Backpack Privacy Policy
Backpack is a Chrome extension for people who own a Skool community. This policy sets out exactly what data Backpack handles, where it is stored, how long it is kept, who it goes to, and how to get rid of it.
Backpack is operated by Havstock FZ-LLC, contactable at support@havstock.com. In this policy, "we", "us" and "our" mean Havstock FZ-LLC. We are the data controller for the account data described in section 1, and your processor for your members' data as set out in section 7. Havstock FZ-LLC is a free zone company registered in the Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates, with its registered office at:
FDBC1705 Compass Building
Al Shohada Road
Al Hamra Industrial Zone-FZ
Ras Al Khaimah
United Arab Emirates
Our Terms of Service sit alongside this policy.
The short version. Your automations run around the clock, including when your computer is off. For that to be possible, Backpack has to store your Skool session for each community you switch on. It is held encrypted, used only for those communities, and you can revoke it at any time. Backpack also stores your account, the member records of those communities, and what you build inside Backpack. It reads member payment state, including plan amount, billing dates, subscription status and whether a payment was declined. It never sees a full card number and never takes a payment. Everything is stored in a Cloudflare database in the EU. It is shared with nobody, unless you connect your own AI assistant through MCP, which then reads it when you ask it to. Emailing the address above gets everything deleted within 30 days. Separately, our website, backpack.click, uses Google Analytics and Microsoft Clarity to see how visitors use it. The extension does not (section 8).
1. What Backpack collects
Your account
Your email address, a display name if you set one, and the name and Skool URL slug of each community you switch on. Backpack has no passwords. You sign in with a six digit code sent to your email address. That code is stored only as a hash, expires after 10 minutes, and a session lasts 30 days before you have to sign in again.
Your Skool session for the communities you switch on
Why this exists. A browser extension can only do something while your browser is open. For your follow-up messages and scheduled posts to go out around the clock, on the day a payment fails, a member cancels or a post is due, rather than the next time you happen to open Chrome, they have to be sent by our servers instead. That is only possible if our servers can act as you inside Skool, and the only way to do that is to store your Skool session for each community you switch on. Without it, nothing runs while your computer is off. This is the trade, stated plainly so you can decide whether you want it.
What it is used for. Three things only: reading the member list and member payment state of each community you switched on, sending the follow-up messages that are switched on in your account to members of that community (payment and cancellation follow-ups start switched on with our starter wording, which you can edit or switch off), and publishing the posts you have scheduled in that community, at the time you set.
What it is not used for. It is not used to read or act in any Skool community you have not switched on, to change your Skool account or community settings, to post anything that has not been scheduled in Backpack, to comment or like on your behalf, to message anyone who is not a member of a community you switched on, or for any purpose of ours.
How it is held. Stored encrypted at rest, and readable only by the server processes that act for you. The encryption key is held separately from the database, so a copy of the database on its own is not enough to read it. No member of our team reads it as a matter of course; a person accesses it only where that is strictly necessary to fix a fault you have reported or to meet a legal obligation. It is never shared, sold or transferred to anyone, and never used for another customer's community.
How long we keep it. Until you revoke it, until 30 days after your subscription ends, until you delete your account, or until Skool invalidates it, whichever happens first.
How to revoke it. Click Disconnect Skool in Backpack's Settings, or email support@havstock.com. We delete the stored session on revocation. Changing your Skool password or signing out of Skool everywhere also invalidates it. Once it is gone, anything that depends on it stops working, including sequences that were part way through and posts that were still scheduled.
Backpack does not store your Skool password. It never has one and never asks for one.
Your community's member records
Backpack reads the member list of the community you own and have connected. That read happens in two places: in your own browser while you are using the panel, and on our servers, periodically, using the stored session described above, so your data stays current when you are not there. Backpack stores, for each member: their Skool member ID, handle, display name, profile picture URL, join date and last active date.
Member payment state
Backpack reads and stores the payment state your Skool owner account already shows you for each member:
- whether their subscription is active, cancelling, churned or on a trial
- the plan amount they pay and the billing interval
- their next billing date, renewal date or removal date
- their timezone, used to hold messages outside their quiet hours
- whether their last payment was declined
Backpack reads these so it knows when to run a payment or cancellation follow-up sequence, and so a message can accurately say what a member is paying and how long they have left. Where a sequence is running for a member, the plan amount and the days remaining are stored with that sequence run so the message can be filled in.
