Backers act. BackBy does not.
BackBy is not a dispatch center and not a rescue service. It sends no one to look for you. The person in town decides what to do using the trip plan you prepared.
Resilience & auditability
A plan that does not depend on one server or one promise.
When you are out of range, the Plan has to hold without you. BackBy is designed so a service outage does not erase the only copy of what mattered, and so independent reviewers can check Plan history. A Plan is a time, a note, and an optional pin, not a moving dot. Several parts of this design still need production proof. BackBy is a development preview; do not depend on it for a real trip yet.
The design
Keep authority with people, and evidence in the open.
No messaging switch
The server sends no SMS, email, or push and stores no contact list. Your Backer's app checks for changes from wherever it has signal and can notify locally. Nothing needs to happen on your phone after the Plan starts. Marking I'm safe does need a connection; an offline action stays pending until it is confirmed.
Append-only history
A change creates a new event instead of rewriting an old one. Add time, and the original Back By stays in the record. That makes silent alteration detectable when the audit system is fully deployed.
Mirrors and local encrypted copies
Public integrity files can be mirrored, while the encrypted trip plan stays with the people who hold the keys.
Status, without spin
Designed, built, and proven are different words.
The table below summarizes the public-readiness document. The repository checklist remains authoritative.
| Protection | Status | What must happen next |
|---|---|---|
| Durable, replayable Plan storage | Development | Restart and multi-replica tests must pass without losing data. |
| Signed history and daily anchors | Development | Production signing and public verification need complete evidence. |
| Private Plan discovery | Development | Discovery must be capability-gated and avoid precise timing exposure. |
| Public mirrors and outage recovery | Development | A restore drill and mirror verification report must succeed. |
| Private or offline map tiles | Later | Until then, the optional pin stays off by default and the app explains the map risk before you turn it on. |
The claim we can make today
BackBy is designed for resilience. It has not yet proven public-release resilience.
Until the checklist is complete, a demo must be treated as a demo. Do not assume that a mirror, anchor, background notification, restore path, or legal safeguard is production-ready merely because it exists in the design. Do not leave a real trip plan with BackBy alone. File your trip plan the way you do today, and carry a personal locator beacon or satellite messenger where you need one.
Independent review is part of the product.
Security reviewers, SREs, SAR volunteers, and outdoor program staff can inspect the open threat model, protocol, audit guide, and readiness criteria.
Review the public repository