Privacy notice
For the Backproof app at app.backproof.dev. Last updated 11 Nov 2026.
Who we are
Backproof is run from the Netherlands. For anything about your data, write to support@backproof.dev.
This notice covers the app. The waitlist on backproof.dev has its own notice.
What we store, and for how long
| Data | Why | Kept |
|---|---|---|
| Your name, email address and login methods | To log you in and contact you about your account | Until you delete your account |
| Storage connections: endpoint, region, bucket and access key. The secret key is encrypted. | To list your bucket | Until you delete the connection |
| Listing results: file names, sizes and dates in the folders you watch | To spot late, missing and small backups | Check summaries for 30 days, size history while the database exists |
| Incidents and alert deliveries | To show what happened and that alerts were sent | 12 months |
| Alert channels: extra email addresses and the Slack webhook URL, encrypted | To send alerts | Until you remove them |
| Sessions: IP address and browser | To keep you logged in and show where you're logged in | Until you log out, here or under Settings, Sessions, or delete your account |
| Feedback, with the page you sent it from | To improve Backproof | Until you delete your account |
What we never store
- The contents of your backups. Backproof lists files; it never reads or downloads them.
- Passwords. You log in with GitHub, Google or a one-time code.
- Your secret keys in logs, error reports or emails.
Who processes it for us
- Resend sends login codes, invites and alerts from notify.backproof.dev.
- Sentry, in its EU region, receives error reports. Keys and other credentials are removed before they're sent.
- netcup GmbH runs the app and its database in Vienna.
- GitHub and Google only when you choose to log in with them. We receive your name and verified email address.
- Slack receives alert messages if you add a webhook.
How we protect it
Access keys and webhook URLs are encrypted at rest, and the encryption key is kept outside the database. Every request is scoped to your workspace. Admin access needs a GitHub login with two-factor authentication, and every admin view of your data is logged.
Your rights
You can see, correct and delete your data. Delete your account at any time under Settings, Profile; it removes your workspace, connections, keys and history straight away. For a copy of your data, write to support@backproof.dev. You can also complain to the Autoriteit Persoonsgegevens.
Changes
We date every change to this notice and mention it in the changelog. Big changes are emailed to you first.