Privacy policy

Last updated 29 August 2026

Backlit keeps the games you mean to play. To do that across more than one device it has to store your library on a server. This page says exactly what is stored, who else ever sees any of it, and how to take it all back.

Who to write to

Backlit is made by Colin Hwang. For anything on this page, including a request to see or delete what is held about you, write to colin@nomorro.com.

What is stored about you

Your account

• An email address. It is your sign-in name, and it is verified once so a password can be reset. If you sign in with Apple and choose to hide your address, Apple hands over a relay address and that is the one held.
• An account identifier that Backlit made for you, and the identifier your sign-in provider uses for you. For Sign in with Apple and for Google that is the provider's own opaque subject, not your name.
• Which sign-in methods are attached to the account: email and password, Apple, Google, and a Steam account if you connected one.
• The date the account was made.

No name is asked for and none is stored at sign-in. If you fill in a display name later it is part of your profile, below.

Your devices

• An identifier the app generated for the device itself on first launch. It is a random value kept in the device keychain. It is not your advertising identifier, not your device serial, and not anything Apple or anyone else can match to you.
• The platform and the app version, so a device on an older build can be told what changed.
• When the device last checked in, and where it had got to in your library's history, so the next check-in only fetches what is new.

Your library

This is most of what is stored, and all of it is what you put there:

• Every game you save, with its title, cover, release date, platforms, genres and the rest of the catalog detail, plus where you have put it: Someday, Library, Up next, playing, ongoing, hibernating, finished, put down or on your wishlist.
• Your runs at a game: when you started, when you finished, how far through you are, and which measure you are counting against.
• Play sessions you timed or logged, with their start, end and duration.
• Achievement counts for a game, if you connected Steam.
• Ratings and reviews you write, and whether you marked a review public.
• Your journal: the record of a game being saved, picked up, put down and finished, with the reason if you gave one.
• Tags, lists, smart list rules, grids and artwork you replaced yourself.
• A launcher link, where you set one, so a game opens in the app or store you play it from.
• A note of each import you ran and where it came from.
• Your settings, as a small bag of switches.

Your profile, if you make one

• A handle, a display name and a short bio.
• An avatar and a header image, if you upload them.
• Who can see the profile - anyone, only people you approve, or no one - and who you follow and who follows you.
• Who you have blocked. Blocking is stored so it can be enforced on both sides.

Images you upload

Four things can be uploaded: an avatar, a profile header, a replacement cover and a replacement background. Nothing else in the app reads your photo library, and the app never asks for permission to read it. It asks only for permission to save a card you made back to your photos.

The bytes go straight from your phone to Backlit's own storage and are served back through Backlit's own delivery network. They are never sent to an image host, a vision service or any other company, because there is no vendor cleared to hold a person's photographs. An upload is capped at 5MB and must be a JPEG, PNG or HEIC.

If you buy Backlit Plus

• Which product you bought, whether it is active, and when it renews or lapses.
• The customer identifier the payments provider uses for you, which is set to your Backlit account identifier and nothing else.

Backlit never sees or stores your card, your Apple ID or your payment details. Apple takes the payment.

Moderation

If you report something, the report is stored with what you reported, the reason you picked, and your account identifier, so the same report is not acted on twice. One copy is emailed to the person who moderates, which is Colin.

What stays on your phone

• Reading text out of a screenshot. This runs entirely on the device, using Apple's own Vision framework. The image is never uploaded, and no image ever reaches a server for this.
• Release-date reminders. They are scheduled locally against a date already on the row. There is no push server, and no notification token is sent anywhere.
• Your backup file. Backing up your library writes a file into your hands. It goes wherever you send it and nowhere else.

Who else ever sees anything

Backlit talks to five outside services, and only two of them ever receive anything about a person.

• IGDB, through Twitch. Where the game catalog comes from. A search sends the words you typed, or a game's numeric id. It never sends your account, your email or your device identifier.
• Valve, for a Steam import. If you connect Steam, your Steam ID goes to Valve so your public library can be read back. That is the whole point of the import, and it is the only reason it happens. Your Steam library is read, matched and stored under your Backlit account; nothing about your Backlit account travels the other way.
• TikTok. If you share a TikTok link into Backlit, the app asks TikTok for that video's public caption so the game can be identified. Only the link you shared is sent. Nothing about you goes with it, and the reply is not kept.
• Apple and Google, for sign-in. Standard federated sign-in. They tell Backlit who you are; Backlit tells them nothing about your library. If you delete your account and had used Sign in with Apple, Backlit calls Apple once to revoke the token it was given.
• RevenueCat, for subscriptions. It is told your Backlit account identifier so a purchase can be attached to the right account. It is not told your email or anything in your library.

The servers, the database and the storage are Amazon Web Services, in the United States. Sign-in and the verification email are AWS too. AWS runs the machines; it is not given anything to use for its own purposes.

What Backlit does not do

• There is no analytics SDK, no crash reporter and no telemetry in the app. Not a reduced one, not an anonymous one. There is none.
• There is no advertising, no ad network and no ad identifier. The App Tracking Transparency prompt does not appear because there is nothing to ask you about.
• Nothing is sold or shared for anyone else's marketing, ever.
• Nothing here is used to build a profile of you for any purpose other than showing you your own library.
• There is no marketing email. The only mail Backlit sends you is about your account: verifying an address, resetting a password.

What other people can see

Your library is private. No game you save, no rating, no play session and no journal entry is visible to anybody else unless you deliberately make it so. A review is private until you mark it public.

A profile is public unless you say otherwise. That is the one thing here that starts open rather than closed. On the Account screen you can set it to anyone, to only the people you approve, or to no one. What a visible profile shows is your handle, display name, bio, avatar and header - never your library, unless you shared something out of it.

Narrowing who can see you does not remove your followers. If people already follow you and you move the profile to approved-only or to no one, they stop being able to see it and they stay on your followers list. Nothing is deleted, and you can open the profile back up later to the same people. Removing a follower is a separate act.

The things you can choose to make visible:

• Marking a review public attaches it to that game for anyone looking at it, under your handle.
• Sharing a list gives the people you name the access you gave them, and nothing more.
• A public review also counts towards that game's average score. The average is a number; it names nobody.

Any of these can be turned back off.

How long it is kept, and how to end it

Deleting your account is in the app, under Settings, and it is immediate. There is no waiting period and nothing to talk anybody out of. When you run it, Backlit revokes the Apple token if there is one, deletes every image you uploaded from storage, deletes your account row, which takes every row belonging to it, and then deletes your sign-in from the identity service.

What survives is one thing, and only in one case: if somebody had reported something of yours and the report has not been dealt with, that report stays in the queue with your content removed from it. Nothing in it identifies you.

Everything else is kept for as long as your account exists, because it is your library and losing it is the worst thing this kind of app can do to you. Back up your library first if you want a copy. That row is always available, it does not need a subscription, and the file is yours.

Your rights

You can see what is held about you, correct it, take a copy of it and delete it. Most of that is already in the app: your library is on the screen, editable there, saveable as a backup file, and deletable along with your account. If you would rather ask a person, write to colin@nomorro.com and you will get an answer.

Children

Backlit is not built for children and is not directed at them. No age is asked for and nothing is knowingly collected from a child under 13. If you believe a child has made an account, write to colin@nomorro.com and it will be removed.

Changes to this page

This page lives on a server rather than inside the app, so a correction can land the day it is needed instead of waiting for a release. The date at the top says when it last changed. A change that affects what is stored or who sees it will be said plainly in the app as well.