Log For Your Log

Privacy Policy

Effective October 19, 2026

Log For Your Log is built privacy-first. This page is the whole story, in plain language. It covers the iPhone app and the Android app. The Android app has its own section below, Android app. It is smaller than the iPhone app, so the sections about photo food logging, poop photo analysis, Ask Poopy, partner sharing (Couples), purchases, crash reports, anonymous usage events and leaderboards describe the iPhone app only. The optional account and poop photo analysis are new in version 1.2 of the iPhone app, and optional sync is newer than that. If you use an earlier version, the sections about them do not apply to you.

The short version: your logs stay on your device unless you turn on sync. Sync is off until you turn it on, and signing in does not turn it on. A few things can leave your device: a meal photo you choose to scan, a poop photo you choose to analyze with Pro, questions you choose to send to Ask Poopy (with a few averages only if you switch that on), your sign-in details if you connect an Apple or Google account, your logs, settings and progress if you turn on sync, a few summary items you choose to share with a partner if you pair up in Couples, crash reports, anonymous usage events unless you turn them off (in the EU, EEA, UK and Switzerland, only if you allow them), subscription checks, and leaderboard scores if you join. Keepsake photos never leave your device. Apart from sync, none of these include your saved log entries or notes. Using Android? The Android app section below says exactly what that app does. It leaves out the photo, Ask Poopy, Couples, purchase, crash report and usage event items above.

Your logs stay on your device unless you turn on sync

Everything you log, including bowel entries, meals, mood, hydration, notes, and keepsake photos, is stored on your iPhone using Apple's on-device database. If you never turn on sync, we hold none of it: we have no copy of your log history, and signing in to an optional account does not upload, back up, or sync it. If you turn on sync, your logs, settings and progress are also stored on our servers, as described under Sync below. Keepsake photos always stay on your iPhone. We do not show ads and never sell your data. The Android app works the same way, with your logs stored on your phone; see Android app below.

Android app

Log For Your Log is also available on Android, from Google Play. This section says what the Android app (version 1.0) does. Everything else on this page that mentions iPhone, Apple or the App Store describes the iPhone app, and where the two differ, this section is the one for Android. The Android app has no photo food logging, no poop photo analysis, no Ask Poopy, no Poopy Pro or in-app purchases, no Couples partner sharing and no widgets. Sign in with Apple and Game Center are Apple services and are not part of it. So the sections on this page about those, and about crash reports and anonymous usage events, do not apply to Android. The Android app is for adults 18 and older.

Your logs stay on your phone. You never need an account to use the Android app. Everything you log, including poop, meal, check-in, water, routine and note entries, plus your settings and reminders, is stored on your phone. If you never sign in, your logs never leave your phone and we hold none of them. The one request the app makes without an account is when you open Settings, to ask our server which account features are available. It carries no sign-in, no identifier and none of your logs, though like any internet request it reaches our server with your phone’s IP address. Reminders are notifications created on your phone, and nothing is sent to us for them. Export writes a JSON file of your logs, including notes, on your phone, and you choose where to save or share it. We do not receive it. The app opts out of Android’s automatic app backup, so Google Drive backup never holds your logs.

Google sign-in (optional). You can connect a Google account in Settings, on the Back up and sync card. Android offers Google sign-in only. It is needed only for Back up and sync, and signing in does not turn sync on. Google’s sign-in page opens in your phone’s browser tab, the app never sees your Google password, and the app sends Google nothing from your logs. Sign-in runs on the same shared Kinori Labs sign-in service described under Accounts are optional (Apple or Google), built on Supabase Auth and hosted on our servers (supabase.kinorilabs.com). We receive your account id and the email address, name and profile picture link your Google account shares. The sign-in service also keeps standard security records, such as when you signed in and from which IP address. Log itself keeps a small record that your Kinori identity is connected to Log. Your account is never used for advertising or tracking.

