Backfeed Privacy Policy

Backfeed is a native iOS and macOS app for printing to thermal label printers. This policy explains, in plain language, what the app and its optional cloud service do and don’t collect. It is written to be honest and small — Backfeed is made by an independent developer, not a large company, and this policy reflects the actual product rather than boilerplate.

Backfeed has two ways to print, and the privacy story is different for each:

Local printing — the app talks directly to a printer on your own network. Nothing about your printing reaches us.
Backfeed Cloud — an optional paid subscription that lets you print to your printers from anywhere through our relay service. This involves a pseudonymous account plus subscription, device, printer, job, and operational metadata, described below.

If you never subscribe to Backfeed Cloud, only the “Local printing” section applies to your use: local-only use sends no app data to us. The app’s privacy manifest and App Store privacy answers describe the app as a whole, however, so they also declare the data collected when someone chooses Backfeed Cloud.

Who we are

Backfeed is published by Robert Owens. Contact: [email protected].

Local printing (free tier and the one-time Backfeed Local unlock)

When you use Backfeed to print on your own network:

Local-only app use sends no app data to us. There is no account, no login, and no analytics.
The app discovers printers on your local network and sends print data directly to your printer over your own network. That data does not pass through us or any server we operate.
The documents, images, and labels you print stay on your device and your network. We never see them.
The Backfeed Local unlock (a one-time in-app purchase that enables printing your own PDFs and images locally) is handled entirely by Apple’s App Store. We receive no personal or payment information from that local purchase; the app checks Apple’s confirmation on your device.

Crash and diagnostic data

Backfeed does not operate any analytics or crash-reporting service, and the app sends no usage or diagnostic data to any server of ours. Crash and performance diagnostics, if any, are handled entirely by Apple’s built-in reporting under Apple’s privacy policy, and you control whether Apple shares diagnostics with developers in your device settings (“Share With App Developers”). Anything we might receive that way is aggregated and does not identify you.

Backfeed Cloud (optional paid subscription)

Backfeed Cloud is a relay service that carries print jobs from the app to your printers when you’re not on the same network. Subscribing to it changes what data exists, so here is exactly what we do and don’t collect.

What we collect

Account and subscription records. We store a relay account ID and creation time; Apple’s original and latest transaction IDs; the latest transaction signed and purchase timestamps; subscription tier, StoreKit environment, expiry, and entitlement state; and whether the account is active or suspended. These are pseudonymous account and purchase identifiers. We do not receive your name, email address, Apple ID, or payment details.
Device and credential metadata. We store a client-generated device ID and authentication metadata such as key IDs, a short display prefix, SHA-256 hashes of device and printer credentials, creation and revocation timestamps, and printer-credential generation IDs. Plaintext credentials are not retained after provisioning or request processing.
Printer claim metadata. We store each claimed printer’s serial number, account association, claim time, whether the claim is currently usable under the account’s tier, and its credential metadata.
Job metadata. For each Cloud job we store its account association, printer serial, timestamp, byte count, client-generated job ID, state (accepted, writtenToSocket, or writeFailed), and a SHA-256 payload fingerprint used only to make retries idempotent. A writtenToSocket state means the relay wrote the job to the printer connection; it does not prove the label printed.
Notification metadata. We store App Store Server Notification IDs, receipt timestamps, and the associated relay account when one exists so a notification is applied only once.
Structured operational logs. The relay emits timestamped service events used to operate, secure, and troubleshoot Cloud. Depending on the event, these can include relay account, transaction, notification, key, credential generation, printer serial, and client job IDs; tier and environment; byte counts; job or connection state; and error details. The logs do not contain label bytes, plaintext credentials, or signed StoreKit payloads.

Data processed temporarily

Signed StoreKit data (JWS). Redemption, recovery, deletion, and App Store notifications send signed transaction data to the relay. It is verified and processed in memory. The signed JWS itself is not persisted; only the account, transaction, entitlement, and notification fields listed above are stored.
Label data (ZPL). ZPL label bytes pass through memory while the relay validates and writes a job to your printer. Label bytes are not persisted. The relay stores only the job metadata and SHA-256 idempotency fingerprint listed above.
IP addresses for rate limiting. The relay uses a request’s source IP as an in-memory rate-limit key before authentication. These keys are not written to the relay database or application logs. The limiter applies a five-minute idle expiry and a bounded key count, and all keys disappear when the process restarts.

What we do NOT collect or store

A persisted copy of your labels or documents. Cloud label bytes pass through the relay but are not stored. The SHA-256 fingerprint cannot be used by the relay to reconstruct the label.
Your name, email address, or Apple ID.
Your payment details. See “Billing” below.

