Privacy

What Backstamp keeps

Your account

• Your email address, if you signed up with email, or if you signed in with Apple and let Apple share your real address. If you use Apple's "Hide My Email", Backstamp does not keep Apple's relay address.
• A username. Unless you picked one, Backstamp makes one up, like member-k7m2x9qa. It says nothing about you.
• A display name, if you set one (up to 40 characters). If you join with Apple and Apple sends your name, Backstamp uses it as your display name. Other members see your display name, or your @username if you have none.
• If you use Sign in with Apple, Apple's own ID number for you. Backstamp uses it only to find your account when you sign in. It is never sent to a phone.
• When you joined; whether you are a member, council or admin; whether you are suspended, and until when; when you agreed to the house rules; how many of your posts to the whole community were approved; your notification and privacy choices; and a running count that numbers your pieces (#0042).
• The invite code you joined with, and which member made it.

How you sign in

There is no password. You sign in with a link or a six-character code that Backstamp emails to you, or with Sign in with Apple. Either way you get a sign-in that lasts 30 days or until you sign out. The server keeps a record of it. Your phone keeps it in the iPhone's secure store (the Keychain).

When you ask for a sign-in email, Backstamp keeps your address, a one-time token for the link, and a scrambled form of the six-character code (not the code itself). The link and the code both stop working after 15 minutes.

What you add

• Pieces: name, kind, franchise, rarity, where it is from, edition numbers, tags, whether it is trade stock, its condition, what you paid and when you bought it, the values you log (with the note you add), where it came from, the names of earlier owners that you type, proofs (receipts, certificates, photos), signatures, and photos.
• Your wishlist: each want, how badly you want it, the least condition you would take, the "tell me when" switches, and your price ceiling.
• Sets you make.
• People: the contacts you add and the tier you gave each one, and how and where you met; people you block; trades (who, the pieces by name and kind, where, notes, each step); vouches (chips and a note); and code swaps (who scanned whose code, when, and at which con).
• Cons: the cons you mark as going, check in to and check out of; how you proved you were there; who may see it; the badge type and days, if you give them; and edits you suggest to the con directory.
• Posts, with their captions, photos and pieces; comments; likes; and the posts you save.
• Reports you file about a person, a post or a comment.
• Invites you make: the code, when you made it and, if you had it emailed, a scrambled form of the address (not the address).
• If you use "Bring my list over": the BlizzardItems profile name you typed, how many items came across, and the pieces and wants it made.

What Backstamp records as you go

• The "Since you last looked" rows on your home screen. Some can name a price or a ceiling of yours. Only you see those.
• Problem reports. If a screen in the app breaks, the app sends a report by itself. It holds the error message, the technical trace, what was on screen, the app version, the phone's system (ios or android), the time, and your account number if you are signed in. There is no setting for this in the app.
• A count of what you did in the last day (posts, comments, likes, reports), for the daily limits.
• Your phone's alert address (see Alerts).

What Backstamp does not keep

• Your phone's contacts (see Your phone's contacts).
• Where you are (see Location).
• The barcode on a convention ticket.
• Your internet address, in its database. The server uses it for a few minutes, in memory only, to limit how often one connection can ask for sign-in emails.

What other members can see

You choose how much each contact sees by giving them a tier: Close, Trusted or Met once. Nobody is told which tier they are in.

• Every member can see your username, your name (your display name, or @username if you have none) and how many vouches you have. A member list shows every member's username. Nobody sees your email address.
• Met once contacts also see your lanyard card: up to four of your trade-stock pieces, up to four of your open wants, and how many trades you have finished.
• Trusted contacts see all your trade stock and all your open wants.
• Close contacts can also be sent your whole collection.

A piece. Others see its name, kind, franchise, where it is from, edition numbers, whether it is trade stock, whether it is Verified, whether its code is used, its BlizzardItems number, and one photo (the front shot, or your earliest). They never see what you paid, what it is worth to you, when you bought it, your tags or your piece number. They never see your proof photos or paperwork.

A want. Others see its name, kind, franchise, where it is from, whether it is a grail or a filler, the least condition you would take, and the variant you described. They never see the ceiling.

Posts. You choose who each post is for: Close only; Close and Trusted; everyone you know; or everyone in Backstamp (every member). If no choice is sent, the post goes to everyone you know. A post shows your name, your words, your photos and the pieces you attach (name, kind and one photo; never what you paid or what it is worth to you). If you are checked in at a con, the post carries an "At" mark with the con's name, unless your check-in is set to Only me. Anyone who can see a post can see its comments and who liked it (name and time). Posts you save are private: nobody is told, and no count is kept.