Back up and sync (optional). Back up and sync is off until you turn it on in Settings, on the Back up and sync card. When it is on, these are sent over HTTPS, which encrypts them in transit, to servers Kinori Labs operates (supabase.kinorilabs.com), and stored there linked to your account, so you can use them on your other devices:

Reminders and notification choices stay on your phone, and the Android app has no photos and no Ask Poopy conversations to sync. You can turn sync off at any time; your logs then stay on your phone and stop updating elsewhere. When you delete an entry, its content is removed from our servers and a content-free marker remains for up to 180 days so your other devices learn about the deletion. Synced logs and settings stay until you delete them or delete your account. Rate-limit counters, which help us stop abuse, are kept for 2 days. Server request logs, which can include your IP address, are rotated on a regular schedule. Deleted data can remain in our encrypted backups until they rotate out.

What the Android app does not do. It shows no ads and has no ad SDK or advertising ID, and we never sell your data. This version has no analytics and no crash reporting, and no third-party SDK receives your data. It does not ask for your location, contacts, camera, microphone or photos. Your gut, mood and hydration data is sensitive. On Android it stays on your phone unless you turn on Back up and sync. If you do, it is stored on servers we operate, linked to your account, used only to run sync, and never used for advertising or sold to data brokers.

Deleting your data on Android.

If you cannot open the app, you can ask for your account to be deleted at logforyourlog.com/account/delete/ or by email to [email protected]. That page covers Android and iPhone, and a request by email is finished within 30 days.

Accounts are optional (Apple or Google)

You never need an account to use Log For Your Log. You can choose to connect one with Sign in with Apple or with Google, during setup or later in Settings, then Account. If you sign in with Google or Apple, we receive your account id and the email address and name your provider shares. Sign-in runs on our own sign-in service, built on Supabase Auth and hosted on our servers (supabase.kinorilabs.com). It is shared by Kinori Labs apps, so one sign-in works across them: if you already use the same Apple or Google account with another Kinori Labs app, you connect to the same Kinori identity.

What we receive and keep. When you connect, our sign-in service stores a unique account identifier from Apple or Google and the email address they share with us (with Apple this can be a private relay address). With Google, it also stores the name and profile picture link on your Google account. We do not ask Apple for your name. The sign-in service also keeps standard security records, such as when you signed in and from which IP address. Log itself keeps a small record that your Kinori identity is connected to Log and which provider you used. If you connect with Apple, Apple also gives us a sign-in token. We store it encrypted on our server and use it only to revoke Log's access with Apple when you delete your Log account.

How it is used. Signing in on its own identifies you for sign-in. It does not upload any of your logs and it does not turn on sync. Your account is not linked to your crash reports, usage events, photo analysis, or Ask Poopy questions, and it is never used for advertising or tracking. While you are signed in, your account id is also given to our subscription provider, RevenueCat, as your subscriber id, so Pro can follow you to your other devices.

Your choices. In Settings, then Account (the same controls also appear under Data & Privacy):

You can also email [email protected] to ask about or delete your account information.

Sync (optional)

Sync is off until you turn it on. Signing in does not turn it on. When you turn it on, the app first shows what syncs and what never does, and nothing leaves your device until you agree. When it's on, your logs, settings and progress are stored on servers Kinori Labs operates, linked to your account, so you can use them on your other devices.

What syncs. Poop, meal, check-in, water, routine and note entries; your settings (such as the name you gave Poopy, which logs are switched on, your water goal and your week start); and your progress (such as achievements, streak freezes, and Learn, Toolkit and Ask Poopy counters). Each synced entry is stored with a random device id, so your devices can settle which edit is newer. Photos you attach to entries, your Ask Poopy conversations and your reminders never sync.

Before anything is sent. If you already have logs on this iPhone, or logs in your account from another device, you choose what happens: back up this iPhone's logs, combine them with the account's logs, or use only the account's logs. If you sign in to a different account on this iPhone, the logs from the previous account are removed from this iPhone first, so accounts never mix.

