Privacy policy

This policy explains what personal data hechenbros processes when you use the Log App website and the Log App app, why, and what your rights are. It is written to meet the Swiss Federal Act on Data Protection (revDSG/nFADP) and, for users in the European Union and the European Economic Area, the General Data Protection Regulation (GDPR). It is written in plain language on purpose.

The short version: as a guest, everything you log stays on your phone. With an account, your logs are synced to our Firebase database so you can restore them. Nothing is sold, there is no advertising, and there is no analytics or tracking on the website or in the app. When the app crashes it sends us a report so we can fix it; that report carries no name, no email address and nothing you logged (section 4.10).

1. Controller

The controller responsible for this processing is hechenbros, represented by Klemens Hechenberger and Lukas Hechenberger, Switzerland (full addresses in the Contact section below). Email for privacy requests: hello@hechenbros.com.

2. Scope

This one policy covers two products: the website at logapp.co (section 3) and the Log App app for iOS and Android (section 4). Sections 5 to 11 apply to both.

3. The website

3.1 Hosting and server logs

The website is a set of static pages hosted by Hostinger International Ltd. in the EU. Like every web server, Hostinger’s servers record technical access data for each request: your IP address, the page requested, date and time, the referring page and your browser’s user-agent string. We do not combine these logs with any other data and only look at them to investigate abuse or errors. They are deleted automatically by the hosting provider’s log rotation. Legal basis: our legitimate interest in operating the site securely (GDPR Art. 6(1)(f)).

3.2 No cookies, no analytics

The website sets no cookies and uses no analytics, tracking pixels, advertising or embedded third-party fonts. If that changes, this policy and its “Last updated” date change with it.

3.3 Roadmap voting

The public roadmap lets you upvote feature ideas without an account. To remember your votes, your browser generates a random identifier and stores it, together with the list of ideas you voted for, in its local storage (not a cookie; it is never sent anywhere except with a vote and can be removed by clearing your site data). When you vote, that identifier and the idea number are sent to our server functions (Firebase Cloud Functions, region europe-west1) and stored so that each browser counts once. The identifier is not linked to a name, email or account.

To limit abuse, the server stores a truncated SHA-256 hash of your IP address with a request counter that resets after one hour. The hash cannot be turned back into your IP address, and the plain IP address is not stored. Legal basis: our legitimate interest in preventing vote manipulation (GDPR Art. 6(1)(f)).

3.4 Feature suggestions

If you submit a suggestion, we store the title, description, the optional log type you picked, the random identifier above, the hashed IP address and, if you enter one, your email address. The title, description and log type are stored as an issue in our private GitHub repository (GitHub, Inc., USA) and, once we have reviewed the suggestion, shown on the public roadmap. Your email address is never published and never sent to GitHub; it is used only to tell you when your idea ships. Legal basis: your consent, given by submitting the form (GDPR Art. 6(1)(a)); you can withdraw it any time by emailing us and we delete the email address.

Once a day, a scheduled function writes the current vote count into each issue on GitHub. That sync transfers only the number, no personal data.

4. The app

4.1 Guest mode: your data stays on your device

You can use Log App without an account. In guest mode, every log, entry, photo, sketch and voice note is stored only in the app’s private storage on your device. Nothing is uploaded to us and we have no way of seeing it. Deleting the app deletes this data; “Reset all data” in the settings does the same without deleting the app. The features in 4.4 (AI analysis) and 4.5 (place search) require an account. In guest mode only two things leave your device: the map and address lookup in 4.6, and the crash reports in 4.10, which carry nothing you logged.

4.2 Account: sign-in

If you create an account, sign-in is handled by Firebase Authentication (Google). We store your email address and, for password accounts, a salted hash of your password (we never see the password itself). With Sign in with Apple, Apple gives us your email address (or an Apple-generated relay address if you chose to hide it) and, if you allow it, your name; we do not use the name for anything today. Firebase also records the time of your sign-ins. Legal basis: performance of the contract with you (GDPR Art. 6(1)(b)).

