# Backwatch Privacy Policy **Last updated: 9 November 2026** This policy covers the Backwatch website, waitlist and (when enabled) public web scanner. The open-source `backwatch` CLI runs on your own machine and sends no telemetry. A scan you run locally makes requests from your machine to the target you specify; the target's own operator may log those requests. ## 1. Who operates Backwatch Backwatch is operated by the same operator as Wisprs (wisprs.co). In this policy, “Backwatch”, “we” and “us” mean the Backwatch service and its operator. For privacy questions or requests, contact **tosh@getwisprs.com**. ## 2. Information we handle ### Waitlist When you join the hosted-monitor waitlist, we store your email address, the page or source label that accompanied your signup, and the time you signed up. The email is lowercased and one row is kept per address. We use it to tell you when the hosted monitor is ready, as the form says. We do not use the waitlist for unrelated marketing. The signup endpoint reads the connecting IP address to apply rate limits. The waitlist feature does not put that IP address in the waitlist table. The shared hosting server may separately write request details to operational logs; see Section 7. ### Public web scans The public web scanner is currently disabled. If enabled, it accepts a public website origin, fetches publicly reachable pages and endpoints to run Backwatch's checks, and stores the resulting report, score, verdict, origin and timestamps. Results are public by default and may appear on the report page, recent scans and leaderboard. The scanner stores a daily salted hash derived from the requester's IP for rate limiting; the scan feature does not store the raw IP in its scan record. Do not submit private, authenticated, confidential or otherwise sensitive URLs. Do not submit a URL unless you are authorized to request automated checks against it. A site owner can request removal through the `/remove` page. Once a domain is removed, later results are kept unlisted under the scanner's design. ### Removal requests If you ask us to remove a site, we store the domain, your email address, any note you provide, and the request time so we can review and process it. Notes are optional. Please do not put sensitive personal information in a note. ### Website and service operations We do not currently run advertising or third-party website analytics on Backwatch. The site may process basic request information needed to serve pages, prevent abuse, troubleshoot faults and protect the service. The shared hosting server may record request details such as IP address, requested path, user-agent, response status and time. The `/home` design preview may store a one-session animation preference in browser `sessionStorage`. It is not a cookie and is cleared by the browser when that session ends. The production homepage does not require it. ## 3. How and why we use information We use information to: - send the one product-availability email requested through the waitlist; - run and display a web scan requested by a visitor, and support the public listing and leaderboard the product describes; - review domain-removal requests and suppress future public listings; - limit automated abuse, keep the site available, diagnose errors and protect the service; and - meet legal obligations and respond to valid legal requests. We do not sell personal information or use it for targeted advertising. Where the GDPR or UK GDPR applies, processing is based on providing a requested service, legitimate interests such as abuse prevention and service security, consent where required, and legal obligations. The rights and legal bases that apply depend on your location and applicable law. ## 4. Public website information Public scan reports describe technical properties observed on the submitted website at the time of the scan. They are not a security certification, endorsement or statement about the site's owner. A public report may be copied or indexed by third parties. Removal from Backwatch cannot remove copies held by search engines, archives or other people. ## 5. Service providers and disclosures The Backwatch website and its database run on the same Contabo VPS as Wisprs. DigitalOcean provides authoritative DNS for `backwatch.dev`. We may disclose information when needed to provide the service, protect people or comply with law. No email-delivery provider is currently used for waitlist messages. We do not share the waitlist with advertisers. ## 6. Retention - **Waitlist:** we keep your email until you withdraw or the hosted monitor launches and we send the availability message. After that, we delete the entry unless you separately ask to receive service communications. You can ask us to delete it sooner by email. - **Public scan results:** if the scanner is enabled, results stay public until the site owner requests removal. After a verified request, reports are removed from public listings and a minimal domain suppression record is kept so later scans stay unlisted. Existing report records may remain in private system records for service integrity. The 30-day leaderboard and 90-day comparison windows are display windows, not deletion schedules. - **Removal requests:** we keep request details while needed to verify and process the request and maintain the domain suppression record. Do not include sensitive information in a request note. - **Operational logs and rate-limit records:** logs rotate by configured size and may be overwritten sooner or later depending on request volume. The deployment bounds Docker JSON logs to three files of up to 10 MB per container; this is not a fixed number of days. Daily scan rate-limit keys rotate daily. We may retain limited information longer where required by law or needed to resolve a dispute or prevent abuse, and then delete or de-identify it when that need ends. ## 7. Security and international processing We use reasonable technical and organizational safeguards appropriate to a small pre-release service. No internet service can promise perfect security. The production app and database share the Contabo VPS used by Wisprs. The VPS region and host-level reverse-proxy log schedule are managed as part of the shared hosting environment and may change with infrastructure configuration. Contact us for current processing-location details. Data may be processed in the countries where our operator and infrastructure providers are located. Where required by applicable law, we use appropriate safeguards for international transfers. ## 8. Your choices and privacy rights You can ask us to access, correct or delete personal information associated with you, or object to or restrict processing where applicable law gives you that right. You can withdraw from the waitlist by contacting **tosh@getwisprs.com**. To request removal of a public scan, use `/remove` or contact that address. We may ask for reasonable information to verify the request and protect the site owner from fraudulent removal requests. You may also have the right to complain to your local data-protection authority. The applicable rights, response periods and regulator depend on your location and applicable law. ## 9. Children Backwatch is a technical service for developers and organizations, not directed to children. Do not submit a child's personal information. ## 10. Changes We may update this policy when our practices change. We will change the "Last updated" date and, where a material change affects information already collected, take reasonable steps to explain the change.