loggie.xyz  /  Privacy Policy

Privacy Policy

Last updated: October 3, 2026

Loggie is operated by Obrevaro, LLC ("we," "us," "our"). The app is built so we can't see your data, even if we wanted to. This page explains what that means in practice — what stays on your device, what reaches our server, and the few exceptions you should know about.

1. Short version

• No accounts, no email, no name required to use the app.
• Your entries, photos, and notes live on your device. They are encrypted before they ever leave it.
• If you turn on sync, our server stores your encrypted data without being able to read it, plus a few identifiers it needs to deliver it (see below).
• We don't track you. There are no analytics, no ad SDKs, no third-party trackers.
• You can export everything to CSV at any time. Deleting data or leaving a vault removes it from your device. The vault's owner can delete the vault from our server in the app, or ask us to (see Retention & deletion).

2. What we don't collect

Loggie does not collect, store, or transmit:

• Your email address, phone number, or any account login. (The only names we receive are the ones you type when inviting someone — see Data on our server.)
• The content of your log entries, notes, or photos in a form we can read.
• Behavioral analytics, telemetry, crash reports, or device fingerprints.
• Advertising identifiers (IDFA, AAID) or any data shared with advertisers.
• Location data of any kind on our servers. (You can attach coordinates to a log entry, but those coordinates are part of the encrypted entry — we can't see them. Place search and map tiles are switched off on our server.)

3. Data on your device

All of your information lives on your device first. The app stores it locally in a private database (IndexedDB on the web, the equivalent local storage in the iOS and Android apps). This includes:

• Your log entries, custom fields, and field values.
• Subjects you've created (e.g., a baby's name, a car's make/model), users (loggers), and any metadata you've added.
• Photos you've attached to entries — stored as encrypted blobs.
• Your device's encryption keys, including the vault key (if you've joined or created a vault) and a per-device identity key used for invites.
• Your app preferences (which domains you've enabled, your current logger, etc.).

Anyone with physical access to your unlocked device can open the app and see this data. Use your device's lock screen, biometric auth, and disk encryption.

4. Data on our server

If — and only if — you turn on sync by creating or joining a vault, the app uploads encrypted copies of your data to our relay server (currently loggie.xyz, hosted on a self-managed VPS). Here's exactly what reaches the server:

• Encrypted events — each change you make (a new entry, an edit, a delete) is wrapped in an envelope, encrypted with your vault key (AES-256-GCM), and sent as opaque ciphertext. We can see that an event arrived. We cannot see what's in it.
• Encrypted blobs — photos and attachments are encrypted on your device and uploaded as binary blobs. The server cannot decrypt them; it sees only their size and when they arrived.
• Vault ID — a random UUID identifying which vault an event or blob belongs to. It is not linked to an account.
• Device identifiers and public keys — each device has a random device ID and public keys. The server stores them for every member device so it can check signed requests and deliver invites, and marks which devices are the vault owner's: only those can invite people, remove them, or delete the vault. So an invite for one of the owner's own devices says that much readably. Public keys are not sensitive on their own.
• Owner secret — a random value per vault that the server gives only to the owner's devices, for their recovery kit. A device restored from that kit shows it to get the owner's rights back. It reveals nothing about your data.
• Membership check — a hash of a value your devices derive from the vault key. When you restore a device from a recovery kit or backup, it proves it holds the key by sending that value, so the server can let it back in. Neither the value nor its hash reveals the vault key.
• Invites — when you invite someone, the invite carries the name you've set for yourself, the name you typed for the person you're inviting, a random user ID, and which trackers you're sharing with them. These are encrypted on your device for the invitee, together with the vault key, so the server stores them but cannot read them. For an invite link they are encrypted under the secret part of the link, which never reaches the server; the invite page decrypts your name in the invitee's browser. Invites sent from app versions before this change still carry those details readable until they are picked up or expire. An invite is removed when the invitee's device picks it up or declines it, and otherwise expires (72 hours by default).
• ACK watermarks — each device tells the server which events it has applied so the server can compact (delete) old events that all devices have seen.
• Storage usage counters — total bytes stored per vault, used to enforce per-vault quotas.
• Timestamps — when each event, blob, and device acknowledgement arrived.

Server logs. The relay logs each request's method, the kind of request it was, response status, and timing, for operational monitoring and debugging. It does not log the vault ID, your IP address or user agent; it uses the IP address only in memory, for rate limiting (to stop abuse). Log files are capped in size and the oldest are discarded as new ones are written, which at normal traffic keeps about two weeks of logs. Logs are not used for analytics. We do not run any third-party log collector.

