Backstage Lite — Privacy Policy

Last updated: 2026-06-17 · Operator: SlowArcs, LLC

This policy explains what data the Backstage Lite Chrome extension and its related services collect, how that data is handled and used, where it is stored, and who it is shared with. The extension bundles three areas of functionality: live capture (recording sales during your Whatnot shows), listing prep (building item listings and exports before a show), and consignor tools (sharing sales with consignors you've paired with). This policy covers all three, plus the access-code request form at backstagelive.app/lite and the optional cloud features the extension connects to. It works alongside the suite-wide Backstage Live Privacy Policy and Terms of Service.

The short version: Backstage Lite is local-first. Sales it captures during your shows and listings you build in prep are stored on your own device. Some features send specific data off-device: when you sign in and use cloud features (the live shipper/binner board, cross-device sync, consignor sharing, or label printing), captured sales and screenshots go to our servers (Supabase and Backblaze B2); and item photos you add in listing prep are uploaded to our Backblaze B2 image storage so listings and reverse-image search can use them. We never sell your data, never run ads, and never use it to train AI models. This policy spells out exactly what is sent, when, and to whom.

1. What we collect

1a. Information you provide

• Whatnot handle and email address — submitted through the access-code request form so we can email you an activation code and download link.
• Show vertical (optional) — the kind of shows you run (vintage, cards, etc.), used to understand our beta cohort.
• Account credentials — when you redeem your code for a Backstage account, your email and a securely hashed password are handled by Supabase Auth so the extension can sign you in across devices.
• Anything you email us — your email address and the contents of your message.

1b. Information the extension captures from your live shows

While running on a Whatnot live show, the extension reads events that are already publicly visible on the stream and records, for each one:

• The buyer's public Whatnot @handle and, when shown, their public display name
• Item title, lot number, and sale price as Whatnot displays them
• Sale timestamp, payment status, bin/box assignment, and repeat-buyer / first-purchase flags
• Tip events parsed from chat (buyer + amount) and raid events (raiding streamer + viewer count)
• A thumbnail screenshot of the stream at the moment a sale fires

The extension does not capture chat messages, viewer lists, private buyer contact details, or anything that would not already be visible to any viewer of the show.

1c. Device and usage information

• A randomly generated device identifier (UUID), your activation code, and the last code-validation timestamp
• Buyer history accumulated across your shows (so the "repeat buyer" badge works)
• Your extension settings (popup duration, label size, board options, etc.)
• A lightweight, self-throttled usage heartbeat (sent only when signed in) telling us the extension is in active use — it does not include your captured sales

1d. Listing prep

When you use the listing-prep area to build items before a show, the extension handles:

• Item details you enter (title, description, category, price, quantity, condition, and similar listing fields)
• Item photos you add — these are uploaded to our Backblaze B2 image storage and given a public image URL so they can be placed in your listing and exported
• An optional reverse-image search that opens Google Lens using the public URL of a photo you choose
• CSV exports you generate from your prepped items

1e. Consignor features (only if you use them)

If you use the consignment tools, the extension also handles the consignor information you enter — consignor name/handle, contract terms, pairing codes, and payout records — so consignors can be linked to sales and paid out.

2. How the data is stored

• On your device (default). Captured sales, tips, raids, screenshots, buyer history, your activation code, device ID, settings, and your in-progress listing-prep items are stored locally in your browser (chrome.storage.local / localStorage, with unlimitedStorage so long shows don't hit quota). This stays on your machine and is removed when you clear it or uninstall the extension.
• In our cloud (when signed in and using cloud features). When you sign in with an access code, captured sale events — including the screenshot for a pending item — are uploaded to our hosted Supabase Postgres database and Backblaze B2 object storage so they can appear on the live shipper/binner board, sync across your devices, and be shared with linked consignors. Your access code, account record, email, handle, and consignor records are also stored in Supabase.
• Listing-prep photos (Backblaze B2). Item photos you add in listing prep are uploaded to a Backblaze B2 image bucket and assigned a public URL, so the image can be embedded in your listing, exported, and used for reverse-image search. Treat these photo URLs as public.
• On your local print helper (optional). If you install the Backstage Live print companion, label data is passed to it locally on your machine over Chrome native messaging to print to your thermal printer. It is not sent to us.