Check-ins. You choose who sees that you are at a con: Contacts, Everyone here or Only me. It starts on Contacts.

• Only me: nobody.
• Close contacts are told that you are at a con, and which one, wherever they are.
• Trusted and Met once contacts are told only while they are checked in at the same con.
• If you choose Everyone here, anyone else checked in at that con also sees that you are there.

Your contacts also see that you are going to a con, unless you chose Only me. What they see is your name, whether you are going or here, a small mark for how you proved it, and the day you arrive. Never a time, a place or a badge photo, and never what you paid or what a piece is worth to you.

Trades and vouches. A trade is seen only by the two people in it. A vouch is seen by those two, and by anyone whom both of them have added as a contact.

Your code. The code you show for a swap carries your display name and a one-time key, and nothing else. It works once.

Reports. If someone reports you, you are not told who.

Blocks. A block hides the two of you from each other everywhere. The person you block is not told.

Wishlist alerts. If a contact puts a piece you want on trade, or someone at your con has one, you are told. The alert never says who has it, and the person who has it is not told who wants it.

Catalog prices. The catalog shows the prices that BlizzardItems publishes ("eBay Avg Price" and "Our Estimated Price"). Every member sees those. On a piece of yours, only you see the catalog's price.

What you type. Captions, comments, trade notes and vouch notes are shown as you wrote them to whoever can see them. Backstamp does not look inside them for prices or personal details. The house rules ask you to leave both out.

Photos

• Photos are kept in a storage bucket at Railway, not in the database. The database holds only each file's random name.
• Before a photo is stored, the server saves it again from its pixels alone. That removes the location (GPS), the camera details and any other hidden data that was inside the file. This applies to photos of pieces and proofs, post photos and badge photos.
• A photo of a piece is stored once, at full size. A photo on a post is stored as two smaller JPEG copies (longest side 800 and 1600 pixels), and the original is not kept. When a post shows one of your pieces, a small copy of that piece's photo is made and kept for the feed.
• A photo is opened with a long address that includes a signature. It works for 6 hours, for anyone who has the address, and needs no sign-in. The app gives the address only to people who are allowed to see that photo: you, and members who can see the piece or the post. The server then sends the phone on to a link at the bucket that works for 5 minutes.
• Proof photos (a receipt, an order confirmation, a certificate) and paperwork are never sent to other members.
• Reviewers are the exception. Adding a proof to a piece puts the piece in the reviewers' list at once. A council member or admin who reviews it sees the piece, your name, all its photos and the proofs. A receipt can show what you paid. See Moderation.
• A photo of your convention badge, if you add one, is kept for you alone. Only you are given a link to it.
• The app asks to use the camera (to photograph pieces and badges, and to scan another collector's code) and your photo library (only for the photos you choose). It does not use the microphone.
• Deleting a photo or a piece removes the files too. Deleting your account does the same.

Location

Backstamp reads where you are in one place only.

"I'm here" check-in. When you tap "I'm here" at a con, the app asks the iPhone where you are. The iPhone asks your permission, for while you are using the app. The app sends the position to the server, which compares it with the venue and then throws it away. The server keeps that you checked in, when, and that the proof was "location". It keeps no coordinates. The phone does not keep the position either.

Arrival offer. This is off until you turn on "Offer check-in when I arrive" in Settings. Then the iPhone asks to use your location all the time, and to send notifications. After that, the iPhone itself watches for you reaching the venue of a con you marked as going, on the con's days. When you arrive, the app is told only that you have arrived at that place. It does not read your position, and nothing is sent to the server. The app then shows a notification on your phone that offers to check you in. The phone keeps a short list of the venues it is watching (with each con's name and dates) and which con days it has already offered. It does not keep where you are.

Suggesting a con. When you suggest a con, the venue name you typed is looked up by the iPhone's own place lookup (Apple's, on an iPhone). Your own position is not used for this.

If you turn location off in the iPhone's Settings, "I'm here" and the arrival offer stop working. Checking in without location still works.

Your phone's contacts

Backstamp does not read the contacts on your phone. The app has no permission to, and no code to.

When you invite someone, you type their email address or their phone number yourself.

• An email address goes to the server, which emails the invite through Resend. Backstamp keeps only a scrambled form of the address, to count how many invites one address has had. It does not keep the address.
• A phone number does not go to Backstamp. The app makes an invite code, then opens your Messages app with the number you typed and the invite already written in. You send it.