5. Sharing with third parties

We do not sell, rent, or share your data with third parties for advertising, analytics, or any commercial purpose. The only third parties involved in the app are:

• Apple App Store / Google Play Store — they distribute the app and may collect their own diagnostics from your device per their respective privacy policies. We don't see those diagnostics.
• Our hosting provider — the VPS that runs the relay server has incidental access to encrypted data passing through, but cannot decrypt anything.

We may disclose data to law enforcement only when compelled by a valid legal process. Even then, your entries, photos, and attachments are encrypted and useless without your vault key, which we never possess; we could only hand over the identifiers and invite details described above.

6. Retention & deletion

• On your device: data stays until you delete it or uninstall the app.
• On the server (events): after every device in your vault has acknowledged an event (plus a small buffer of recent events), the server compacts that event from storage. In practice, old changes are dropped automatically once everyone has them. A device that has stopped syncing keeps those events on the server, as does an invite nobody has picked up until it expires.
• On the server (blobs): when you delete an entry that had photos or attachments, or remove a photo or attachment from an entry, the app deletes it from your device, asks the server to delete its encrypted copy, and the vault's other devices delete theirs the next time they sync. The server stops serving it at once and removes the file within about a day. Deleting from an app version older than this one leaves the server's copy in place.
• Leaving a vault: "Remove me from this vault" erases the vault's data and key from your device and removes your device from the vault on the server. The entries you logged stay in the vault for the others.
• Deleting a vault: "Delete this vault everywhere", on one of the owner's devices, deletes the vault's encrypted events, photos and attachments, invites, device identifiers, owner secret, and membership check from the server, and erases the vault from that device. The server keeps only the vault ID, marked as deleted, so the vault can't be started again by mistake. Other members' devices are told the vault was deleted; what is already on them stays until they export or erase it.
• Asking us to delete the server copy: if none of the owner's devices is left to delete it from the app, we do it by hand. Email privacy@obrevaro.com. There are no accounts, so we cannot look a vault up by your name or email, and we will not delete a vault just because someone sent us its ID. We will ask you to send the diagnostic report from a device in the vault (Settings → Sync → Diagnostics) to confirm the request comes from a member; deleting a whole vault needs its owner. We then delete the vault's encrypted events, photos and attachments, invites, device identifiers, owner secret, membership check, and vault ID from the server. Erase or leave the vault on every device first — a device that still has it will start the vault again on the server at its next sync.
• Server logs: kept for about two weeks, capped by size rather than by date (see Data on our server). They do not record the vault ID, so there is nothing in them to remove for a deletion request.
• Server backups: backup copies of the server's database are kept for at most 35 days, so data deleted from the server can remain in a backup for up to 35 days.
• What we cannot delete: copies on another person's device, and anything already exported, backed up, or saved outside the app (CSV exports, backup files, recovery kits, screenshots).

7. Security

Loggie uses standard, well-vetted cryptography from the platform's Web Crypto API — no custom crypto, no third-party crypto libraries.

• AES-256-GCM for encrypting events and blobs.
• ECDH on the P-256 curve + HKDF for deriving shared secrets between two devices when sending an invite.
• AES-KW for wrapping the vault key for an invitee.

Encryption happens on your device before any network request. The server never sees your entries, photos, or attachments in plaintext. We disclose this in detail because if you don't trust the cryptography, the rest of this policy doesn't matter.

We do not have a way to recover your data if you lose all of your devices and have not exported a backup. This is a deliberate design choice — there is no master key on our side that could be compelled or compromised.

8. Children & family use

Loggie includes a Baby tracking domain that adults use to record information about an infant in their care. The user of the app must be 13 years or older (or the age of digital consent in your jurisdiction). The app is not directed at children, and we do not knowingly collect data from children — both because children should not be the user of the app, and because we cannot read the entries anyway.

9. Your rights

You can:

• Export all of your data as CSV from Settings at any time.
• Delete any entry, subject, or vault from your devices at any time from within the app, and ask us to delete a vault's encrypted copy from our server (see Retention & deletion).
• Disable sync at any time and keep using the app fully offline.
• Request information about any data we may hold by contacting us. Note: because of the encryption design, our practical answer for any user will be "we hold opaque ciphertext we can't read, indexed by a vault UUID, plus the device identifiers described above, and the invite details sent by older app versions."

If you are in the EU/UK, the GDPR concepts of access, rectification, erasure, and portability apply. The encryption design means most of these are exercised directly through the app; for anything else, contact us at the address below.

10. Changes to this policy

We will update this page when our practices change. The "Last updated" date at the top will reflect the most recent revision. Material changes that meaningfully affect what we collect or how we share data will be announced inside the app and on the loggie.xyz homepage.

11. Contact

Questions, concerns, or requests about this policy: privacy@obrevaro.com.

© Obrevaro, LLC. Loggie — end-to-end encrypted journaling.