Privacy commitments

The strongest privacy policy is not needing your trust.

Most services promise not to look at your data. LeoLog is built so that looking is impossible: your notebook is encrypted on your device, and we hold only ciphertext. This page lists, in plain language, the little we do hold — and what we do with it.

What we cannot see, by design

Your entries, sketches, attachments, tags-in-content, and drafts. All of it is encrypted with keys that exist only on your devices; our servers store ciphertext, and only a one-way SHA-256 fingerprint ever touches a blockchain. This is not a policy that could quietly change — it is the architecture, documented on our security page.

What we do hold, and why

• Your email address and a password hash (Argon2id) — to operate your account, deliver verification and recovery email, and meet our legal obligations. We use Resend to deliver transactional email.
• Consent records — which Terms version you accepted, and when.
• Ciphertext and public cryptographic parameters — your encrypted content, encrypted keys, salts, and entry fingerprints, per the security page.
• Operational telemetry — error reports and performance traces so we can keep the service working. These pipelines are scrubbed before anything leaves the server: our monitoring is tested to strip cookies, request bodies, query strings, and email addresses, and trace attributes are restricted to a zero-knowledge allow-list. Your content cannot appear in our logs, because it never exists on our servers in readable form.
• Waitlist submissions — if you joined the waitlist: the name, email, and note you chose to give us, used only to contact you about LeoLog.

What we don't do

• No advertising, no ad trackers, no sale or rental of any data, ever.
• No training AI models on your content — see above; we couldn't if we wanted to.
• No reading your notebook for "safety review," "quality," or any other euphemism.

Deletion

Deleting an entry destroys its decryption material — a crypto-shred that makes the remaining ciphertext permanently unreadable. Deleting your account removes your account data and encrypted content from our systems. One honest caveat, stated in the Terms as well: a fingerprint already anchored to a public blockchain is permanent and public by design — though it reveals nothing about your content and nothing recoverable stands behind it after a shred.

Your rights and questions

Ask us anything about your data — including access, correction, export (built into the product: your notebook exports at any time, encrypted or readable, no exit fees), or deletion — at hello@leolog.io. We answer as the small team we are: quickly and specifically.

These commitments are written in plain language on purpose and reflect how LeoLog actually operates today, under the operative Terms of Service. A formal privacy policy in legal form, reviewed by counsel like our Terms, will be published as LeoLog grows; nothing in it will weaken what is promised here.