Privacy Policy

Apps made with Backplane

The organizations and people who build apps with Backplane, our customers, decide what their apps collect and who can see it. When you use one of those apps, the items, photos and files you add belong to the customer that runs it, and that customer's own privacy notice explains how they use them. We store and process that content on the customer's behalf, following their instructions and this policy.

If you have a question about an app, contact the organization that runs it. If you write to us instead, we'll pass your request on to them.

Information we collect

Information you give us

• Account information. Your name, email address and password. We store your password only as a salted hash, so we can check it but can't read it.
• Sign-in with Google or Microsoft. If you choose to sign in this way, the provider sends us your name, email address, profile picture if you have one, whether it has confirmed your email address, and its identifier for your account. We use this only to sign you in. We don't get access to your mail, files or contacts.
• Workspace information. Your workspace's name and plan, its members and their roles, the email addresses you invite, your API keys and the addresses your webhooks send to. API keys are stored only as hashes, apart from a short prefix that helps you tell them apart.
• Content. The apps you build, including their screens, settings, icons and images, and the items, photos and files that you and the people using your apps add to them.
• Templates you share. When you share an app as a template, we store a copy of its design and any starting items you chose to include, with the name, description and publisher name you give it. We never copy the items people entered in the app into a template. If someone reports a template, we keep their reason and who sent it, for our review.
• Billing information. If you buy a paid plan, the billing contact and details you give us, and a record of your invoices and payments.
• Messages to us. When you email us, we keep your message and our reply.

Information we collect when you use Backplane

• Sign-in sessions. When you sign in, we record the IP address and the browser and device type for that session. You can see your sessions under your account's devices and sign out of any of them.
• Activity log. When someone in a workspace publishes a version, invites someone, changes a role, creates an API key or takes a similar action, we record who did it, when and the IP address it came from. The workspace's owners can see the log, without the IP addresses.
• Usage. What each workspace uses against its plan's limits, such as live apps, items, photos, automation runs, API calls and webhook messages.
• App diagnostics. Apps report when they open, when they update and when they run into an error, with the app's version and a random identifier for the device. We use these reports to show how many devices run each version and to spot a release that's causing errors.
• Email records. For each email we send, we record what kind it was, when we sent it and whether it was delivered. The recipient's address is stored only as a one-way hash. If an address bounces or its owner marks our email as spam, we keep that address so we never email it again.
• Server logs. Like most websites, our servers log the requests they receive, including your IP address, the address you requested and your browser type.

Information about other people

When you invite someone to a workspace or an app, you give us their email address and we send them the invitation. Only invite people who expect to hear from you.

Cookies and device storage

The website at backplaneapp.com sets no cookies and runs no analytics or advertising scripts.

The designer and apps use cookies only to keep you signed in. Backplane can't work without them, so there's no setting to turn them off. We don't use cookies for advertising, and we don't let other companies track you through Backplane.

Apps keep a copy of their data on your device, along with any changes waiting to sync, so they keep working offline. Removing the app or clearing its site data in your browser deletes that copy. Apps also remember on the device whether you closed the hint about adding them to your home screen.

How we use information

We use information to:

• Provide Backplane: run your account and workspaces, host and sync your apps, send the emails the service depends on, such as sign-in codes, invitations and password resets, and bill for paid plans.
• Keep Backplane secure and reliable: prevent abuse and fraud, limit how fast requests can be made, look into problems and keep backups.
• Apply plan limits and our Terms of Service.
• Tell you about your account: security notices, warnings before an unused free workspace is deleted, changes to our policies and replies to your messages.
• Improve Backplane, using measures such as how often each release runs into errors.
• Meet our legal obligations.

We don't sell personal information, and we don't share it for targeted advertising. We don't use your content to train AI models.

We look at the content in a workspace only when you ask us to, for example to help with a problem, when it's needed to keep Backplane secure or working, or when the law requires it.

We don't send marketing email. If that changes, every marketing message will include a way to unsubscribe.

The AI builder

When you ask the AI builder to make an app or change one, we send what you wrote to our AI provider, Anthropic, together with the design of the app you're changing: its screens, fields and settings. We don't send the items, photos or files in your apps. Anthropic uses this to return a draft and, under its commercial terms, doesn't train its models on it.

We keep a record of each request's size and cost, but not what you wrote. The app the AI builder makes is saved in your workspace like any other draft.

How we share information

• In your workspace. Owners and editors can see the workspace's members, their names, email addresses and roles, and who has been invited. People using an app see what the app's rules let them see.
• Where you send it. Webhooks and API keys send content wherever the workspace points them.
• Templates you share. A template you share with your workspace is visible to the people who build in it. A template you share with everyone is visible to all Backplane users once we've reviewed it, along with the publisher name you chose.
• Service providers. We use the companies below to run Backplane. They may use the information we give them only to provide their service to us.

• Sign-in providers. If you choose to continue with Google or Microsoft, that company learns that you signed in to Backplane. Its own privacy policy covers what it does with that.
• Legal reasons. We may share information if we believe in good faith that it's needed to comply with the law or a valid legal request, to protect someone's safety, to protect Backplane or its users from fraud or abuse, or to enforce our Terms of Service. When the law allows, we'll tell the affected customer first.
• A change of ownership. If Deoxy Labs is part of a merger, acquisition or sale of assets, information may be transferred as part of that deal, and this policy will continue to apply to it.
• With your permission. Otherwise, we share information only when you ask us to or agree to it.

Where information is stored

Backplane runs on Cloudflare. Account information and files are stored in Cloudflare data centers in the eastern United States. Each workspace's own database is stored in the Cloudflare region nearest to where the workspace was first used. Requests pass through Cloudflare's network, which has data centers around the world.

We're based in the United States. If you use Backplane from another country, your information will be processed in the United States, where data protection law may differ from the law where you live.

How long we keep information

• Your account. We keep it until you ask us to delete it.
• Content. We keep it until you delete it or its workspace is deleted. A photo is removed from storage 7 days after the last item using it is deleted or changed.
• Templates. We keep a template until you remove it or its workspace is deleted. Apps that other people made from it are their own copies and stay with them. Reports about a template are deleted when we approve it again or it's removed.
• Unused free workspaces. A free workspace is deleted after 90 days in which nobody opens it, uses one of its apps or calls its API. We email its owners 20, 10 and 5 days before. When a workspace is deleted, its apps, items, photos and files are removed straight away.
• Backups. Our hosting provider can restore our databases to any point in the past 30 days, so deleted information can remain in those copies for up to 30 days.
• Sign-in sessions. A session ends when you sign out or after 30 days without use, and we then delete it.
• Links and codes. Sign-in codes expire after 10 minutes, password reset links after an hour, email confirmation links after a day and invitations after 14 days.
• App diagnostics. We keep the latest 5,000 reports for each app.
• Server logs. We keep them for about a week.
• Activity log. It stays with its workspace. After a workspace is deleted, we keep its activity log and a record that it existed, so we can answer questions about it later.
• Email records. We keep them to apply sending limits, and we keep addresses that bounced or reported spam so we never email them again.
• Billing records. We keep invoices and payment records for as long as tax and accounting law requires.

Your choices and rights

In the designer you can change your password, see the devices you're signed in on and sign out of them, export any table as a CSV file, and delete apps, items, photos and files.

To get a copy of your information, correct it, or delete your account or a workspace, email support@deoxylabs.com from the address on your account. We'll confirm the request is yours and reply within 30 days. If you own a workspace, tell us whether to delete it as well or hand it to another member.

Depending on where you live, the law may give you the right to access, correct, delete or move your information, to object to or restrict some uses of it, and to withdraw consent. We offer these choices to everyone, wherever they live. If we turn down a request, we'll explain why, and you can ask us to reconsider by replying. You can also complain to your data protection authority or, in the United States, to your state attorney general.

If you use an app made with Backplane, ask the organization that runs it for a copy of what you've put into it, or to delete it.

Emails about your account, such as sign-in codes and security notices, are part of the service, so you'll get them for as long as you have an account.

Because we don't sell personal information or use it for targeted ads, browser signals such as Global Privacy Control and Do Not Track don't change how Backplane works.

How we protect information

• Every connection to Backplane uses HTTPS.
• Passwords are stored as salted hashes, and API keys, invitation links and sign-in codes as hashes. Sign-in tokens from Google and Microsoft are stored encrypted.
• Each workspace keeps its items in a database of its own, and the server checks every change against the app's access rules.
• Photos taken in an app are resized on the device before upload, which removes their location and other camera details.

No service is perfectly secure. If we learn of a breach that affects your information, we'll tell you as the law requires.

Children

Backplane isn't meant for children under 13, and we don't knowingly collect personal information from them. Customers agree not to use Backplane to collect personal information from children under 13. If you think a child under 13 has given us personal information, email us and we'll delete it.

If you're in Europe or the UK

For people in the European Economic Area, the United Kingdom and Switzerland, Deoxy Labs is the controller of the information this policy describes, except content in customers' apps, which we process on the customer's behalf. We rely on these legal bases:

• Our contract with you, to provide Backplane under our Terms of Service.
• Our legitimate interest in running a secure, reliable service, to prevent abuse, keep backups and improve Backplane.
• Our legal obligations, where the law requires us to keep or share information.
• Your consent, where we ask for it. You can withdraw it at any time.

Changes to this policy

When we change this policy, we'll post the new version here and update the date at the top. If a change is significant, we'll also tell account holders by email or in the designer before it takes effect.

Contact us

For questions or requests about privacy, email support@deoxylabs.com. Backplane is a service of Deoxy Labs, based in Texas in the United States.