4.3 Account: sync of your logs

With an account, your logs and entries are stored in Cloud Firestore and your attachments in Cloud Storage, both Firebase services by Google, in an area that only your account can read. When you sign in for the first time, the logs you built as a guest are uploaded to that account. What is stored is what you entered:

• Logs: name, tags, the variables you defined, goals, streak settings, reminder settings.
• Entries: date and time, the values you logged, optional title, notes, duration and location (coordinates and address, if you attached one).
• Attachments: photos, hand-drawn sketches and voice notes you added to entries.
• Recaps: the period summaries (for example last month’s) the app computes from your entries.
• Usage counters: how many AI analyses and place searches you used (user ID, day or month, count), so the daily and free-tier limits can be applied.

What you log is up to you. If you choose to log health-related information (symptoms, sleep, medication, skin photos and the like), that is special-category data under GDPR Art. 9. We process it solely to store and show it back to you, based on your explicit consent given by entering it (GDPR Art. 9(2)(a)); we never analyse it for our own purposes. Legal basis for the sync itself: performance of the contract (GDPR Art. 6(1)(b)).

Where the data is kept: the database (logs, entries, recaps, counters) is in Google’s European multi-region (eur3, data centres in Belgium and the Netherlands) and our server functions run in europe-west1 (Belgium). Attachments are stored in Google’s us-east1 region (USA), and Firebase Authentication processes your sign-in data in the USA. Google may also access data from other countries to provide and support its services. Google is certified under the EU-US and Swiss-US Data Privacy Framework and its data processing terms include the EU standard contractual clauses.

4.4 AI analysis (optional, account required)

When you tap “Analyse” on a log, the app builds a plain-text summary of that log and sends it to our server function, which forwards it to Anthropic, PBC (USA), the provider of the Claude language model, and returns the model’s answer. Nothing is sent unless you trigger it. The summary contains exactly this:

• the log’s name and tags, the number of entries and the date range;
• the computed statistics per variable (e.g. average, total, maximum) and, if the log groups by a variable, the breakdown per group;
• the 40 most recent entries: date, logged values, duration, the text of your notes, and how many photos, sketches or voice notes are attached (the count only; the files themselves are never sent);
• your current goal for the log, if any.

Locations, titles, photos, sketches, voice recordings, your name and your email address are not included. Our server does not store the summary or the answer, and neither reaches our server logs: when a response from the model cannot be read, what is logged is its shape — how many content blocks it held and how long each was — and never any of its text. The only thing the call records is the usage counter from 4.3. Under Anthropic’s commercial terms, API inputs and outputs are not used to train Anthropic’s models. Legal basis: your consent, given in the app on the consent sheet the first analysis shows and confirmed by each later analysis you ask for (GDPR Art. 6(1)(a)); you can withdraw it at any time by not using the feature and by writing to us. Transfer safeguard: EU standard contractual clauses in Anthropic’s data processing addendum. The analysis is a statistical summary, not medical or professional advice.

4.5 Place search (premium, account required)

When you search for a place or browse nearby places, the app sends your search text, the place you pick and, if you allow location access, the coordinates to bias the search, to our server function, which forwards them to the Google Places API (Google LLC, USA) using our key. Our server does not store the query. Only the place you finally attach to an entry (name, address, coordinates) is saved with that entry; the search itself only increases the usage counter from 4.3. Without an account, or once the Google search is unavailable, place search falls back to Photon (4.6). Legal basis: performance of the contract (GDPR Art. 6(1)(b)). While there is nothing to buy in the app (see 4.7), this feature is available to everyone with an account.

4.6 Maps, device location and address lookup

Maps in the app are rendered by the operating system’s own map framework: Apple Maps on iOS and the Google Maps SDK on Android. Loading map tiles sends your device’s IP address and the map area you are viewing to Apple or to Google respectively, under that company’s own privacy policy. Your device location is used only while a location picker or map is open, only if you grant the operating system’s permission, and only to show your position and centre the map; it is saved solely when you attach a location to an entry. Address search and turning a dropped pin into an address use Photon, an OpenStreetMap-based geocoder run by komoot GmbH (Germany): the text you type or the pin’s coordinates are sent there without any account or identifier. Legal basis: performance of the contract (GDPR Art. 6(1)(b)).

4.7 Subscriptions

There is nothing to buy in the app today: subscriptions are not switched on, every feature is included, and no purchase, subscription or payment data is processed. Nothing is sent to RevenueCat, Inc. while that is the case. The rest of this section describes what will happen once subscriptions launch, and we will update the “Last updated” date when they do.

