Privacy at Back
Last updated October 7, 2026
This privacy notice covers Backburner (a task list), Backpack (files, documents and spreadsheets), Backdrop (a video editor) and back.dev (this site). One Back account signs you into all of them. It explains what personal data we hold, why we hold it, where it is processed, and how to exercise your rights.
We do not sell your data or run ads. No Back product contains third-party tracking or advertising pixels.
Who is responsible
Back is a trading name of Tom Grady, a sole proprietor based in Washington State, in the United States. Tom is the data controller for the processing described here. Contact him at privacy@back.dev.
Back has no office, company or representative in the UK or the EU. If you are in the UK or the EEA, contact Tom directly at the address above. If that changes, we will publish the relevant details here.
Data we hold and why we use it
Your account — all products
We hold your email address, a protected hash of your password, your first and last name if you provide them, and your settings. We never store the password itself. We use this information to provide your account. Lawful basis: performing our contract with you.
Backburner
We hold your tasks, goals, initiatives, projects, records, comments and links, including their order and completion status. Contract.
We also keep a log of your actions in the app: when you complete, skip, reorder or create an item, we record the action, the item and the hour of your local day. This log is linked to your account; it is neither anonymous nor aggregated. Backburner uses it to learn how you work and rank your list. It is used only for your account, never pooled with other people's data or used to train a shared model. We do not send this action log to outside services for ranking. Contract, because ranking is part of the service.
Backpack
We hold your files, folders, documents and spreadsheets, including their contents, along with the share links you create and whether each link is enabled. Contract.
Uploaded files have private, unguessable web addresses, but access at those addresses is not password-protected. Anyone with a share link or the underlying file address can download the file. We do not publish these addresses. Turning sharing off invalidates the old address and share link.
Backdrop
We hold your project structure, edit lists, comments and approvals. Contract.
When video is uploaded. Cutting, transcoding and captions run in your browser on your own device. Editing alone does not require an upload. Video is sent to us in two circumstances:
- If you are signed in, Backdrop saves a copy of your original footage to Backpack, on our servers.
- If you invite someone to edit with you, a preview copy is uploaded to our sync server so they can see it.
If you use Backdrop while signed out and never share a project, your footage stays on your device. Signing in or sharing a project uploads footage as described above.
Feedback
Backburner has a Feedback button on every screen and in Settings in its iPhone app. On back.dev, Backdrop and Backpack, feedback is off unless you switch it on in your Back account. Nothing is sent until you write a note and press Send.
A report always includes your note, the element you selected, and the page address, with anything after a “?” removed. Unless you untick the box in the report, it also includes the page title, your browser's user-agent string, your window size, and a trail of roughly the last 60 things you clicked or pages you visited in that session. This context helps us investigate the problem. It can contain the names of your tasks, files or pages, so review it with the same care as a screenshot. The iPhone app sends your note, the screen you were on, your theme, the app version, and your phone's model and iOS version. Lawful basis: our legitimate interest in fixing our software. You can object at any time by unticking the box, choosing not to submit a report, or asking us to delete one.
Backdrop invite requests
The invite form collects a name, an email address and a note. If someone enters your details, we hold them so we can respond. Legitimate interest in responding to an enquiry. Write to us and we will delete them.
Information you enter
Task titles, notes, documents, spreadsheets and comments can contain any text, including information about health, finances or other people. We do not request sensitive information. Backburner uses task wording to identify the kind of action, such as reviewing or creating, to help rank your list. It does not infer health categories. We do not sell what you write or share it with advertisers or analytics companies. Service providers process data only as described below.
Avoid putting sensitive information in task titles or feedback reports.
Cookies and local storage
We use two cookies and no others.
| Cookie | What it does | Consent needed? |
|---|---|---|
bb_session | Keeps you signed in across the Back products. | No — strictly necessary |
back_theme | Remembers your appearance setting. | No — it only stores a setting you chose |
Both are exempt from consent under UK PECR and the ePrivacy Directive because they are strictly necessary to deliver something you asked for. We set no advertising or measurement cookies, which is why you don't see a cookie banner. If that changes, we will obtain your consent before setting those cookies.
The products also use your browser's local storage to work offline and remember your place. That data stays on your device.