When you search for someone by email, you type a whole address and it goes to the server. It finds a person only if they turned on "Let contacts find me by email", which is off unless they turn it on. It shows their name, never their address.

Alerts

If you allow notifications, the app gives the server an alert address for your phone. It is a token from Expo's push service, with the phone's system (ios or android) and when it was first and last seen. It belongs to your sign-in: signing out, deleting your account or letting the sign-in run out stops alerts to that phone. Backstamp keeps up to 10 phones for one account.

An alert has a short title for its kind (for example Trade, Vouch, Reply, Wishlist, Contact arrived), one line of text (the same line you see on your home screen, such as "Kara T. wants to swap"), and a few reference numbers so that a tap opens the right thing. That line can name another member, one of your pieces or a con, and it can show on your lock screen.

An alert never carries what you paid, what a piece is worth to you, your ceiling, the note on a vouch or a reviewer's note. If a line looks like it names an amount, a plain "Open Backstamp to see it" is sent instead. Likes are never sent as alerts. A warning from Backstamp's reviewers, and council's decisions about your posts and comments, are always sent. The rest follow your switches: Trades, Vouches, Replies to my posts, Wishlist alerts and Contacts arriving. An alert that is not delivered within a day is dropped.

Alerts go through Expo's push service (see the next section).

Who else handles your information

• Me. I run the server, so I can open the database and read everything in it, including values, what you paid and email addresses. Before a change to the live database I copy its tables to my own computer. Those copies hold members' real data and are kept out of the code repository. They do not include photos.
• Railway hosts the server, the database and the photo storage. It handles everything you put into Backstamp.
• Resend sends Backstamp's emails. It receives the address each email goes to, the sender, the subject and the text. A sign-in email holds the link and the six-character code. An invite email holds the invite code and the name of the member who invited you (their display name, or @username).
• Apple. Sign in with Apple is Apple's own sheet. The phone sends Backstamp's server a token that Apple has signed, saying who you are. The server downloads Apple's public signing keys to check it, and sends Apple nothing about you. The iPhone's place lookup (when you suggest a con) is Apple's too. Alerts to an iPhone are delivered by Apple's notification service, through Expo.
• Expo. Expo's push service receives each alert: your phone's alert address, the title and line, and the reference numbers. Expo's update service delivers changes to the app: the app asks it for updates, so Expo sees that request, including the app's version details and the connection's internet address.
• BlizzardItems (blizzarditems.com) supplies the catalog. The server copies its public catalog once a day and asks for nothing about members. When you use "Bring my list over", the server asks the site for the public pages of the profile name you typed, so that name is in the address it asks for. The site sees the server, not your phone. Your phone never contacts BlizzardItems. When you tap a con's website link, your phone opens that site itself.
• Neon, a database service, held Backstamp's database before the move to Railway. It still holds a copy from that day, which is now used for testing.
• Nobody else. There are no analytics, advertising or tracking tools in the app or on the server, and nothing in the code sends your information to advertisers or data brokers. I do not sell it.

How long things are kept

• Most of what you add stays until you delete it or delete your account. Deleting a piece, photo, post or comment removes it, and for a piece or a post its files too.
• Sign-in emails: the record (address, token, scrambled code) is deleted about a day after the email stops working, and when you delete your account.
• Sign-ins end when you sign out or delete your account. One that simply runs out leaves its record in the database; nothing sweeps those yet.
• Lists brought over from BlizzardItems can be undone for 24 hours. The profile name you typed is blanked after 90 days. The counts stay.
• A photo uploaded for a post but never put on one is deleted after 24 hours. The daily-limit counts are deleted after two days.
• Problem reports are deleted after 30 days, and only the newest 5,000 are kept.
• Swap codes that nobody used are deleted when they run out. Used ones stay.
• A Met once contact ends when the con you met at ends (or after a week, if you were not at a con) unless you keep them. An ended contact is treated as no contact. The record is not deleted.
• A post that council declines stays, with the reason, until you delete it. A post that council removes loses its photos, pieces, likes and comments. The post's row, with your words, stays as council's record until your account is deleted.
• A report stays after the post or comment it was about is deleted.