Backpack does not read, store or transmit full card numbers, bank details, or any complete payment credential. It never takes a payment. It has no connection to any payment processor. Card details are handled entirely by Skool and its payment provider, and Backpack never sees them.
What you create in Backpack
The tags, pipelines and stages you define, which members you put where, the message sequences you write, and the posts you schedule: their title, body, category, the time they are due, and whether they went out.
If you connect an AI assistant (MCP)
Backpack has an optional MCP connection that lets you link your own AI assistant, such as Claude or ChatGPT, to your Backpack account. Nothing is connected unless you do it yourself. To connect one, you sign in with your email code and approve the connection. We store a record of that approval: your email address, your team member and community, and the access tokens issued to that assistant. The assistant never receives your Skool session.
Once connected, the assistant can read your Backpack data when you ask it to, including your member records, member payment state, tags, pipelines and the state of your follow-up sequences. It can also add tags, move members between pipeline stages, and create, change or cancel scheduled posts. It cannot send direct messages, delete tags or pipelines, or change your message sequences. Every change it makes is logged in the audit record as coming from MCP.
Its access pauses while your subscription is unpaid and works again when you pay. It stops for good when you disconnect it, when your seat on the account is removed, or after 90 days without use.
An audit record
Every change made through Backpack is logged: which team member did it, what they changed, when, and whether it came from the panel, from a connected AI assistant, or from Backpack's own scheduled run on our servers. Each message a sequence sends is logged with the member, the sequence, the position in the sequence and the time.
Your own Backpack subscription status
Your email address, your membership status in the Skool community at skool.com/backpack, and the events that changed it. This is how Backpack knows your subscription is current. Skool takes the payment; Backpack only ever asks whether you are still a member.
2. What Backpack does not collect
- Your browsing history, or anything at all from any website other than skool.com.
- Your Skool password. Backpack never asks for it, never sees it and never stores it. The only Skool credential Backpack holds is the session described in section 1, for the communities you switched on.
- Cookies, sessions or credentials for any site other than skool.com, or for any Skool community you have not switched on.
- Full card numbers or bank details, yours or your members'.
- Keystrokes, mouse movement, screen recordings or any form of session monitoring.
- Your location.
- Health information.
This list is about the Backpack extension and service. The backpack.click website is different: it uses analytics that record visits, as set out in section 8.
Backpack itself contains no artificial intelligence. There is no model inside Backpack, no drafting and no generated copy, and Backpack sends nothing to an AI provider on its own. Your message templates are written by you, and Backpack substitutes the placeholders and sends what you wrote. The only way Backpack data reaches an AI provider is if you connect your own assistant through MCP, as described in section 1.
3. Where it is stored
Your account, your communities' member records, your tags, pipelines, sequences, sequence runs and audit log are stored in a Cloudflare D1 database, accessed through a Cloudflare Worker operated by us. The database is located in the European Union. Cloudflare is our only infrastructure provider and acts as a data processor on our behalf.
The approval record and access tokens for an AI assistant you connect are held in Cloudflare Workers KV, Cloudflare's key-value store, which is spread across Cloudflare's network rather than kept only in the EU.
Your stored Skool session is held in that same database as ciphertext. The key that decrypts it is not in the database. It is held separately as a secret available only to the Worker at run time, so obtaining a copy of the database alone does not reveal your session.
Your session token and your interface preferences are stored locally in your browser, in Chrome's extension storage. They are not readable by any website.
4. Who it is shared with
Nobody, unless you choose to connect an AI assistant.
Backpack does not sell your data. It does not share it with advertisers, data brokers, analytics providers or any other third party. It does not transfer it to determine creditworthiness or for lending purposes. There is no advertising in Backpack and no tracking in the extension. The backpack.click website uses analytics, as set out in section 8.
The only parties who ever touch your data are:
- You and the team members you invite to your own Backpack account.
- Cloudflare, which hosts the database and the API on our behalf and processes nothing on its own account.
- Resend, which delivers your six digit sign-in code. It receives your email address and nothing else.
- Skool, which receives the messages your sequences send and the posts you schedule, because that is where they are delivered. It also handles your subscription payment.
