Leaflog

Leaflog Privacy Policy

Last updated: July 24, 2026

Leaflog is a personal journal. Your privacy is the core of its design.

By default, everything stays on your device

Leaflog does not collect, transmit, or share any data unless you turn on the optional Leaflog+ backup described below.

  • Everything you log (strains, sessions, notes, ratings, stash entries) is stored only on your device.
  • Photos you take or choose stay in the app's local database on your device. Camera access is used solely to capture photos you ask for; Leaflog never reads your photo library (the system photo picker runs outside the app).
  • The app contains no analytics, no advertising, and no third-party SDKs, with or without Leaflog+.
  • Without Leaflog+, there are no accounts, no sign-in, and no network connections.

Leaflog+ (optional, off by default)

Leaflog+ is an optional subscription that backs up your journal to Leaflog's servers, end-to-end encrypted.

We cannot read your journal. Before anything leaves your device, it is encrypted with AES-256-GCM using keys generated on your device. Those keys never leave your devices except in encrypted form, protected by your recovery code or your iCloud Keychain. Leaflog's servers store only ciphertext and have no way to decrypt it. There is no password reset and no support-assisted recovery: if you lose your devices and your recovery code, your backup is unreadable by anyone, including us.

What the server holds. The server never sees plaintext user data. It stores:

  • your encrypted (ciphertext) backup blobs,
  • their sizes and timestamps,
  • a keyed hash (HMAC) of your Apple account identifier, used only to recognize your account when you sign in with Apple,
  • your subscription state.

Nothing else. No email address (Leaflog never requests the Sign in with Apple email scope), no name, no device names, and no IP address retention beyond short-lived rate-limit windows.

Sign in with Apple is the only sign-in method, and an account exists only if you subscribe. Payment is handled entirely by Apple; Leaflog receives your subscription status but never your payment details.

Retention and deletion

  • Deleting the app permanently deletes all local data. If you use an encrypted device backup (iCloud or computer), your local data is included in it under Apple's protections.
  • If your Leaflog+ subscription lapses, your encrypted backups are kept for 90 days so you can come back or restore, then permanently deleted.
  • You can delete your Leaflog+ account at any time inside the app (Settings → Leaflog+ → Account). Deletion immediately removes all server-side data and revokes the Sign in with Apple connection.

Contact

Questions about this policy: leaflog.app@proton.me