Privacy Policy for MUDBasher

Last updated: August 6, 2026

This Privacy Policy describes how MUDBasher ("the App") handles your information, and separately how this website handles yours. Your privacy is important to us, and we are committed to protecting your personal data.

Developer Information

MUDBasher is developed and maintained independently. For questions or concerns about this privacy policy, please use the support page or contact us through the App Store.

Data Collection and Storage

Data Stored Locally on Your Device

MUDBasher stores all of your settings and content locally on your device. We do not collect it, and there is no account, no profile and no sync. The one case where session data passes through a server we run is a proxy connection, described under Proxy Connections below. The following data is stored locally:

Connection Information

• MUD Server Details: Hostnames, port numbers, and connection settings for MUD servers you configure
• Credentials: Usernames and passwords are stored securely in the iOS Keychain
• Connection History: Last connection dates and auto-connect preferences

Customization Data

• Aliases: Custom text shortcuts you create
• Triggers: Automated responses to specific text patterns
• Gags: Text filtering rules
• Preferences: Font settings, themes, terminal types, and other display preferences

Session Data

• Session Logs: Optional session transcripts if you enable logging (stored locally on your device)
• Notes: Any notes you add to your saved MUD worlds

Data the App Does NOT Collect

MUDBasher does not:

• Collect analytics or usage statistics
• Track your location
• Access your contacts, photos, or other personal files (except those you explicitly choose to share)
• Send your data to advertising networks, data brokers, or any third-party service
• Use advertising or tracking SDKs
• Collect any personal information for marketing purposes
• Read, mine, or retain your session content for any purpose beyond delivering it to you

This Website

The statements above describe the App. This website is separate, and it is not as private as the App is. We want to be straightforward about the difference.

• Google Analytics: This site uses Google Analytics to count visits. It sets cookies in your browser and sends your IP address, approximate location, browser and referring page to Google, acting as a third party. See Google's privacy policy.
• Cloudflare: The site is served by Cloudflare, which sees your IP address in order to deliver the page, and runs its own cookieless visit counter. See Cloudflare's privacy policy.
• Support form: The support page submits your email address and message through Formspree so we can reply to you. It is used for that reply and nothing else.
• Opting out: Browser tracking protection, an ad blocker, or Google's opt-out add-on will all stop the analytics. Nothing on this site requires them to run.
• No connection to the App: Website analytics are kept entirely separate from the App. There is no account, no identifier and no login shared between the two, so a visit to this site is never tied to your use of MUDBasher or to a proxy session.

Network Connections

Direct MUD Server Connections

The App connects to MUD (Multi-User Dungeon) servers that you configure. On a direct connection, which is how a world behaves unless you enable the proxy for it:

• Your device establishes a connection straight to the MUD server using the hostname and port you provide
• All communication occurs directly between your device and the MUD server
• Nothing passes through any server we operate, so we cannot intercept, monitor, or store any of it
• Connection security depends on the MUD server's capabilities (standard telnet or SSL/TLS)

No Third-Party Services in the App

MUDBasher does not connect to any third-party analytics, advertising, or tracking services. The only network connections the App makes are the ones you initiate: to MUD servers, and to the MUDBasher proxy for worlds where you have turned the proxy on.

Proxy Connections

iOS suspends an app a few seconds after you leave it, which closes any open connection. To keep a session alive while MUDBasher is in the background, a world can be set to connect through a MUDBasher proxy server instead of connecting directly. This is the one part of the App where your session data passes through infrastructure we run, so it is worth being precise about.

Each world connects in one of two ways:

• Direct: your device holds the connection to the MUD itself. Nothing reaches us. This is described under "Direct MUD Server Connections" above.
• Proxy: your device connects to a MUDBasher proxy over an encrypted WebSocket (wss), and the proxy holds the telnet connection to the MUD on your behalf. Your session traffic therefore travels through our server.

What passes through the proxy

While a proxied world is connected:

• Session traffic: everything the MUD sends you, and everything you send the MUD, is relayed by the proxy. That includes the commands and messages you type.
• Connection details: the hostname and port of the MUD you are connecting to.
• Buffered output: while your app is backgrounded or closed, output from the MUD is held with sequence numbers so it can be replayed to you when you return. This buffer exists only in the proxy's memory. It is never written to disk, never put in a database, and never backed up.
• Login credentials, if you use auto-login: a proxied world that logs in for you sends those credentials to the MUD through the proxy, in the same way it sends any other command. Your password is still stored only in the iOS Keychain on your device; the proxy relays it in transit and does not keep a copy of your Keychain entry.
• A per-session token, used to authenticate your session to the proxy.
• Notification events: if you have set a trigger to notify you, the alert is delivered through Apple's Push Notification service.