Loading performance. Our web apps send limited first-party measurements to help us improve loading times and the loading animation. These describe the product version, a fixed category of wait, its duration and outcome, whether the page was hidden, whether the animation appeared and how full it was, a broad compact/wide layout category, and the reduced-motion setting. They contain no account or visitor identifier, page address, title, file name, or content. We combine them into daily counts and histograms; individual measurements are not stored. We retain 30 UTC calendar days of aggregates; daily cleanup removes expired records, which may remain in storage until the next cleanup runs. Collection uses no cookies or browser storage.
Do Not Track. We do not track you across other websites. Loading performance collection is disabled when your browser sends Do Not Track or Global Privacy Control. No third party uses our Services to collect information about your activity on other sites.
Service providers and other disclosures
The following providers process data for Back.
| Who | What they do | Where |
|---|---|---|
| Vercel | Runs the sites and the API, stores uploaded files, keeps server logs | United States |
| Neon | The database — everything described above | United States |
| Resend | Sends Back account emails, including password resets and password-change notifications; receives your email address and the message subject and body through its API to deliver them | United States |
| Forward Email | Receives mail sent to any @back.dev address and forwards it on | United States |
| The mailbox that forwarded mail lands in, so we can read and answer it | United States | |
| Anthropic and OpenAI | Provide development services that process feedback reports and their included context so we can investigate and fix problems | United States |
We do not use analytics providers, advertising networks or data brokers.
Feedback reports are shared for troubleshooting. We review reports using development services from Anthropic and OpenAI. These services receive the report text and any context included with it, which can contain task, file or page names. Do not include passwords or sensitive information in a report.
Your tasks, files, documents and video projects are not sent to these development services as part of ordinary use. If you include any of that content in a report, it is shared with the report. We do not use your content to train models or permit others to do so.
We will also disclose data when legally required, such as under a valid court order. A request without a legal requirement is not sufficient.
Where your data is
All data is processed in the United States. Back operates from Washington State, and the servers are in Virginia. If you are in the UK or the EEA, your data is held outside your country from the time you sign up. Our agreements with Vercel and Neon include standard data protection clauses for data transferred to them.
How long we keep it
- Your content — until you delete it, or until you delete your account.
- Your account — deleted when you delete it or ask us to do so, as described below, without a waiting period.
- Password-reset links — 30 minutes, and single-use.
- Server logs — held by Vercel. We do not control their retention period and hold no copy.
- Feedback reports — kept until you delete your account, or until you ask us to delete them. Marking a report resolved does not delete it.
Your rights and controls
- Access your data. Sign in at account.back.dev and choose Download your data. The download is a machine-readable file containing your account, Backburner content, documents, feedback reports, the full action log used for ranking, and a list of your Backpack files with their details and share links. It does not include the contents of uploaded files; download those directly from Backpack. Or ask at privacy@back.dev and we will send it to you.
- Correct your data. You can edit most information directly in the product. Contact us for other corrections.
- Delete your account and its content. Go to account.back.dev with Delete my account. This permanently deletes your account, Backburner content, documents, feedback, Backpack files and associated share links. The share links stop working immediately. If deletion cannot finish, your account remains in place and we notify you so you can try again. An incomplete deletion is never reported as complete. You can also request deletion at the email address above. We cannot delete copies that other people have already downloaded from a shared file.
- Take your data elsewhere. The file we send you is machine-readable JSON.
- Object to processing. Untick the feedback trail in a report, or write to us to object to any processing based on legitimate interests.
- Make a complaint. You can contact us or go directly to the data protection authority where you live. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is your national authority. In the United States you can go to the Federal Trade Commission, or to the Attorney General of your state.
We answer within a month wherever you are, and there is no charge.
Automated decisions
Backburner learns from how you work to rank your list automatically. This determines only the order in which items appear. It has no legal effect on you and does not make decisions outside the app, so it does not fall within the category of automated decision-making that carries a right to opt out. You can always reorder the list manually, and your manual order takes precedence.
Children
Back is not intended for children under 13, and we do not knowingly hold their data. If your country sets a higher minimum age for online services, that age applies. If we learn that someone below their country's minimum age has an account, we delete the account and all its content without retaining a record of their age. Contact us if you believe a child has an account.
Security
We protect passwords with one-way hashing and encrypt connections to the Services. Sign-in and sharing use protected credentials. Anyone who obtains an active share link or file address can access that file, as explained above.
If your data is exposed, we will notify you promptly.
If you find a security problem, report it to security@back.dev — details at security.txt. We will not take legal action against anyone who reports a genuine issue in good faith.
When this changes
We will update this page and the date at the top when this notice changes. We will notify you of material changes in the app or by email before they take effect.