- The AI provider you choose, only if you connect an assistant through MCP. It receives the Backpack data your assistant asks for, when you ask it. That provider is chosen by you and handles the data under your own agreement with it, not ours. We do not choose it, pay it or control what it does with the data. Disconnect it and it can no longer read anything.
Your stored Skool session is shared with nobody at all, including Cloudflare, Resend and any AI assistant you connect. It is decrypted only inside our Worker, only to make a request to Skool on your behalf.
We will disclose data only if legally compelled to, and will tell you if we are permitted to.
5. How long it is kept
- Sign-in codes: expire after 10 minutes.
- Backpack sessions: expire 30 days after sign-in, or immediately when you sign out.
- Your stored Skool session: kept until you revoke it, 30 days after your subscription ends, you delete your account, or Skool invalidates it. Deleted on any of those.
- Member records, tags, pipelines, sequences, scheduled posts and audit entries: kept while your account exists, including while it is paused, so your history stays usable.
- A connected AI assistant's approval record and tokens: kept until you disconnect it, you delete your account, or it goes 90 days without use, then deleted. While your subscription is unpaid it cannot read or change anything.
- On account deletion: everything tied to your account is deleted, including your stored Skool session, member records, payment state, tags, pipelines, sequences, sequence runs, scheduled posts, connected AI assistants and the audit log. The stored session goes immediately; the rest within 30 days of your request.
- Subscription status records: retained after deletion only where we are required to keep a record of the transaction.
6. How to revoke access and delete your data
To revoke our access to your Skool account: click Disconnect Skool in Backpack's Settings, or email support@havstock.com. The stored session is deleted and our servers can no longer act on your behalf. You can do this at any time and without deleting anything else.
To disconnect an AI assistant: remove it in Backpack, or email support@havstock.com. It can then no longer read or change anything in your Backpack account.
To delete everything: email support@havstock.com from the address on your Backpack account and ask for deletion. Everything tied to your account is deleted within 30 days and we will confirm when it is done.
Uninstalling the extension removes the Backpack session token and preferences from your browser immediately. Chrome then opens a Backpack page that turns Backpack off for your account: we delete the Skool session we stored for every community you had on and disconnect every AI assistant you connected, so no more messages or posts are sent. It does not delete your other data on our side (email us for that), and it does not cancel your Backpack membership, which Skool bills: cancel it in Skool. If that page cannot open, for example because you are offline, click Disconnect Skool before you uninstall, or email us.
You can also ask us for a copy of everything we hold about you, or ask us to correct it, at the same address.
7. Your members' data
If you run a Skool community, you are the controller of your members' data and Backpack processes it on your behalf and on your instruction. We use it only to provide Backpack to you. We do not use it for any purpose of our own, do not combine it with any other community's data, and delete it when you delete your account.
Backpack only ever touches communities you own and have connected. It does not read communities you are merely a member of.
If you connect an AI assistant, you are choosing to share your members' data with that assistant's provider. Whether you have a lawful basis to do that, and whether you need to tell your members, is your decision as controller.
8. Our website
This section is about the backpack.click website only: the homepage, the blog and these policy pages. It is not about the Backpack extension. The extension has no analytics and no tracking, and nothing described in sections 1 to 7 is sent to the tools below.
To see how people find and use the website, we use two analytics tools on it:
- Google Analytics, run by Google. It records which pages you visit, how you arrived, how long you stay, your device and browser, and your rough location based on your IP address.
- Microsoft Clarity, run by Microsoft. It records how you use each page, including clicks, scrolling and mouse movement, so we can replay a visit and see where a page is confusing.
Both set cookies in your browser so they can recognise a return visit. They receive nothing from the Backpack extension, your Skool account or your members. Google and Microsoft handle this data under their own privacy policies (Google, Microsoft), and keep it for no more than 14 months.
You can stop both by blocking cookies or trackers in your browser. For Google Analytics you can also use Google's opt-out add-on.
9. Children
Backpack is a tool for community operators and is not directed at anyone under 16.
10. Changes
If this policy changes materially we will update the date at the top and tell existing users by email before the change takes effect.
11. Contact
support@havstock.com
Havstock FZ-LLC
FDBC1705 Compass Building
Al Shohada Road
Al Hamra Industrial Zone-FZ
Ras Al Khaimah
United Arab Emirates