Privacy Policy

Drafted 2026-09-20. Effective date: 22 September 2026.

The short version

Backstop, the browser extension, stores everything it saves in chrome.storage.local — a storage area private to your browser profile, on your own machine. It does not transmit your sessions anywhere. There is no Backstop server for session data to go to. We — the people who make Backstop — cannot see your saved tabs, your window layouts, or your browsing activity, because the extension never sends them to us or to anyone else. There is no analytics library, no crash reporter, no telemetry, and no tracking of any kind built into the extension.

What the extension can access, and why

Backstop's Chrome permissions and what each one is used for:

• tabs — to read the URLs, titles, and window/tab structure of your currently open tabs when you save a session, and to reopen them when you restore one.
• storage and unlimitedStorage — to write and read snapshots in chrome.storage.local, and to allow more history to be kept than Chrome's default storage quota would otherwise permit.
• alarms — to schedule automatic snapshots on a timer.

Backstop does not request permission to read the content of the pages you visit, and has no host_permissions for any site. It cannot see what's inside your tabs — only the tab and window metadata (URL, title, grouping) needed to save and restore a session.

Where your data goes: nowhere

The extension makes no network requests with your session data. There is no first-party server it reports to, and no third-party analytics or advertising SDK bundled into it. If you never buy a Pro licence, nothing about your use of Backstop ever leaves your machine, at all.

Encrypted export

Pro's encrypted export runs entirely inside the extension, in your browser: it derives an AES-256-GCM key from a passphrase you choose using PBKDF2-SHA256, and writes the result to a file you save yourself. Your passphrase is never transmitted, never stored by us, and never recoverable by us — if you lose it, the export cannot be decrypted by anyone, including us.

When you uninstall, or reset your profile

Chrome deletes an extension's local storage when the extension is uninstalled, or when a browser profile is reset or removed — this is standard Chrome behavior, not something Backstop controls or can prevent. If you want a copy of your sessions that survives that, export them (plain or encrypted) to a file before uninstalling.

Buying a Pro licence

Pro licences are sold through Paddle.com, Inc., who act as the Merchant of Record for the transaction. That means Paddle, not us, collects and processes your payment details (card or other payment method, billing address, and the email address you check out with), bills you, handles applicable tax, and is the data controller for that checkout. Paddle's own privacy policy governs that data; see Paddle's privacy policy.

From Paddle, we receive only what's needed to issue your licence: your email address and an order identifier. Your licence key is a small, cryptographically signed piece of data that the extension verifies entirely offline, using public-key signature verification built into the browser. Activating it makes no network call of any kind — we do not learn when, how often, or on how many machines a licence is activated.

This website

This site (the page you're reading now) is a static site with no build step, hosted on Cloudflare. We do not add any analytics, advertising, or tracking script to it ourselves — no cookies are set by this site's own code. As with any web host, Cloudflare's edge network processes standard connection information (such as your IP address and request metadata) to serve the page at all; that is Cloudflare's infrastructure logging, governed by Cloudflare's privacy policy, not something we configure or receive a copy of.

Children's privacy

Backstop is a general-purpose developer/productivity tool not directed at children, and we do not knowingly collect personal information from children.

Changes to this policy

If this policy changes, we'll update the "drafted" date at the top of this page and, for any change that meaningfully reduces your privacy, call it out in the extension's release notes.

Contact

Backstop and this website are operated by Small Hours, which is the data controller for the (very little) data described above. For privacy questions or data requests, email hello@smallhours.works. Contact is by email; there is no postal correspondence address for this service.

Pro purchases are processed by Paddle as Merchant of Record. Paddle is the seller of record for the payment itself, and Paddle's own privacy policy and contact details apply to it.

This policy is governed by the laws of the Commonwealth of Massachusetts, United States, consistent with the Terms of Service. If you are in the EU, UK or another jurisdiction with its own data-protection law, the rights that law gives you apply in addition; given that Backstop transmits nothing, there is little for them to act on, but they are yours regardless.