Premium subscriptions are bought through Apple’s App Store (or Google Play on Android). Apple or Google processes the payment; we never receive your payment details. Subscription status is managed by RevenueCat, Inc. (USA), which receives your Firebase user ID as the app user ID, the purchase receipt and transaction identifiers from the store, and your device’s platform and app version. This lets us unlock premium on all your devices and restore purchases. Legal basis: performance of the contract (GDPR Art. 6(1)(b)). Transfer safeguard: EU standard contractual clauses in RevenueCat’s data processing agreement.

4.8 Reminders and notifications

Goal reminders, inactivity nudges and streak warnings are local notifications scheduled on your device by the app itself. There is no push-notification server, no device token is collected, and the reminder settings leave your device only as part of the log sync in 4.3.

4.9 Photos, microphone, camera

The app asks for photo-library, camera and microphone access only when you add a photo or voice note to an entry. The resulting file is stored on your device (guest) or in your account’s Cloud Storage folder (account). No other photos or recordings are read.

4.10 Crash reports

When the app crashes, or runs into an error it handles without showing you anything, it sends a report to Sentry (Functional Software, Inc., USA), our crash-reporting provider, so that we can find and fix the bug. The reports are stored in Sentry’s European region. A report contains:

• the error itself: its type, its message and the stack trace (which line of our code failed);
• the app version and build number, and a record of the app session — when it started, whether it was in the foreground, and whether it ended in a crash — so we can see how many sessions of a release run without crashing;
• your device model, operating-system version, screen orientation, free memory and disk space and battery level;
• a short trail of what happened before the error: which screens you moved between and when the app was opened, backgrounded or resumed.

What you log is never part of it. Before a report leaves your device, the app strips it: the user object is deleted, so no user ID, email address or name is attached; the device’s own name, the request address and any request headers are removed; everything the crash reporter attaches about your device beyond the few items listed above is dropped rather than sent; the value of any field that could hold your content — names, titles, notes, values, tags, places, labels, descriptions, search queries — is replaced with “[redacted]”; an email address appearing anywhere in an error message becomes “[email]” and a query string becomes “[redacted]”; text longer than 300 characters is cut off; and the trails that could record what you typed, which control you tapped, what the app requested or what it printed to the console are dropped entirely. Screenshots of the screen, the view hierarchy, your IP address and performance tracing are switched off in the crash reporter itself.

One kind of report is an exception to “before it leaves your device”. If the app is killed outright rather than running into an error it can handle, the crash reporter saves the report while the app is already stopping and sends it the next time you open the app — too early and too late for the app’s own stripping to run on it. Such a report carries the crash reporter’s own description of your device, which can include the name you gave it (“Anna’s iPhone”). Sentry is configured to delete that name on arrival, and not to store the IP address any report is sent from, so neither is kept. What you logged is not in these reports either: they describe the app’s own code, not its contents.

Because no identifier is attached, we cannot tell whose device a crash report came from or connect it to your account. Sentry processes the reports for us under a data processing agreement and deletes them 30 days after they arrive. Legal basis: our legitimate interest in an app that works and does not lose your data (GDPR Art. 6(1)(f)). You can object to this processing at any time (GDPR Art. 21) by writing to hello@hechenbros.com. Because a report carries no identifier, we cannot pick out the ones that came from your device after they have arrived; write to us and we will tell you how to stop further ones.

Apart from these reports the app contains no analytics SDK and no advertising, and we do not track how you use the app. Should we add product analytics later, we will describe it here first.

5. Recipients and international transfers

We share personal data only with the processors below, each bound by a data processing agreement and only for the purpose stated. Some are in the USA. For transfers from Switzerland and the EU/EEA we rely on the recipient’s certification under the EU-US / Swiss-US Data Privacy Framework where it exists, and otherwise on the EU standard contractual clauses (with the Swiss addendum), as listed. We never sell personal data.

Apple and Google act as independent controllers for the App Store, Google Play, payments and your Apple ID / Google account; their own privacy policies apply to those.

