Privacy Policy

This Privacy Policy explains what information Fullback ("we", "us"), operated by Jan Michael Intia, an individual sole proprietor based in the Republic of the Philippines, collects when you use our Contentful backup and restore service (the "Service"), and how we use, store, and protect it.

Account information: your email address and a hashed (never plaintext) version of your password.

Connected-space information: the Contentful space and environment IDs you connect, an optional display name you give the space, and your Content Management API token — encrypted with AES-256-GCM before it's stored, and never written to logs in plaintext.

Your Contentful content: entries and content types from the spaces you connect, captured as snapshots, stored as encrypted objects.

Billing information: handled entirely by Stripe. We store a Stripe customer/subscription reference so we know your plan status, but we never see or store your card number.

Usage and log data: standard web server logs (IP address, timestamps, requests made) generated by our hosting and infrastructure providers as part of operating the Service.

To provide the Service: running scheduled backups, computing diffs, performing restores you request, and showing you your own data in the dashboard.

To operate your account: authentication, billing, and enforcing plan limits.

To communicate with you: email verification, password reset, and — if you connect a Slack webhook — backup and deletion alerts you've configured.

To keep the Service secure and working: detecting and responding to failures or abuse.

We do not sell your personal information, and we do not use your Contentful content for any purpose other than providing the Service to you.

We use a small number of infrastructure providers to run the Service, each with access limited to what they need to perform their function:

Neon — hosts our Postgres database (account and snapshot metadata).

Cloudflare R2 — stores encrypted snapshot content.

Fly.io — hosts our application servers.

Stripe — processes payments and manages subscriptions.

Resend — sends transactional email (verification, password reset).

Google Analytics — aggregate visit analytics on this marketing site (fullback.app) only, not the dashboard. See Cookies below.

These providers process data on our behalf under their own security and confidentiality commitments. We don't share your data with anyone beyond this list except where required by law.

Your Contentful API token is encrypted at rest (AES-256-GCM) with a key kept outside the database. Data in transit is encrypted with TLS. See our Security page for more detail on how we handle your token and content.

Snapshots are retained according to your plan's retention window (currently 3, 7, or 60 days, shown on your dashboard) and deleted automatically afterward — they are not archived elsewhere. If you disconnect a space or close your account, we delete the associated snapshots and connection details within a reasonable period, except where we're required to retain limited records (such as billing history) for legal or accounting purposes.

Our infrastructure providers operate globally, and your data may be processed and stored outside the Philippines and outside your own country, including in the United States. By using the Service, you understand your data may be transferred to and processed in these locations.

Depending on where you're located, you may have rights to access, correct, or request deletion of your personal information, or to object to certain processing. You can access and correct most of your account information directly in the dashboard; for anything else, or to request account deletion, email us and we'll act on your request within a reasonable time.

If you're in the Philippines, these rights are consistent with the Data Privacy Act of 2012. If you're located elsewhere, local law may give you additional or different rights — contact us and we'll do our best to accommodate a reasonable request regardless of jurisdiction.

The dashboard (app.fullback.app) uses a single essential session cookie to keep you signed in — no advertising or analytics cookies there.

This marketing site (fullback.app) uses Google Analytics to understand aggregate traffic (pages viewed, general location, referral source) — it sets analytics cookies for that purpose. We don't use advertising cookies or cross-site ad tracking on either site.

The Service is intended for business and professional use and isn't directed at children. We don't knowingly collect personal information from anyone under 18.

We may update this policy from time to time. If we make a material change, we'll make reasonable efforts to notify existing customers before it takes effect. Continuing to use the Service afterward means you accept the updated policy.

Questions about this policy, or a request about your data? Email us at janmichaelintia@gmail.com.