Privacy Policy

Last updated October 28, 2026

The short version

Backstep runs on your computer. Your code, files, database contents, backups, history and passwords stay on your computer or in your own database. We never see them.
The only thing Backstep sends us is an anonymous count of installs, and you can turn it off.
This website has no cookies, no ads and no tracking.
We don't sell or share anyone's data.

1. What stays on your computer

Backstep keeps everything it needs locally, in a ~/.backstep folder on your computer that only your user account can read:

The history of what your AI tools changed.
Copies of files saved before they changed.
Connection details for services you connect, such as your Supabase database. These can include passwords, so they're stored with permissions that only you can read.

Backups of database changes are stored inside your own database. None of this is sent to us.

2. The anonymous install count

So we know roughly how many people use Backstep, it sends a small message when it's installed, and at most once a day while it's in use. Each message contains only:

A random ID made on your computer (it isn't tied to your name, email or accounts).
The Backstep version, your operating system, your processor type and your Node.js version.

It never includes file names, paths, code, commands, server or project names, database contents, or anything from your history.

These messages go to PostHog, the analytics service we use, with personal profiles and location lookup turned off. Like any internet request, PostHog receives your IP address in order to receive the message, and we've set it not to use it to work out your location.

To turn it off, set BACKSTEP_TELEMETRY=0 or DO_NOT_TRACK=1 in your environment.

3. Connecting your services

When you connect a service like Supabase or Firebase, Backstep talks to it directly from your computer, using your own login. Nothing passes through us, and we never see your logins, keys or data.

4. AI tools

Backstep doesn't use AI and doesn't send your data to any AI service. The AI tools you use alongside it, like Claude Code or Cursor, are run by other companies and have their own privacy policies.

5. This website

This website doesn't use cookies, analytics or tracking. It is hosted by Vercel, which handles basic request information such as your IP address and browser type to deliver and protect the site. Its fonts are loaded from Google Fonts, which also receives your IP address when your browser fetches them. The copy buttons only touch your clipboard when you click them.

6. Sharing

We don't sell, rent or share personal information, and we don't show ads. We'd only disclose information if the law requires it.

7. Your choices

Turn off the install count at any time (see section 2).
Delete everything Backstep stored on your computer by deleting the ~/.backstep folder.
Ask us to delete the anonymous data tied to your install by emailing us the ID in ~/.backstep/install-id.

Depending on where you live, you may have further rights, such as to access or delete data about you. Email us and we'll help.

8. Security

We keep what Backstep collects to a minimum and take reasonable steps to protect it, but no system is perfectly secure. Keeping your computer and accounts secure protects the data Backstep stores there.

9. Children

Backstep is a developer tool and isn't meant for children under 13. We don't knowingly collect information from them.

10. Changes

If we change this policy, we'll update the date at the top of this page. If a change affects what Backstep collects, we'll say so on this page before it takes effect.

11. Contact

Privacy questions or requests: brandonzeller01@gmail.com