Skip to content
Sign inStart for free

Privacy

Last updated 13 September 2026. Plain English on purpose; the legal terms are on the terms page.

Two kinds of people

Owners sign up, install the widget on their site and read the inbox. Visitors are the owners' users who tap the widget. We process visitor data on behalf of the owner; the owner decides to install the widget and should mention it in their own privacy policy.

What the widget collects from a visitor, and only when they send feedback

  • What they typed: the rating, the message, and an email or phone number if they choose to leave one.
  • The page address (path and title) and the referring page.
  • UTM tags from the page address (source, medium, campaign), if present.
  • Browser type, language, timezone, viewport size and a device class (mobile, tablet, desktop).
  • With every submission: page load timing, the last 20 failed network requests as method, URL without the query string and status code (never request or response bodies, never headers), the last 50 console errors and warnings, the last 20 JavaScript errors, and the last 5 clicked elements as CSS selectors (never their text).
  • A country code derived from the IP address on our server. The IP address itself is discarded and never stored.

Email addresses, tokens and card numbers inside any of the above are replaced with placeholders in the browser before sending and again on our server.

What the widget never collects

  • No cookies, no local storage identifiers, no fingerprinting, no visitor profile that outlives the tab.
  • No form field values, no passwords, no keystrokes, no request or response bodies, no headers.
  • No scroll depth, no clicks outside the widget, no page views tied to a person.

What one browser tab remembers

The widget keeps two things in the tab's own session storage: whether the bubble's label has been shown, and the campaign tags and referring site of the page the visit started on, so a report sent three pages later still says where the visit came from. Neither is an identifier, neither is readable by another site, and both are gone when the tab closes. Nothing is written to cookies or to local storage, and nothing is used to recognise a returning visitor.

Automatic page measurements

The widget automatically sends page-view counts, page paths, campaign tags, device category, external referrer hostnames, and available load timing. The server derives country, browser family, and operating-system family. These are stored as hourly aggregates, without visitor identifiers, full user-agent strings, or referrer paths and query strings.

We also count, once per page or single-page app route, the first uncaught JavaScript error or unhandled rejection, the first failed request, the first rage click and the first dead click. For the error and the failed request the widget also sends one sample — the redacted error message with its source file and line, or the request method, URL without its query string and status — which is stored per distinct error per day for 91 days, without stacks, request bodies, headers, selectors or visitor identifiers. Detailed diagnostic context is sent with every submission, as described above.

Widget opens and feedback submissions are also counted in aggregate.

Owners

  • We store your email address and your organization and project settings.
  • Sign-in is handled by Supabase Auth; we do not see your password.
  • We send you email about reports (immediately for problems, daily for the rest) and can post to a Slack webhook you provide.

Retention

  • Automatic page analytics aggregates are scheduled for deletion after 91 days by the retention job.
  • Free plan: the technical context (requests, errors, clicks) is deleted 14 days after a report; the message and rating stay.
  • Pro plan: context kept for one year. When a plan lapses, settings are kept but the widget is served the free plan's values; nothing is deleted.
  • Owners can delete any report permanently or delete their organization from the dashboard, and export a project’s reports and their history as JSON (once a day on Free). The export carries the project, its reports and every owner action on them; the automatic analytics are aggregates with no visitor identifiers and are not part of it.

Where and with whom

Data is stored with Supabase (Postgres) and processed on Railway and Vercel. Email is delivered by Resend. Spam checks use Cloudflare Turnstile, which never sees the feedback content. We do not sell data and do not use it to train models.

Visitors: asking for deletion

If you left feedback on a site using Backwire and want it removed, contact the site owner, or email us at hello@backwire.io with the site and roughly when you sent it. We will locate and delete it within 30 days.

Contact

Asian Digital Mind LLC, Irvine, CA. hello@backwire.io