Privacy at Digback

This page covers digback.com, the app at app.digback.com, the Digback MCP server, and the Digback phone app. It describes how Digback works today. If that changes, this page changes first, with a new date at the top.

Who runs Digback?

Digback is run by Lalit Fauzdar (Fauzdar1), in India, as a personal project. There is no company behind it. For anything about your data, write to [email protected].

What does Digback keep?

Your account. Your name, your email address and your password. The password is never stored as you typed it, only as a bcrypt hash that cannot be turned back into the password.

Your pins. Every link you save, and for each one:

• where it came from (Reddit, WhatsApp, Instagram, a bookmarks file, the share sheet, and so on)
• the note you wrote, or the words around the link in a WhatsApp chat
• the title, image, description and tags, from the page or from you
• up to 6000 characters of the page’s text, so search can find it
• for articles, a reading copy of the text, up to 120,000 characters
• a screenshot of the page, when the page has no picture of its own
• the date you saved it, the boards and tags you put it on, and any reminder you set

Files you import. A WhatsApp, Reddit or Instagram export is read to take the links out of it. The file itself is not stored. What is kept is the links with the details above, the file name, and a count of what was found and added. For a WhatsApp chat, that includes the message around each link and the name of the person who sent it, as the chat shows them.

Settings and connections. Your theme and view choices, and your reminder settings. If you use the phone app, a token for each phone you sign in on, and the token Firebase gives that phone for notifications. If you connect a Reddit account, your Reddit username and an access token, encrypted. If you make an MCP token, only a hash of it.

A record of changes. What was changed on your board and by whom (you, an AI app over MCP, or Digback itself), so you can see it in Settings.

Usage counts. How many pins you have and how many AI actions your account used this month, so plan limits work.

Server logs. Basic details of each request, like the time, the address asked for and the IP address, to keep the service working and to stop abuse.

Where is it stored?

In one MongoDB database on the server that runs digback.com, rented from a hosting company. Your pins are not copied to any other database.

Who else sees any of it?

Only these services, each for one job:

Service	What it sees	Why
Cloudflare	Every request to digback.com and app.digback.com, including your IP address	It sits in front of the site to protect it and keep it fast
An AI service, through OpenRouter	The title and text of one link, or your question and the text of your closest pins	To write a summary and tags, or to answer Ask. Only when that feature runs
The sites you save	A visit from Digback’s server, not from you	To read the page’s title, image and text, and to take a screenshot when the page has no picture
Google Firebase Cloud Messaging	Your phone’s notification token, and the pin title and text of each reminder	Only for the phone app, and only when push is switched on for the server, to deliver reminders
An email sending service	Your email address and the email itself	Only for password reset emails
An AI app you connect over MCP	What that app asks for through your token	Because you connected it. Your token reaches only your own pins

Search by meaning does not use an outside service. It runs on the Digback server with a small built in model.

Digback does not sell your data, does not share it with advertisers, and shows no ads.

Does Digback use cookies?

On digback.com, no. The website sets no cookies and runs no analytics or tracking scripts.

On app.digback.com, only to keep you signed in. Two cookies hold your sign in. The app also remembers your theme and reader choices on your device, in local storage. Nothing tracks you across other sites.

Read aloud uses the voice built into your browser or phone. Whether that voice runs on your device or with the browser maker’s service depends on your browser and the voice you pick.

How long is data kept?

• Your pins and account stay until you delete them.
• A deleted pin waits in the trash for 30 days, then it is removed for good.
• When a pin is deleted, a small record of its id and the time is kept for 180 days, so your phone can catch up. It holds no link and no text.
• When you delete your account, the account and everything in it are removed at once: pins, trash, boards, the change record, usage counts and connected devices. There is no waiting period.

What can I do with my data?

• See it. Everything is on your board.
• Take it with you. Settings, Data exports every pin as JSON, CSV or a browser bookmarks file, any time.
• Fix it. Edit any pin, note or tag.
• Delete it. Delete one pin, empty the trash, or delete your whole account from Settings, Account.
• Ask. For anything else, like a question about what is kept, write to [email protected].

Is my data safe?

The steps Digback takes:

• Every connection uses HTTPS.
• Passwords are stored as bcrypt hashes.
• AI keys and the Reddit token are encrypted before they are stored.
• MCP tokens are stored only as a hash, and each token reaches only one person’s pins.
• When Digback visits a link you saved, it refuses addresses inside private networks, so a saved link cannot be used to reach the server’s own network.

No system is perfect. If you find a security problem, write to [email protected] with “Security” in the subject.

Children

Digback is not meant for children under 13, and does not knowingly keep data about them.

Changes to this page

When Digback starts doing something new with data, this page is updated before it happens, and the date at the top changes.