Privacy & safety
No account. No server-side contact list. No readable note. Your route, your vehicle, and your companions stay sealed on the phone. The app is designed not to retain IP addresses, but provider proof is not complete. BackBy is a development preview; do not depend on it for a real trip yet. Here is what the service can see and where risk remains.
The server stores
The server does not store
Your trip plan
The note holds your trip plan: route and turnaround, trailhead, vehicle, companions, permits, and who to call. An optional pin, off by default, can mark a trailhead or a take-out. It is a fixed pin you place, not live tracking.
Your Backer sees Scheduled, not your route. The current demo does not yet enforce this promise safely. Do not put real private or safety information in it. Production is designed to release a note key only when the Plan needs attention, Help is requested, or a completion contains the private safety signal.
If you choose Right Away, your Backer can read the trip plan as soon as you start the Plan. Some people want that for a long trip. It also shares any legal name, phone number, or pin in that Plan, and you cannot take back a copy a Backer already opened.
Important limits
The service stores Plan deadlines and may infer patterns from their timing, such as a Back By time every Saturday. Repeat grouping is encrypted for paired Backers; the server does not receive a repeat-series label. Like any internet service, the phone still makes a network connection, and provider-level proof of removed identifying request metadata is not complete.
The pin is off by default. Turning it on can reveal your IP address and the map area you viewed, such as a trailhead, to the map provider. The app explains this in the info button beside Share Location.
Local records are encrypted. Lock-screen banners show details by default; you can make them generic in Settings. After opening BackBy, it shows the exact action. Protection is weaker without a secure device passcode and cannot stop on-device malware or keyloggers.
The server does not call search and rescue, a ranger, the sheriff, or your family. BackBy is not a personal locator beacon or a satellite messenger. Your Backer decides how to respond using the plan you prepared. Carry a beacon or messenger where you need one.
Nothing needs to happen on your phone after the Plan starts. Marking I'm safe does need a connection. An action taken offline stays pending until it is confirmed. If you cannot check in, your Backer sees Needs Attention after the Grace Period and follows your note. The server sends no messages of its own; Backer apps check for updates and may notify locally.
Legal process
If legally required, BackBy may be able to provide pseudonymous event records, encrypted notes, and integrity proofs. It cannot provide plaintext notes, so it cannot provide your route or your companions, and it has no server-side contact graph. Any statement about provider IP metadata requires a fresh complete evidence report.
Encrypted payloads have a fixed retention period, with safety floors that keep them available through the relevant Plan and attention window. Pseudonymous Plan events are permanent and append-only.
For reviewers
Notes are encrypted on the device with AES-GCM. The unlock key is derived from the Backer secret shared by QR code or recovery words. The server never receives that key.
Sensitive reads require a per-Plan capability. A missing or wrong capability returns the same 404 response as missing data.
Every lifecycle change is a new append-only event. Public production is designed to publish signed tree heads and daily anchors so independent reviewers can detect tampering. Production evidence is not yet complete.
On a PIN-protected Plan, two incorrect PIN attempts silently complete the Plan with a private safety signal. The Planner sees an ordinary success screen. Trusted Backers can recognize the signal and read the note; the server cannot tell whether the completion was normal or carried the signal.
