Privacy

Last updated 5 October 2026. Backseat is in a closed pre-alpha test.

In short

• The website counts visits without cookies and without identifying you. It sets one cookie, and only if you open a personal invite link: it remembers which link you came through, for the sign-in after the install. The hosting provider keeps ordinary server logs.
• If you join the waitlist, we keep your e-mail address to write to you once, when your spot is ready.
• The app signs you in with your Google account. We receive your Google user id, your e-mail address and your name — never your password.
• When you ask the assistant a question, the question, the text read off your game screen and — only when the assistant decides it needs one — a screenshot of the game are sent to our server and on, through Vercel’s AI Gateway, to OpenAI, whose language model writes the answer. A question you speak is turned into text the same way before that.
• Questions, answers and what the assistant looked at are stored so that your conversations survive a restart and so that we can find out what went wrong during the test. You can ask us to delete all of it at any time.
• The app tells us when it starts, when you play a game with it and for how long, and when you open the chat — so we can see how many people use Backseat and whether they come back. None of that carries what you asked or what was on your screen.
• Nothing is sold, and nothing is used for advertising.

Who is responsible

Felix Tesche
Innsbrucker Straße 55
10825 Berlin, Germany
felix.tesche@gmail.com

Write to that address for anything in this policy: a question, a copy of your data, a correction, or a deletion.

The website

backseat.wtf and docs.backseat.wtf are hosted by Vercel Inc. When you open a page, Vercel receives what every web server receives: your IP address, the page requested, the time, and your browser’s identification string. Vercel keeps these in short-lived server logs for operating and securing the service. We embed nothing from advertising networks. The fonts are served from our own domain.

Counting visits. The website uses Vercel Web Analytics to count how many people open which page, which site linked to it, and roughly from which country and on which kind of device. It sets no cookie and stores nothing on your device. A visitor is told apart only by a hash of the request that is discarded after a day, so we see numbers, never who you are. Legal basis: our legitimate interest in knowing whether anybody reads the site (Art. 6(1)(f) GDPR).

The waitlist. If you leave your e-mail address on the front page, we store it in our database at Supabase, with the time, the campaign tag in the address you came from (the part after ?ref=, if there was one) and the name of the site that linked to us. We use the address for one thing: to e-mail you when your spot in the test is ready. To send that e-mail we may pass the address to an e-mail sending service at that time. Legal basis: your consent, given by leaving the address (Art. 6(1)(a) GDPR). Write to us and we take you off the list and delete the address.

Invite links. Some testers get a personal link (backseat.wtf/i/…) instead of the plain address. The link was made for you by name, and the page it opens greets you by that name: the name is stored with the link, and shown to whoever opens it. Opening the link counts one visit for it — the link and the time, nothing about you — and sets one cookie, bs_invite, which holds only the link’s code, for 60 days. When the app then opens the sign-in page in the same browser, the code goes along, and which invite link you came through is stored with your account in our list of testers. That is how we see who passed the test on to whom. Without the cookie — another browser, or deleted — nothing is attributed, and nothing else changes. The website sets no other cookie.

Legal basis for the cookie: it only exists to carry out what the invite link you opened is for — bringing you into the test through that link — so it is strictly necessary and needs no separate consent (§ 25(2) no. 2 TDDDG). Storing which link you came through rests on our legitimate interest in knowing how the test spreads (Art. 6(1)(f) GDPR); you can object to it at any time, and we remove the link from your account.

The download button forwards you to GitHub, where the installer is published. From that moment GitHub’s privacy statement applies.

Legal basis: our legitimate interest in running a website that works and is not abused (Art. 6(1)(f) GDPR).

The app

Backseat is a program for Windows and the Steam Deck that draws over the game you are playing and lets you ask questions about it without leaving the game. To do that it has to read parts of your screen and send them to a server. This section says exactly what leaves your computer, when, and where it goes.

