Privacy policy
Backstop is an independent app built on the Buffer API for the Buffer Commit contest. Last updated 10 November 2026.
What we store
- Your Buffer account id and email address, so we know whose workspace you are in.
- The access and refresh tokens Buffer gives us when you connect. They are encrypted before they are stored and are used only to read your channels and to publish posts you have approved.
- The post drafts, rules, approval decisions and activity log you create in Backstop. Each post's activity log holds only fingerprints (hashes), never the post text, and can be opened by anyone who has its private receipt link.
- The private review link you send to a client, stored encrypted so you can open it again from your dashboard while the post is waiting. It is erased the moment the post is approved, changed, replaced or withdrawn, and the same link is also kept as a one-way hash so Backstop can recognise it.
What we do not do
- We do not sell or share your data, and we do not use it to train models.
- We ask Buffer for the smallest set of permissions we need: account information, reading posts, and creating posts.
- People who review a post through a private link do not need an account, and we do not ask them for personal details.
Third parties
Buffer receives the posts you publish through it. When a draft is generated with an AI model, the draft request is sent to that model provider. Your Buffer tokens are never sent to it.
Your control
You can disconnect Buffer at any time, which deletes the stored tokens. You can also revoke Backstop in your Buffer settings. Disconnecting does not erase the records of posts already made, which hold only hashes and identifiers.