3. How we use the data

• Run the extension's core features: capturing sales, assigning bins, building listings, generating manifest/recap PDFs, and printing labels
• Power the live shipper/binner board and (where enabled) share live sales with the consignors linked to a show
• Validate your access code and sign you into your account across devices
• Email you your activation code and download link, and reply when you contact support
• Understand rough product usage (via the usage heartbeat and beta-cohort fields)
• Keep the service secure and prevent abuse

We do not sell your data, share it with advertisers or data brokers, serve ads, or use your captured data to train AI/ML models.

4. Who we share data with

We use a small set of service providers, who only receive what they need to perform their function and are obligated to keep it confidential:

• Supabase — hosted Postgres database and authentication. Stores your access code, account info, and (when you use cloud features) your captured sale events and consignor records.
• Backblaze B2 — object storage. Hosts the extension download, stores sale screenshots uploaded for the live board, and stores listing-prep item photos (with public URLs).
• Resend — sends your welcome/code email and our internal sign-up notification.
• Cloudflare — hosts backstagelive.app and the form-handling Worker; sees standard request metadata (IP, user agent) for site traffic.
• Google Lens — only if you use reverse-image search in listing prep. The public URL of the photo you select is passed to lens.google.com, which opens in a new tab. Use of Google Lens is governed by Google's own privacy policy.
• Linked consignors — if you connect a consignor to a show, the captured sales for that show are visible to that consignor through Backstage.

We do not use Google Analytics, advertising pixels, or third-party trackers on backstagelive.app/lite or in the extension. Whatnot itself collects whatever it normally collects when you use Whatnot; that is governed by Whatnot's own privacy policy, not ours.

5. Permissions the extension requests + why

• activeTab / scripting — to read sale events from the open Whatnot show tab and inject the capture script
• storage / unlimitedStorage — to save captured sales, buyer history, screenshots, and your activation locally without hitting storage limits
• tabs — to detect when you open a live show and to open recap/manifest pages
• sidePanel — to show the Live Feed UI in Chrome's side panel
• downloads — to save manifest/recap PDFs to your computer
• nativeMessaging — to talk to the optional local print companion for thermal label printing
• Host access to *.whatnot.com — so the content script can read the show feed
• Host access to rjopdzpvfabmdtcshgod.supabase.co — to validate codes, sign in, and (when using cloud features) sync captured sales and consignor data
• Host access to *.backblazeb2.com — to download the extension and upload board screenshots
• Optional access to other sites (<all_urls>) — requested only if needed for an optional feature, and only after you grant it

6. Data retention

• On your device: captured sales and listing-prep items are kept until you clear them (End Show / delete the item), delete a show, or uninstall the extension.
• Board screenshots and live captures (Supabase/B2): the live board is ephemeral and pruned automatically (roughly every few hours).
• Listing-prep photos (Backblaze B2): retained at their public URL so your saved listings keep working; email us to have specific images removed.
• Access code, account, email, handle, and consignor records (Supabase): kept while your account is active so we can verify your code on re-installs; deleted on request.

7. Security

• All network traffic uses TLS encryption (extension ↔ Supabase / Backblaze B2)
• Supabase tables are protected with row-level security policies
• Passwords are hashed by Supabase Auth; we never see them

No system is perfectly secure. If we discover a breach affecting your data, we'll notify you as required by law.

8. Your rights and choices

• Delete local data instantly by clicking End Show or removing the extension from chrome://extensions/
• Delete cloud data (account, email, handle, code, captured sales, consignor records) by emailing us — we'll remove it within 30 days
• Request a copy of, or correction to, the personal data we hold about you
• Stop using Backstage Lite at any time — no payment is taken and there is no auto-renewal during beta

If you live in California, the EU/UK, or another jurisdiction with data-rights laws (CCPA, GDPR, etc.), you may also object to certain processing and lodge a complaint with your local data-protection authority.

9. Children

Backstage Lite is not intended for anyone under 18, and we don't knowingly collect data from children. If you believe a child has used it, contact us and we'll delete the data.

10. Changes to this policy

If we materially change what we collect or how we use it, we'll update this page and the "Last updated" date, and email everyone with an active access code. We won't roll out billing or new data collection without notice.

11. Contact

Questions, deletion requests, or anything else: [email protected]
Operator: SlowArcs, LLC