Your account

You sign in with Google. The sign-in happens in your own browser on Google’s pages; the app never sees your Google password. Google then tells our authentication provider, Supabase, who you are, and we receive:

• your Google user id,
• your e-mail address,
• your name and, if you have one, the address of your profile picture.

We store your user id and e-mail address in our list of testers, together with when you last used the app and which version you ran — and, if you came in through a personal invite link, which one. Google receives nothing about what you do inside Backseat; as far as Google is concerned, you signed in to a website. You can withdraw the app’s access at any time in your Google account’s third-party access, and sign out from the Backseat tray icon.

A sign-in session lasts one hour and is renewed silently while the app runs. The renewal secret is stored on your computer, encrypted with Windows’ own protection for the signed-in Windows user. Keeping it there is the only way to stay signed in between sessions, so it is strictly necessary for the thing you asked the app to do and needs no separate consent (§ 25(2) no. 2 TDDDG). Nothing else is written to your device for our benefit, and the website writes nothing but the invite cookie described under “The website”, and only when you open an invite link.

An account is how you take part: without a Google sign-in there is no way into the test, because every conversation is stored against an account. Handing over the three items above is not a legal obligation — it is what the agreement to test Backseat requires, and the consequence of not doing it is simply that you cannot use the app.

Legal basis: performance of the agreement under which you take part in the test (Art. 6(1)(b) GDPR).

Your installation

The app gives each installation a random id when it is first started, and sends it with every request together with the app’s version number. The id is random and tells us nothing about your computer; it lets your conversations follow you when you reinstall, and lets us see which version a problem occurred in.

When you ask a question

Each question you type is sent to our server on Vercel, together with:

• the text the app has read off your game screen, so the assistant knows what you are looking at,
• a short timeline of text that recently appeared on the screen,
• the previous questions and answers of the same conversation,
• the notes you have pinned in the overlay,
• the name of the game, and
• a screenshot of the game — only when the assistant decides it needs one to answer. The screenshot shows the game window; it does not include other windows.

Our server forwards this through Vercel’s AI Gateway to OpenAI, whose language model (GPT-5.6) writes the answer. The gateway passes the request on and keeps neither the question nor the answer. OpenAI does not use data sent through its API to train its models, and keeps requests for up to 30 days to detect abuse, unless the law requires longer. We can also switch a tester’s answers to Anthropic’s model (Claude), for example to compare the two; Anthropic processes that on our behalf under its commercial terms, which do not permit training on it.

To answer, the model may search the web. The model writes those searches itself from your question and the game; they carry neither your account nor your installation id. They are run by Exa — see “Who else sees the data” for what Exa does with them.

Please do not type personal data about other people into the assistant, and be aware that a game screen can show usernames or chat.

Legal basis: performance of the agreement (Art. 6(1)(b) GDPR) — answering is the service.

When you speak a question

Where voice input is switched on, the app records your microphone only while you hold the voice key, or from a press on the microphone button until you confirm or cancel. A cancelled recording is thrown away. Otherwise the recording is sent to our server, which passes it through Vercel’s AI Gateway to OpenAI’s speech-to-text model and gets the text back. That text becomes your question and is handled as above. We do not store the recording; OpenAI does not use it to train its models.

Legal basis: performance of the agreement (Art. 6(1)(b) GDPR) — you asked to speak instead of type.

What is stored, and for how long

Our server keeps a record of each question in a database run by Supabase Inc.:

• the question and the answer,
• the screen text, timeline and history that were sent with it, and the screenshot if one was taken,
• which game, which installation, which account, which app version, and when,
• how long the answer took, how many tokens it used, and any errors,
• the feedback you give on an answer (the thumbs and the note, if you write one).

This record is what lets your conversations come back after a restart and on another computer, and it is how we find out why an answer was wrong or slow during the test. It is read by the people running the test and by nobody else.

We keep it for the duration of the pre-alpha test and delete it within three months after the test ends, or earlier when you ask — for a single conversation or for everything.