When you delete your account

1. Every phone is signed out at once and stops getting alerts. Other members stop seeing you in lists and searches.
2. For 7 days nothing is removed. If you sign in again in that time, the request is cancelled and everything is back.
3. After 7 days (a job checks every hour) Backstamp removes: your collection, with its photos (the files too), values and proofs; your wishlist and sets; your posts, comments, likes, saves and post photos; your con attendance, check-ins and badge photos; the con edits you suggested; your contacts and blocks; your swap codes; the rows about you on other people's home screens; your import records; your problem reports; your sign-in emails; and your sign-ins and alert addresses. The note on any vouch you gave is removed.
4. What stays, so that other people's history still makes sense: trades you were in (finished or not), with the names and kinds of the pieces on them and any notes; vouches (the chips, not your note); reports you filed or that name you, with what was written in them; the record of code scans between you and another member; the invites you used and made; and the record of any role changes. These point to an emptied account row. It holds no name, no email and no Apple ID, only a made-up username, your initials (for example KT), and a few dates and counters. Other members see it as a deleted account.

Copies. The copies of the database that I make before a change stay on my computer until I delete them, and nothing deletes them automatically. Deleting your account does not change a copy that was already made. The same goes for the older copy at Neon and the photo files left on my computer from before the move to Railway.

On your phone. The app keeps copies of your lists (your wall, wishlist, feed, contacts and lanyard card), and anything you saved with no signal, in the app's own folder, so that it works without a signal. If you use iPhone backup, that folder is part of the backup. Signing out removes the copies of the lists. Things not yet sent stay on the phone until they are sent.

What you can do

• Change your display name in Settings, Profile.
• Choose who sees you at cons, and whether people can find you by email, in Settings, Privacy.
• Switch alerts on and off in Settings, Notifications. Allow or refuse notifications, the camera, the photo library and location in the iPhone's own Settings.
• Block someone from their page (More). Your blocked list is in Settings, Privacy, Blocked, where you can unblock.
• Report a person, a post or a comment. Reporting a person also blocks them. Reporting a post or a comment does not, unless you choose to.
• Export your collection as one ZIP: collection.csv, provenance.csv, value-history.csv, a README and every photo. It includes what you paid and your values, so keep it to yourself. It covers your collection only, not your wishlist, posts, comments, contacts, trades or vouches.
• Delete a piece, a photo, a post or a comment.
• Sign out in Settings. Deleting the app does not sign you out, because the iPhone can keep the sign-in after the app is gone, so sign out first.
• Delete your account in Settings, Delete account, by typing DELETE. Export first if you want a copy.
• Ask me about anything on this page at hello@backstamp.quest.
• Not possible yet: changing your email address, and removing a contact (you can lower their tier or block them).

Moderation

Backstamp has a council: members an admin has chosen to help look after the community. Admins are named in a setting on the server. That setting names me.

Council members and admins can add and edit cons and accept or decline the edits members suggest, decide Verified requests, deal with reports, and review held and reported posts. Admins can also find members by name, handle or whole email address, and make a member council or a member again.

What they can see when they review:

• A report: who filed it and who it is about (by name), the reason and details, and the words of the post or comment it names. They never see a report they filed, one about them, or one on something they reported or wrote.
• A held post: the post as a reader would see it, with its author, words, photos and pieces. A new member's first three posts to everyone in Backstamp are held until council approves them, and at most three wait at once. Council approves, or declines with a reason that the author is shown. Posts to smaller audiences, and posts by council or admins, are not held.
• A reported post or comment: when three different members report one, it is hidden until council restores it or removes it. A removal names the house rule it broke, and can warn or suspend the author in the same step.
• A piece sent for Verified: the piece, the owner's name, all its photos (proofs included) and the proofs.

Council and admins do not see what you paid, what a piece is worth to you, your ceiling or a purchase date. Their lists carry no email addresses.

A person who is reported is never told who reported them. A warning or suspension shows only what the reviewer wrote. Council and admins can also delete a post or comment, but not one that is held or reported.

Backstamp keeps who acted on a report, when, and their note. It also keeps who changed whose role, from what, to what, and when.

The house rules, shown before your first post to everyone:

1. Post your own photos and your own pieces.
2. Be decent. Nothing hateful, sexual or harassing.
3. No prices, no shop links, no sales pitches.
4. Leave other people's names, faces and details out unless they said yes.
5. Council can hide a post, warn you, or suspend you. If three members report a post it is hidden until council looks.

Children

You must be 16 or older to join Backstamp. Backstamp does not ask for your age or your date of birth, and does not keep either.

Changes to this page

When this page changes, the "Last changed" date at the top changes.

Contact

hello@backstamp.quest

1039 SE Franklin St
Portland, OR 97202