg/hiring and our decision.	Our hiring team reads it to decide on your application.	We keep them until you delete your account; nothing else deletes them yet.
Support requests What you send through Submit a request, by email to support@baff.gg or in your DM with baff.gg Support: the topic and details, your messages and files, the email address we answer, your rating, and our answers. Staff can add internal notes. Email links to a request are kept only as fingerprints.	Answering you and following up by email.	Deleted one year after the request is closed (a solved request closes after 7 days), or when you delete your account. A request sent without logging in and never confirmed is deleted after 24 hours.

Backups

Every night the whole database is copied, encrypted with AES-256 on our server, and uploaded to Cloudflare R2. We keep the newest 14, so something you delete can live on in a backup for up to 14 days before it’s gone for good. Files you upload aren’t part of these backups.

Support and staff records

When you message baff.gg Support, your messages are copied into a private channel where our support staff read and answer them. Applications sent from baff.gg/hiring are read by our hiring team. When staff change something on the platform (like a badge or a server’s verified status) or handle a report, we record who did what to which account, server or message.

What we don’t keep

Some things are only held in the server’s memory while it runs, and are gone when it restarts:

IP addresses. We hold them in memory to count how often one address asks for QR sign-in codes or password resets over the last 1 to 15 minutes. They’re never written to the database: only the keyed fingerprints described under Network fingerprints are.
The spam check. Each account gets a score from the last 10 minutes of activity (lots of links, repeated messages, mass friend requests). If it gets too high, you’re asked to solve a captcha. The score is never saved.
Who’s online, who’s typing, and who’s in which call. Your picked status (like Do Not Disturb) is saved; whether you’re connected right now isn’t.
QR sign-in codes, which expire within minutes.
Link previews, cached for 30 minutes so the same link isn’t fetched again and again.
GIF searches. KLIPY’s answers are kept in our server’s memory for a few minutes so the same search isn’t sent again, without who searched. Nothing about them is written down.
Calls. Voice and video are never recorded or stored.

Server logs

Our web server doesn’t log visits. Our programs do write a technical log: errors, and events like “email verified” or “joined server” with a username, never message text. When something goes wrong, an error line can include the network address of that request. Each program’s log is capped at 50 MB, and the oldest lines are thrown away as new ones come in.

Who can see what

Your profile (name, avatar, banner, pronouns, About Me) is shown to people you share a server or a DM with. Your full profile card only opens for people you’re connected to.
Your online status goes to friends, people in your servers and people you DM. Set yourself to Invisible and they see you as offline, without your custom status.
Your messages are seen by everyone who can view that channel or DM, including bots in that server. Server moderators can delete them, and so can our staff when someone reports one.
Typing shows “is typing” to people in the channel. Type /silenttype to turn it off.
Your email address, date of birth and Baffles balance are never shown to other people on baff.gg. Our staff tools don’t show email addresses either.
Files are served from cdn.baff.gg at a web address that works for anyone who has the link, without logging in. Files in paid posts get a random, unguessable part in their address.

Messages, DMs included, are not end-to-end encrypted. They’re protected on the way (HTTPS), then stored as they are in our database, so the few people with access to the server could read them.

When our staff look at messages, profiles and servers

Our staff don’t read your messages unless someone reports them. Anyone can report a message they can see: right-click it (or press and hold it on a phone) and pick Report Message. Staff then see that one message as it was when it was first reported, the reasons and notes people gave, and who reported it. Our report tools don’t show them the rest of the conversation (the one exception, for servers, is below).

You can also report a person (from their profile, the member list or a DM) or a server (from its menu, its Discovery card or an invite). You can report people whose profile you can open, and servers you’re in, that are listed in Discovery, or that an invite you have leads to. Staff then see a copy of the profile or the server as it was at the first report (see What we store), not its messages.

While investigating a report or a safety issue, a small group of senior staff may open a server’s channels read-only in the app, including private channels. Each look needs a written reason, is recorded in our staff audit log, ends on its own after at most 4 hours and can be revoked sooner. Staff can’t post, react or join calls while looking, they don’t show up as members, and nobody in the server is told. It never covers DMs or group DMs, and the files of priced posts stay locked.

The person or server you report is never told, and never told who reported them. If staff act on a report, for example by deleting the message, suspending the account or taking the server out of Discovery, the people who reported it get a short note from baff.gg saying action was taken, without saying what or against whom.

Two things are always read by people on our team: what you send to baff.gg Support (requests, emails and your DM with Support, by support staff) and job applications (by the hiring team).

Account suspensions

When an account breaks our rules badly, our staff can suspend it, for a number of days or until they lift it. A suspended account is logged out everywhere and can’t log in; trying shows until when and the reason staff gave. Its messages, servers and friends stay as they are, and nobody else is told. Staff can lift a suspension early, and every suspension and lift is recorded in our staff log.

Other companies involved

We run the database, the app’s server and the voice server ourselves. Calls go through our own voice server, so the people you call never get your IP address, and noise removal runs on your own device. These are the outside services that see something:

OVHcloud

Rents us the server everything above lives on, in Hillsboro, Oregon (USA).

Always.

Cloudflare

Stores uploaded files (avatars, banners, emoji, attachments) and our encrypted backups in R2, and serves files from cdn.baff.gg, so it sees the IP address of anyone loading a file. It also runs baff.gg’s DNS. The app itself doesn’t go through Cloudflare.

When you upload or view a file.

Resend

Sends our emails, so it gets your email address and the email’s text.