Turning it off and deleting. You can turn sync off at any time; your logs then stay on this device and stop updating elsewhere. When you delete an entry, its content is removed from our servers and a content-free marker remains for up to 180 days so your other devices learn about the deletion. Delete all data, when sync is on, also deletes your synced logs on all your devices; your account and settings stay.

How long we keep things. Synced logs, settings and progress stay until you delete them or delete your account. Content-free deletion markers stay up to 180 days. Rate-limit counters, which help us stop abuse, are kept for 2 days. Server request logs, which can include your IP address, are rotated on a regular schedule.

Partner sharing (Couples)

Couples is optional and for adults 18 and older. It needs a Log account. Two people pair with a one-time link or code, and both confirm they are 18 or older. Nothing is shared until you switch it on, item by item, and every item starts off. The six items are whether you went today, how many trips, a time-of-day bucket such as Morning, a friendly word for the day's form, your streak and a playful daily score. Your partner never sees your notes, symptoms, meals, photos or exact times. Your phone works out these summaries, and our server checks your choices again before your partner can see them.

What we store. Your summaries and reactions are readable only by your partner. A pairing invite is stored only as a hashed code. We also keep the time you confirmed you are 18 or older, and the version of the confirmation, while you are paired. If you add a Home Screen or Lock Screen widget, we store a hashed widget access token, and the widget reads a limited snapshot of your partner's latest summary that is kept in a shared app container on your iPhone.

Unpairing and deleting. Either of you can unpair at any time, without the other person. Unpairing deletes everything shared between you right away, including summaries, reactions and widget tokens, and your partner's widget stops showing anything about you. Deleting your Log account unpairs your partner and deletes the same things. If you choose to block a person when you unpair, we keep a block record with the two account ids until the person who blocked deletes their account. Summaries and reactions are for fun and are not medical advice.

How long we keep Couples data:

AI features and your permission

Three features send data to an AI provider: meal photo scanning, Pro poop photo analysis and Ask Poopy. Before the first one is used, the app shows a short screen that says what is sent and who receives it, and nothing is sent until you tap Continue. If you tap Not now, nothing is sent and you can log by typing or by hand.

What is sent: for meal photo scanning and poop photo analysis, the one photo you choose; for Ask Poopy, the question you type and the last few messages of the conversation, plus a few averages and food and symptom names only if you switch those on. Notes, photos you did not choose and entry dates are never sent.

Who receives it: our server passes each request to OpenAI (OpenAI, L.L.C., United States) or Google (Gemini API, Google LLC), chosen by our server configuration (OpenAI normally, Google as a backup). They process the request only to return the answer or estimate. We use their API services, not their consumer apps. They may keep API data for a limited time for abuse monitoring, under their own API terms, which require them to protect it. Our server does not store the photo, question or answer.

You can turn AI features off at any time in Settings, then Data & Privacy, with the Send photos and questions to AI switch. Turning it off stops all three features and turns Ask Poopy off until you allow it again. Delete all data also clears your choice, and the app asks again before sending anything.

Photo food logging

If you choose to log a meal by photo, that photo is sent to our server and passed to a third-party AI vision service, OpenAI or Google, chosen by our server configuration (OpenAI normally, Google as a backup), so the food can be identified and its calories and fiber estimated. We do not store the photo or the result, and neither is linked to you or to an account you connected. OpenAI and Google may keep API data for a limited time for abuse monitoring, under their own terms. Each scan request carries a random identifier for your install, used only to limit abuse and not linked to who you are. Our server also uses the request’s IP address to apply daily limits.

Photo food logging is always your choice. If you never use it, no meal photo leaves your device.

Poop photo analysis (optional, Poopy Pro)

Poopy Pro can estimate a few visible details from a photo of your poop. Nothing is sent automatically: choosing AI photo as your default, taking a picture, or picking one does not send it. After you have allowed AI features, for each photo you also agree to share that photo for analysis, then tap Analyze photo. