The server stores
The minimum needed to run a Plan
- Pseudonymous Plan events such as created, completed, rescheduled, or missed
- An optional encrypted, padded note that the server cannot read
- Public integrity records used to detect changes to history
Privacy & safety
We designed BackBy to know less about you.
No account. No server-side contact list. No readable note. The app is designed not to retain IP addresses, but provider proof is not complete. Here is what the service can see and where risk remains.
The server does not store
Your identity or your support network
- No plaintext legal name, phone number, contacts, or address book
- No list showing who your Backers are
- No cookies, analytics profile, or session. Provider-level no-IP evidence is still required.
Your private note
You choose when Backers can read it.
Emergency Only is the intended default
The current demo does not yet enforce this promise safely. Do not put real private or safety information in it. Production is designed to release a note key only when the Plan needs attention, Help is requested, or a completion contains the private safety signal.
Right Away is optional
If you choose it, Backers can read the note as soon as the Plan is created. That also shares any legal name, phone number, or map pin included in that Plan.
Important limits
Privacy is a design choice, not a magic shield.
Someone who already knows a channel may observe activity
The service stores Plan deadlines and may infer patterns from their timing. Repeat grouping is encrypted for paired Backers; the server does not receive a repeat-series label. Like any internet service, the phone still makes a network connection, and provider-level proof of removed identifying request metadata is not complete.
Optional maps use another company’s tiles
Map sharing is off by default. Turning it on can reveal your IP address and viewed map area to the map provider. The app must warn you before the first map request.
A compromised phone can still expose local information
Local records are encrypted. Lock-screen banners show details by default; you can make them generic in Settings. After opening BackBy, it shows the exact action. Protection is weaker without a secure device passcode and cannot stop on-device malware or keyloggers.
BackBy is not emergency services
The server does not call police, counsel, family, or a rapid-response network. Your Backers decide how to respond using the plan you prepared.
Legal process
We cannot hand over information we never had.
If legally required, BackBy may be able to provide pseudonymous event records, encrypted notes, and integrity proofs. It cannot provide plaintext notes or a server-side contact graph. Any statement about provider IP metadata requires a fresh complete evidence report.
Retention
Encrypted payloads have a fixed retention period, with safety floors that keep them available through the relevant Plan and attention window. Pseudonymous Plan events are permanent and append-only.
For reviewers
Technical evidence, kept out of the everyday flow.
How note encryption works
Notes are encrypted on the device with AES-GCM. The unlock key is derived from the Backer secret shared by QR code or recovery words. The server never receives that key.
How state reads are protected
Sensitive reads require a per-Plan capability. A missing or wrong capability returns the same 404 response as missing data.
How history is meant to be checked
Every lifecycle change is a new append-only event. Public production is designed to publish signed tree heads and daily anchors so independent reviewers can detect tampering. Production evidence is not yet complete.
How the private safety signal works
On a PIN-protected Plan, two incorrect PIN attempts silently complete the Plan with a private safety signal. The Planner sees an ordinary success screen. Trusted Backers can recognize the signal and read the note; the server cannot tell whether the completion was normal or carried the signal.