Account emails, like verification and password reset links.

VerCaptcha

Its check runs in your browser (loaded from vercaptcha.com), so it sees your IP address and whatever its check looks at. Our server sends it only the check’s token, to confirm it.

Signing up, logging in, resetting a password, and the spam check.

Your browser’s push service

Google, Apple, Microsoft or Mozilla, depending on your browser. Notifications are encrypted for your device, so the service sees that one was sent and how big it is, not what it says.

Only if you turn push notifications on.

jsDelivr

Emoji pictures (Twemoji) load from cdn.jsdelivr.net, so jsDelivr sees your IP address.

When the app or the homepage shows a standard emoji.

Websites people link to

Our crawler, Bafflebot, fetches a page to build its link preview from our server, so the site sees our server, not you. But the pictures in a preview, and in bots’ embeds, load straight from that website in your browser, so it sees your IP address. We don’t send it which chat you were in.

When a message with a link preview is on your screen.

YouTube

A YouTube preview’s picture comes from YouTube. The video player loads from youtube-nocookie.com only after you press play.

When a YouTube link is on your screen, and when you play it.

KLIPY

GIF search goes through our server: KLIPY gets the words you search for and a country taken from your browser’s language, never who searched (no account, no IP address). The GIFs themselves load straight from KLIPY’s servers in your browser, so KLIPY sees the IP address of anyone viewing a GIF, in the picker or in a chat.

When you open the GIF picker, and when a GIF is on your screen.

Bot developers

Bots are run by whoever made them. A bot in a server gets the messages in every channel it can see, and when you use a bot’s command, the bot gets the command, what you typed into it, and your user ID, name, avatar and roles in that server.

In servers that added a bot, and when you use one.

Discord

If you move a server over, we ask Discord for its name, icon, banner, channels, roles, permissions and emoji. Never its messages or members. If you link your Discord account to get your roles back, we keep an encrypted Discord sign-in token so we can read your roles in servers that moved here every few hours, until you unlink it.

When a server owner runs Migrate a Server, and while you have a Discord account linked.

Where it lives and how it’s protected

baff.gg isn’t a company. It’s a solo project: one person runs it and is responsible for your data, with a few people helping out.
baff.gg is an American service, and US law applies. Our server is an OVHcloud machine in Hillsboro, Oregon. If baff.gg grows, we may add more voice and backend servers in other parts of the US, but they’ll stay in the US.
Files and backups are stored with Cloudflare R2 in the US (see other companies). When someone opens a file, Cloudflare may keep a short-lived cached copy in a data center near them so it loads fast.
Everything between you and baff.gg is encrypted on the way: HTTPS for the app, and WebRTC’s built-in encryption for calls.
Passwords are stored as Argon2id hashes. Session tokens and email links are stored only as SHA-256 hashes, so a copy of the database can’t be used to log in as you.
The database can’t be reached from the internet, only by our own programs on that server.
Backups are encrypted before they leave the server.
JPEG, PNG, WebP, BMP and AVIF pictures you attach are re-encoded to WebP, which drops hidden details like where a photo was taken. Other files, GIFs included, are stored exactly as you upload them.

Your browser

baff.gg sets a cookie, bafflux_session, which keeps you logged in. If you use Switch Accounts, a second one, bafflux_accounts, keeps the other accounts on this browser logged in (up to 5); logging out of an account removes it. Scripts can’t read either of them. Your settings for this device (voice and appearance settings, recently used emoji, whether you’re signed in on this browser) are saved in your browser’s local storage and stay there.

Your controls

Delete any message you sent; its files are deleted with it. Most messages can be edited too.
Change or remove your avatar, banner, pronouns and About Me in User Settings > Profiles.
Go Invisible from the status menu in the bottom-left corner.
See every device with push notifications on, and remove any of them, in User Settings > Notifications.
Remove a bought post from your library in User Settings > Purchased Content. If you were its last buyer, our copy of it is deleted.
Choose who can send you DMs and friend requests in User Settings > Privacy & Safety.
Block someone to stop them from messaging you.

Without changes, only friends and people you share a server with can DM you, and anyone who knows your username can send you a friend request.

Getting a copy of your data

In User Settings > Your Data, choose Request My Data. We put together a ZIP file and send you a link to it by email; the link also shows up in that settings page. The file is deleted after 7 days, and you can ask for a new one once every 7 days.

It includes the reports you sent (what you reported, reason, note, date, and whether staff have handled them), but not our copy of the reported message, profile or server. Reports about you, your messages or your servers aren’t in it: they would tell you who reported you, or that someone did.

Deleting your account

You can delete your account from User Settings. It’s scheduled for 14 days later; log in before then to cancel. After that, your personal data is erased and your account shows up as “Deleted User”.

Your messages stay where they are, under “Deleted User”, unless you tick “Also delete every message I’ve sent”. Reports you sent stay with our staff, without your name or your note. Reports about you or your messages, with their copies, stay until staff handle them and 90 days after, so deleting an account doesn’t make a report go away. Remember the nightly backups: erased data can still be in them for up to 14 days.

Age

You have to be at least 13 to make an account. We ask for your date of birth when you sign up and refuse anyone younger. We also use it for age-restricted channels: accounts under 18 can’t open them, and adults confirm once per channel on each browser.

Questions

Send a request at support.baff.gg/requests/new (you sign in with your email, no account needed), or open User Settings and pick Contact Support. Someone from our team answers.