Billing, purchases, and refunds

Apple handles payment for the Backfeed Local unlock, Backfeed Cloud subscriptions, the 14-day free trial, renewals, cancellations, and refunds. We never see or store your credit card, Apple ID, or other payment information. For Cloud, Apple provides the signed transaction and subscription status data listed above so the relay can grant and revoke service. Manage or cancel a subscription in your Apple account settings; request refunds through Apple.

How long we keep cloud data

Job metadata: the active relay database is configured to prune job metadata older than 90 days. It exists for idempotency, delivery diagnosis, and support.
Account, subscription, notification, device, and printer metadata: kept to provide Cloud, reconcile subscription status, enforce security controls, and support account recovery. A lapse makes Cloud credentials unusable but does not itself delete the account. You can request deletion as described below.
Deletion tombstone: deleting a subscription-backed account removes its account-linked rows from the active database but preserves a SHA-256 digest of the original transaction ID, a digest of the latest transaction ID, and the deletion, latest signed, and latest purchase timestamps. This digest-only security record prevents stale redemption or notification replay. It has no time-based expiry and is cleared if a later explicit redemption with currently valid proof creates a fresh account. Raw transaction IDs are not retained in the tombstone.
Backups: the relay database is backed up nightly to Cloudflare R2, an object-storage service we use as a service provider. A backup is a copy of the whole database, so it contains the same account, subscription, device, printer, and job-metadata records described above — it does not contain label content, because label content is never written to the database in the first place. Backups are encrypted before they leave our server and are kept on a tiered schedule — daily backups for 7 days, weekly backups for 30 days, and monthly backups for 90 days — so no backup is kept longer than 90 days. Account deletion acts on the active relay database; because no backup outlives 90 days, data removed from the active database disappears from backups within that window. Deletion from backups is therefore not immediate, but it is bounded. Cloudflare’s handling of data we store with it is governed by its own privacy policy at cloudflare.com/privacypolicy.

Operational server logs

The Cloud relay’s proxy access log is disabled so Weblink request paths and source IP addresses are not written there. This does not mean the service keeps no logs: the relay produces the structured application logs described above. Source IP addresses used transiently for in-memory rate limiting are not added to those logs.

Website hosting and service providers

The Backfeed website — these pages at backfeed.cloud, including this policy — is delivered through Cloudflare, a content-delivery and security network we use as a service provider to serve the site and protect it from abuse. This is separate from the Backfeed Cloud print relay described above.

What Cloudflare handles. When your browser loads a page, Cloudflare processes the request at its edge and, in doing so, sees your IP address and basic request metadata — the page requested, your browser’s user-agent string, and the time of the request. Cloudflare may retain some of this in its own security and network logs. It processes this data on our behalf to deliver and secure the website.
What it is not used for. We use Cloudflare only to serve and protect these pages. We do not use it to build advertising or analytics profiles, and there is no third-party ad or analytics tracking on this site.

Cloudflare’s handling of that data is governed by its own privacy policy at cloudflare.com/privacypolicy. Simply visiting this website does not involve your subscription, your relay account, or your print jobs — the “Operational server logs” note above concerns the print relay, which is a separate service and is not served through Cloudflare. We do, separately, use Cloudflare’s R2 storage to hold the relay’s nightly database backups; that is described under “How long we keep cloud data” above.

Children

Backfeed is a tool for printing to label printers and is not directed to children. We do not knowingly collect personal information from children under 13 (or the equivalent age in your region). If you believe a child has provided us information, contact us and we will delete it.

Your rights (GDPR / CCPA and similar)

We keep very little data, and what we keep for Backfeed Cloud is pseudonymous (tied to a subscription identifier, not to your name). Within those limits:

Access / know: you can ask what data we hold that is associated with your subscription identity.
Deletion: you can ask us to delete your relay account and its linked keys, printer claims, notification records, and job metadata from the active database. The digest-only security tombstone and the 90-day backup window described above apply. Your subscription itself is managed through Apple.
No sale of data: we do not sell your personal information, and we do not use it for advertising. There is no third-party ad or analytics tracking in Backfeed.

Because we don’t collect your name or email, we identify your data through your subscription. To make a request, contact us at the address above — you may need to provide information from your Apple purchase so we can locate the right account.

Changes to this policy

If we change this policy, we’ll update the effective date above and, for material changes affecting Backfeed Cloud, surface a notice in the app or on this page.

Contact

[email protected]