Legal
Privacy Policy
Last updated 4 September 2026. pgProof is operated from Quebec, Canada. This policy is written in plain language on purpose — a backup service should be legible.
Who we are
pgProof ("we", "us") provides restore-tested Postgres backups, as an open-source command-line tool and a hosted service at pgproof.com. For any privacy question, write to hello@pgproof.com.
What we collect, and why
| Data | Why | When |
|---|---|---|
| Your email address | To send the launch notice (waitlist) or to sign you in and send reports and alerts (service) | When you join the waitlist or create an account |
| Hosting provider, number of databases (waitlist) | To decide what to build first — aggregate signal only | Optional, if you fill the waitlist fields |
| Database connection strings | To connect to your database and back it up | When you add a project to the hosted service |
| Your database backups (dumps) | This is the product — we back them up and restore-test them | On your backup schedule |
| Drill metadata (table counts, timings, extensions, sha256) | To produce the proof report | Each drill |
We do not use tracking cookies, advertising networks, or third-party analytics that profile you. The command-line tool sends us nothing — it runs entirely on your machine.
The sensitive part, stated plainly
The hosted service handles two things that deserve special care: your database connection strings and your data itself. Here is exactly how they are treated:
- Connection strings are encrypted at rest (AES-256-GCM, a distinct key per customer). They are decrypted only in memory, only at backup time, and are never shown back to you or written to logs — the dashboard displays only a masked
host/db. - Backups are encrypted before storage (AES-256-GCM) and kept in object storage. We recommend a read-only database role, and our setup script creates one; pgProof never needs write access to your database.
- Self-hosted agent mode keeps your credentials and dumps on your own infrastructure — they never reach us at all.
- We access the contents of your backups only when strictly necessary to operate the service (for example, to diagnose a failed restore you reported), never to inspect your data otherwise.
Where your data lives (sub-processors)
We keep the chain short. The hosted service runs entirely on Cloudflare (compute, database, encrypted object storage, and email delivery). We do not sell, rent, or share your data with anyone, and we use no other data processors at this time. If that changes, this page changes first.
How long we keep it
- Backups: for the retention window you choose per project (7, 30, or 90 days), then deleted automatically.
- Connection strings and account data: until you delete the project or your account.
- Waitlist email: until launch, or until you ask us to remove it — whichever comes first.
When you delete a project or account, the associated connection strings and backups are deleted.
Your rights
Under Quebec's Law 25 and Canada's PIPEDA, you may ask us to access, correct, or delete your personal information, and to stop using it. Write to hello@pgproof.com and we will respond within the legal timeframe. You may also lodge a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
Changes
If we change this policy, we update the date above and, for material changes affecting the hosted service, we notify account holders by email.
This document is provided in good faith and in plain language; it is not legal advice. Questions: hello@pgproof.com.