Privacy Policy
Backwire is a private, invite-only, end-to-end encrypted chat service. This page says what we store, what we cannot see, what we never do, and how to reach us. It is written to be read, not to cover us.
Who runs it
TruGen Labs Inc. ("we") runs Backwire on servers it operates in the United States. There is no third party in the chain between your device and our server. Backwire is invite-only: an account can only be created from an invite sent by an existing member.
What we store
Your account
- Your username, display name and avatar if you set one.
- The email address you verified. We use it to confirm your account, to let you reset your password, and, if you turn it on, to tell you that you have unread messages.
- A salted hash of your password. We cannot see the password itself.
- The list of devices signed into your account (name, last-seen time and IP address), so you can review and remove them.
Your conversations
- Messages and files are encrypted on your device before they are sent. The server stores the encrypted blobs. We cannot decrypt them, and we do not hold the keys.
- Room membership, invitations and timestamps: who is in which room, who invited whom, and when each message was sent. Encryption does not hide this, and the server needs it to deliver messages.
Invites
- Who created an invite, when, whether it was a link or an email, which email address it was sent to, and when it was used. This is how we keep Backwire invite-only and stop abuse.
Server logs
- IP addresses and request details in the server logs, kept for up to 14 days for security and troubleshooting, then deleted.
Email we send
Backwire sends email from noreply@backwire.chat only for these reasons: verifying your email address, resetting your password, delivering an invite someone sent you, a short welcome after you join, and, only if you keep it switched on, a notice that you have unread messages. Unread notices never contain the message itself, because the server cannot read it. We send nothing else: no newsletters, no marketing.
What we never do
- No advertising, in the app or anywhere else.
- No selling, renting or sharing of your data with anyone.
- No analytics, no behavioural tracking, no third-party trackers.
- The server never fetches link previews on your behalf.
- The chat app at app.backwire.chat loads nothing from third parties. This marketing site loads one outside script: the TruGen Labs "Report an issue" widget, which sends a report only when you choose to submit one.
Backups
We take a backup of the server every night so that a hardware failure does not lose your account. Backups are encrypted at rest and contain the same data as the live server: your encrypted conversations stay encrypted in the backup too. Old backups are rotated out after two weeks.
Deleting your account
You can deactivate your account yourself from the app settings, or ask us at the address below. Deactivation removes your profile, signs out every device and stops all delivery to that account. Messages you already sent remain, encrypted, in the rooms you sent them to, in the same way that a message you send to someone stays with them. Your email address is removed from the account.
Your recovery key
Your recovery key is generated on your device and never sent to us. If you lose it and every signed-in device, your encrypted history cannot be recovered by anyone, including us. We mention this here because it is the one thing about your data we genuinely cannot help with.
Changes
If this policy changes in a way that matters, we will say so in the app and update the effective date above.
Contact
Questions about privacy: privacy@backwire.chat. Anything else: support@backwire.chat.