Privacy & cookies

What We Keep, and Why.

Last updated 31 October 2026

Baddie Be Well is a small community, run by one person and a handful of volunteer stewards. We collect as little as we can get away with, we don’t sell anything about you, and you can ask us to delete what we hold. This page explains that in plain language and tells you how to change your mind.

Who Is Responsible

Baddie Be Well (“we”, “us”) is the controller of the personal data described here. Write to hello@baddiebewell.com for anything on this page, including requests to access or delete your data. We are based in Los Angeles, California, and the app is hosted in the United States.

What We Collect

Account details: your email address, and the password you set with us (stored hashed by our authentication provider).
Profile and membership: the name you ask us to call you, pronouns, city, avatar, the identities and tribes you elect into, the membership category you select, your age attestation, and your acceptance of the code of conduct and these terms, with timestamps.
What you post: threads, replies, tribe memberships, job posts, listings, and any report you file.
Payments: paid seats are billed through Substack. Card details never reach us; we see the email address you subscribed with when you ask us to verify it.
Technical data: standard server logs (IP address, user agent, timestamps, errors) kept by our hosting provider for security and reliability.

Why We Use It, and on What Basis

To create and run your account, and to give you the access your membership category carries (performance of a contract).
To send the newsletter you asked for, and community notes (consent, withdrawable from any email or from your profile).
To moderate the community and keep it safe, including reviewing reports (legitimate interests, and our community rules).
To keep the service secure, prevent abuse, and debug failures (legitimate interests).
To use optional analytics (consent, via the cookie banner only).

Cookies and Local Storage

Essential storage keeps you signed in and remembers this cookie choice; it is required for the app to work and does not wait for permission. Optional analytics runs only if you accept, and stops again if you decline later. We do not use advertising cookies ourselves.

bbw-cookie-choice (local storage, first-party, kept until you clear it): your Accept or Decline decision.
Session and authentication tokens(first-party, session to 30 days): keeps you signed in between visits.
Analytics (only with consent): page and device information used to see what is working. Declining sets Google Consent Mode signals to denied, so these tags do not collect.

Who Else Sees It

We use a small set of processors to run this community: our application and database host (Base44), our authentication and email delivery providers, Substack for the newsletter and paid subscriptions, YouTube for embedded videos, and our payment provider for any card charges. They act on our instructions and only for those purposes. We do not sell or rent personal data, and we disclose it to authorities only where the law requires it.

Because our providers are in the United States, your data may be processed there. Where we rely on a transfer mechanism (for example the European Commission’s standard contractual clauses), our providers put it in place with their own sub-processors.

How Long We Keep It

Profile and membership records while your account is open, and for up to twelve months after you close it so we can honor opt-outs and resolve disputes. Posts stay up unless you delete them or a steward removes them, minus a copy retained in the moderation log. Reports are kept while they are open and for twelve months afterwards. Server logs rotate within ninety days.

Your Rights

Wherever you live, we extend the same core rights to you. You can ask for a copy of what we hold, ask us to correct or delete it, ask us to stop using it for a particular purpose, ask to receive it in a portable format, and withdraw consent for the newsletter or for analytics at any time. Under the GDPR and similar laws you also have the right to object, to restrict processing, and to complain to your local supervisory authority; in California you have the right to know, delete, correct, and opt out of sharing, and we do not discriminate against anyone for exercising them. Email hello@baddiebewell.com and we will respond within thirty days.

Adults Only

This community is for people eighteen and over, and we do not knowingly collect anything from children. Some spaces, like the Kinksters tribe, require a further attestation of majority and an acknowledgment of adult content before entry. If you believe a minor has created an account, write to us and we will remove it.

Security, and the Honest Limits

Access to member data is restricted, accounts are gated, and payment details never touch our servers. No service can promise perfect security. If we ever suffer a breach that affects your data, we will tell you promptly and tell you what we know.

Changes

If we change how we handle your data in a meaningful way, we will update this page and note the date at the top, and where the change affects consent we will ask again rather than assume it.

See also the terms of use and the code of conduct.