6. Retention and deletion

• Guest data lives only on your device and is gone when you delete the app or use “Reset all data”.
• Trash. A log or entry you delete goes to the Trash first, where you can restore it for 30 days. After that it is deleted for good, attachments included: for an account by a server job that runs every night, in guest mode the next time you open the app. “Delete now” and “Empty trash” delete it earlier; with an account, the attachment files then go in the next nightly run, once no other entry of yours still uses them.
• Account data (logs, entries, attachments, recaps, usage counters, sign-in record) is kept until you delete it. “Reset all data” removes every log, entry and attachment but keeps the account; “Delete account” in the settings removes all of that, the usage counters and the account itself, immediately and irreversibly, and for Sign in with Apple also revokes the app’s access to your Apple ID. You can also email us and we delete it for you.
• Crash reports are deleted by Sentry 30 days after they arrive. They contain no identifier, so they cannot be matched to you or to your account while they are stored.
• Provider backups: deleted data may persist in Google’s backups for a limited time before it is purged under Google’s deletion policies (up to 180 days).
• Roadmap votes are kept as long as the idea is on the roadmap. Suggestions and the optional email address are kept until the idea ships or you ask us to remove them. Rate-limit hashes hold no readable identifier and are deleted by a daily cleanup once their one-hour window has passed.
• Website server logs are deleted by Hostinger’s log rotation.
• App server logs. Our server functions run on Google Cloud Functions and write technical diagnostics to Google Cloud Logging in the EU — an error, a refused request, a rate limit reached. These entries record what went wrong and which account made the call, never the content of your logs or an AI analysis. Google deletes them after 30 days.
• Emails you send us are kept as long as needed to handle your request and for any legal retention duties.

7. Your rights

Under the revDSG and the GDPR you can ask us at any time for access to your personal data, for its correction or deletion, for a copy in a machine-readable format (data portability), for restriction of processing, and you can object to processing based on legitimate interest. Where processing is based on consent (AI analysis, the suggestion email), you can withdraw it at any time with effect for the future. Write to hello@hechenbros.com; we may ask you to verify your identity. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU/EEA the authority of your country of residence (for example the Datenschutzbehörde in Austria or your state’s authority in Germany).

We make no automated individual decisions about you and do no profiling (revDSG Art. 21, GDPR Art. 22). The AI analysis describes your log to you; nothing is decided on its basis.

8. EU representative

hechenbros has no establishment in the EU. Our processing of EU users’ data is occasional and not large-scale, so we have not appointed a representative under GDPR Art. 27. We reassess this as the app grows.

9. Children

Log App is not directed at children under 13, and in the EU/EEA you must be at least 16 (or the age of digital consent in your country) to create an account. We do not knowingly collect data from children; if you believe a child has given us data, email us and we will delete it.

10. Security

Data in transit is encrypted (TLS). Account data is stored in Firebase under your user ID and is only read or written through your signed-in session. API keys for third-party services stay on our server; the app never contains them.

11. Changes to this policy

We update this page whenever the app or the website starts processing data differently, change the “Last updated” date at the top and, for material changes, tell you in the app or by email. Changelog: 2026-10-16 where the data is stored (section 4.3: database in the EU, attachments in the USA); the Trash and its 30 days (section 6); recaps and the place-search counter listed, and the usage counters are deleted with the account (sections 4.3, 6); crash reports also run in guest mode (section 4.1); suggestions go to a private repository and appear on the roadmap after review (section 3.4); rate-limit hashes are deleted daily (section 6); no automated decisions (section 7); 2026-09-24 corrected to match the app: maps on iOS are Apple Maps, not Google Maps (section 4.6); the AI analysis asks for consent in the app before the first summary is sent (section 4.4); subscriptions are not switched on, so no payment data is processed and nothing reaches RevenueCat (section 4.7); 2026-09-22 crash reports described more precisely (section 4.10: reports sent after the app is killed cannot be stripped on the device, and the device name and IP address are deleted at Sentry instead; the device language is no longer part of a report); 2026-09-21 crash reporting added (section 4.10, Sentry as processor, 30-day retention); 2026-09-14 first version.

Contact

hechenbros
Klemens Hechenberger, Ländernachstrasse 27, 9435 Heerbrugg, Switzerland
Lukas Hechenberger, Hintergasse 5, 7204 Untervaz, Switzerland
UID CHE-168.518.196
Email: hello@hechenbros.com (privacy requests, legal)
App support: hello@hechenbros.com