Privacy policy
Effective November 6, 2026
backmesh is built to know as little about you as it can. It runs in your own cloud accounts, so your code, jobs, logs, secrets and cloud credentials stay there. This policy lists the little that reaches us, what we do with it, and your rights. We never sell your data.
“We”, “us” and “our” mean backmesh, the operator of the service. “backmesh”
also names the service itself: the CLI, the listener and runner images,
backmesh.com and api.backmesh.com.
What we collect and why
Section titled “What we collect and why”Telemetry from your install
Section titled “Telemetry from your install”The listener in your install sends one event per job started, so we can count jobs for your plan. Telemetry lists every field, with an example. In short: a hashed job ID, the backmesh version, when the job started, and the cloud, region, VM type, pool, capacity, label, queue and boot times and features of its runner. It never sends repository, workflow, job, branch or commit names, code, logs, secrets, cloud credentials, or anything from the job’s run.
GitHub sign-in
Section titled “GitHub sign-in”You sign in with GitHub in two places, and we keep what each needs:
backmesh installandbackmesh upgradeask forread:org, to check you’re an admin of the org, andread:packages, for your control plane.api.backmesh.compasses that GitHub token through to your machine and keeps none. Uninstall’s admin check asks only forread:org. We store the org’s numeric GitHub ID, an install ID, when the install was created, and a SHA-256 hash of the install’s key, never the key itself.- The billing page asks for
read:organdread:enterprise, to check which orgs and enterprises you admin. A sign-in lasts an hour. We keep your GitHub user ID, login and token with it, and delete them once it has expired, the next time anyone signs in or opens the billing page.
For your orgs and the enterprises you link, we store their numeric GitHub IDs and names, and which subscription each belongs to.
backmesh’s GitHub App
Section titled “backmesh’s GitHub App”Your install gets its GitHub access from backmesh’s GitHub App, installed on
your org. For each org we keep the App installation’s ID, the org’s login and
the permissions the installation grants. Your listener asks api.backmesh.com
for an hour-long installation token about every 30 minutes; we hand it over
and keep none. Each token issued, and each uninstall call, refused or not,
writes one audit row: the install, org and installation, the token’s
permissions and expiry, and the caller’s IP address and Cloudflare ray ID.
Billing
Section titled “Billing”Payments go through Stripe. Your card details go to Stripe and never reach us. From Stripe we keep the customer and subscription IDs, the billing email you gave at checkout, your tier, whether the subscription is paid, and any unpaid balance with its currency. We also record the GitHub user ID and login of the admin who checked out. Stripe keeps its own records, such as invoices and your billing address, under its own privacy policy.
Non-commercial declaration
Section titled “Non-commercial declaration”If an org admin declares an org’s use non-commercial on the billing page, we keep the org’s GitHub ID, the public page they gave that links to backmesh.com, the admin’s GitHub user ID and when they declared it, so we can check the org qualifies.
Cookies
Section titled “Cookies”The billing page sets two cookies, and only while you use it: bm_oauth,
which checks a GitHub sign-in is the one you started (10 minutes), and
bm_session, which keeps you signed in (one hour). backmesh.com stores your
light or dark theme choice in your browser. There are no analytics,
advertising or tracking cookies.
Request logs
Section titled “Request logs”backmesh.com and api.backmesh.com run on Cloudflare, which sees each
request’s IP address to serve, secure and rate-limit it. The API’s logs, which
we use for debugging and security, are kept in Cloudflare for up to 7 days.
When you write to us, we keep the correspondence so we can refer back to it.
How we use it
Section titled “How we use it”- To count jobs against your plan and show the over-cap warning in
backmesh status. Going over a cap never blocks a job. - To bill you, link your orgs, and show your installs on the billing page.
- Per org, to help with your support requests, to see whether your install is running jobs, and to contact you when your org is over its cap.
- For product planning and reliability, as totals across all installs, as Telemetry describes.
- To keep backmesh secure and to answer you when you contact us.
Who we share it with
Section titled “Who we share it with”We use these processors to run backmesh:
| Processor | What for |
|---|---|
| Stripe | Checkout, subscriptions, invoices, the customer portal and taxes |
| Cloudflare | Hosting backmesh.com and api.backmesh.com, and the database behind them |
| GitHub | Sign-in and org membership checks |
Otherwise we share your information only when the law requires it, and we disclose only the minimum needed. If backmesh is acquired or merges with another company, we’ll tell you before your information becomes subject to a different privacy policy.
How long we keep it
Section titled “How long we keep it”| Data | Kept |
|---|---|
| Telemetry events | 90 days, then folded into a count of jobs per day, org and install |
| Daily job counts | Kept, for billing questions |
| Billing-page sign-ins, with their GitHub tokens | Deleted after they expire, at the next sign-in or billing-page visit |
| Install sign-ins’ and App installation tokens | Not kept |
| Orgs chosen at checkout, before payment | Until paid, or a day, deleted at the next sign-in |
| Subscriptions | Until it ends; a cancellation with nothing owed deletes the record and unlinks its orgs |
| Token and uninstall audit rows | 90 days |
| Non-commercial declarations | Until an admin withdraws it on the billing page |
| App installation records | Until the App is uninstalled or GitHub reports it gone |
| Org, enterprise and install records | Kept, so an org’s plan and installs survive renames; ask us to delete them |
| API request logs | Up to 7 days, at Cloudflare |
Stripe keeps payment records for as long as the law requires.
Your rights
Section titled “Your rights”Wherever you are, you can ask us to tell you what we hold about you, give you a copy, correct it, delete it, or stop using it. Deleting billing records may end a subscription, and we may need to keep some records to meet legal obligations. We’ll ask you to sign in with GitHub to confirm the request is yours. You can also complain to your data protection authority.
You can stop telemetry by uninstalling backmesh with backmesh uninstall.
Security
Section titled “Security”Everything between your install, your browser and backmesh travels over TLS. We store hashes of install keys, not the keys. See the security model for how backmesh works inside your accounts.
Changes and questions
Section titled “Changes and questions”We may update this policy. When we make a significant change, we’ll update the date at the top and tell subscribers by email. Questions or requests: support@backmesh.com.
Adapted from the Basecamp open-source policies / CC BY 4.0.