Privacy

What Backdraft collects

Nothing. The CLI and the agent skills run entirely on your machine. There is no telemetry, no analytics, no usage reporting, no crash reporting, and no account. We do not see your documents, your queries, or the fact that you use Backdraft at all.

Everything Backdraft produces stays where you put it: the registry and its snapshots live in a .backdraft/ directory inside your project folder, and the rendered artifact is a single self-contained HTML file that works with no network connection.

When data leaves your machine

Only when you configure it, and only to a provider you chose. If you set BACKDRAFT_VLM_API_KEY, page images or document images are sent to that vision-model provider during ingest; if you set BACKDRAFT_ENTAIL_API_KEY, claim and evidence text is sent to that provider during the optional entailment check. Without those keys, nothing is ever transmitted anywhere.

Backdraft deliberately never reads ambient provider keys such as OPENAI_API_KEY: a key in your environment is not consent to send your documents to its provider. Consent is a BACKDRAFT_-scoped setting you write yourself.

Data sent to a provider you configure is governed by that provider's privacy policy, not this one.

This website

backdraft.dev is a static site. It sets no cookies and runs no analytics. Standard web server logs may record requests, as with any website.

Changes and contact

If this policy changes, the change lands in the public repository with its full history. Questions: open an issue there.

Last updated: July 29, 2026.