Legal basis: performance of the agreement for keeping your conversations (Art. 6(1)(b) GDPR), and our legitimate interest in understanding and improving a product under test (Art. 6(1)(f) GDPR).

How you use the app

The app tells our server when a few things happen, so that we can see how many people use Backseat, how often, and whether they come back:

• when the app starts, and whether you are signed in,
• when a game gets the overlay and when it ends — which game, and for how long,
• when you open the chat in a game,
• for each question: how long the answer took, whether you spoke it or typed it, whether the assistant searched the web or looked at the screen, and whether it worked.

Each of these carries your installation id, the app version and whether it runs on Windows or a Steam Deck — and, if you are signed in, your account, which our server takes from your sign-in, never from the app’s own word. None of them carries a question, an answer, screen text or a screenshot. They are stored in the same database as your conversations, read only by the people running the test, and kept and deleted on the same terms.

Legal basis: our legitimate interest in understanding how a product under test is used (Art. 6(1)(f) GDPR). You can object at any time; write to the address above and we delete them.

Recognising the game

Before the overlay attaches to a game, the app sends the file name of the game’s program (for example gothic2.exe) to our server, which checks whether that game uses anti-cheat software the overlay must stay away from. For a game it has not seen before, our server has Anthropic’s model research that file name on the web; only the file name goes there. The result is stored per game, not per person. Nothing else about your computer or your installed programs is sent.

On your computer

The app writes a few files locally: log files in your temporary folder, a copy of your conversation record, your installation id, your sign-in secret, and the invite link you came through, if any. They never leave your computer unless you send them to us. Uninstalling the app removes the program; the folder %APPDATA%\Backseat and the log files in %TEMP% can be deleted by hand.

Who else sees the data

We use the following companies as processors. They act on our instructions and may not use the data for their own purposes:

• Vercel Inc. (USA) — hosts the website and our server, counts the website’s visits, and runs the AI Gateway through which questions and voice recordings reach the models.
• Supabase Inc. (USA) — runs the database (the waitlist included) and the sign-in service.
• OpenAI (USA) — runs the language model that answers your questions and the speech-to-text model, reached through Vercel’s AI Gateway.
• Anthropic, PBC (USA) — checks unknown games for anti-cheat, and answers questions for a tester whose answers we switched to its model.
• GitHub, Inc. (USA) — hosts the installer download.

Google LLC (USA) is not on that list, because it is not acting on our instructions. When you sign in, Google decides for itself what it does with your Google account — it is a controller in its own right, and its own privacy policy governs that part. All we receive from it is the handful of items named under “Your account”.

Exa (USA), which runs the assistant’s web searches, is not on that list either. Under its own privacy policy, Exa may use search queries to improve its services, including to train its models. That is why a search never carries your account or your installation id. It is written by the model and can still contain words from your question — another reason not to type personal data about other people into the assistant.

These providers may process data in the United States. Transfers rest on the EU standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework. Write to the address above and we will send you a copy of the clauses.

We do not sell data, share it with advertisers, or pass it to anyone not listed here.

Your rights

Under the GDPR you can ask us at any time to:

• tell you what data we hold about you and give you a copy (access, Art. 15),
• correct it (Art. 16),
• delete it (Art. 17) — this includes your account and every conversation,
• restrict how we use it (Art. 18),
• hand it over in a machine-readable form (Art. 20),
• object to processing based on legitimate interest (Art. 21).

Where processing rests on your consent, you can withdraw it at any time with effect for the future. You also have the right to complain to a data protection authority — in Germany, the one for the state you live in. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Write to the address under “Who is responsible”. We answer within a month.

Children

Backseat is not intended for anyone under 16, and we do not knowingly collect data from children.

Changes

When the app starts sending or storing something new, this page changes with it, and the date at the top moves. Substantial changes are announced to testers in the channel the test is run from.