How long a proxy session lasts

A proxy session stays alive for up to 24 hours without an attached client, so you can leave the app and come back to it. After that the session expires and its connection to the MUD is closed.

Nothing from your session is stored. The replay buffer lives only in the proxy's memory for the life of the session, and it is gone the moment the session ends, whether that is because you disconnected, because the session expired, or because the proxy restarted. There is no session log, no transcript on our side, and nothing to export or hand over later.

Where the proxy runs

MUDBasher's proxy servers are hosted in the United States, in a US East region. If you use a proxied world, your session traffic is relayed through the United States on its way to and from the MUD, wherever you and that MUD happen to be.

This matters most if you are in the UK or the European Economic Area, because it means that traffic leaves your region. It is held in memory for the life of the session and stored nowhere, as described above, but it does transit US infrastructure and is subject to US law while it does. A world left on a direct connection is not routed through us and does not make that trip.

Turning it off

The proxy is a per-world setting, not an account-level one. A world set to connect directly never contacts our servers, and disabling the proxy for a world ends any proxy session it had.

Data Security

We take the security of your data seriously:

• Keychain Storage: Passwords are stored using iOS Keychain, Apple's secure credential storage system
• Local Encryption: Data stored in Core Data benefits from iOS device-level encryption when you enable device encryption
• No Cloud Sync: Your saved worlds, rules and settings remain exclusively on your device. They are never uploaded, backed up to us, or synced between devices
• Proxy transport: The link between your device and a MUDBasher proxy is an encrypted WebSocket. The onward link from the proxy to the MUD uses whatever that MUD supports, which for many MUDs is unencrypted telnet

File Sharing

The App has file sharing enabled, which allows you to:

• Access session logs through iTunes File Sharing or the Files app
• Export and import your data if needed

Files are only accessible when your device is connected to a computer and you explicitly grant access. We do not automatically upload or sync files to any cloud service.

Children's Privacy

MUDBasher does not knowingly collect any personal information from children. The App is designed for general use and does not target children specifically. All data remains on the user's device.

Third-Party Links

MUDBasher connects to third-party MUD servers at your direction. We are not responsible for the privacy practices of these servers. Please review the privacy policies of any MUD server you connect to.

Data Retention

Data on your device is retained until you:

• Delete specific saved worlds, aliases, triggers, or gags
• Delete the App from your device
• Reset the App's data

On the proxy, there is nothing to retain. A session lasts up to 24 hours without an attached client and then expires, and the only copy of your session output lives in memory for the life of that session. Nothing is written to disk, so nothing survives it. See Proxy Connections.

Your Rights and Controls

You have complete control over your data:

• Access: All your data is accessible through the App's interface
• Modification: You can edit or delete any saved information at any time
• Export: You can export data using iOS file sharing
• Deletion: Deleting the App removes all associated data from your device

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this policy. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy or the App's data practices, please:

• Send a message from the support page
• Contact us through the App Store

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA):

• Your saved worlds, rules, settings and logs are processed locally on your device and are never transferred to us
• You maintain full control over that data at all times, and deleting the App removes it
• Two things sit outside that. Session traffic for any world you have set to use a proxy connection is relayed by a server we operate, for the sole purpose of keeping that session alive and replaying what you missed. Website analytics, described under This Website, are handled by Google as a third party
• Both are avoidable: leave a world on a direct connection, and use tracking protection or an ad blocker on this site

International transfers

Our proxy servers run in the United States. If you enable the proxy for a world, that world's session traffic is transferred outside the EEA and the UK while the session is running. That transfer happens only because you switched the feature on for that world, and only for as long as it takes to relay and replay your session. Nothing is stored at the other end.

If you would rather no session data leave your region, leave your worlds on direct connections. The App works this way by default and the setting is per world, so you can keep some worlds direct and others proxied.

California Privacy Rights (CCPA)

For California residents:

• We do not sell your personal information
• We do not share your personal information with third parties for marketing purposes
• All App data remains on your device under your control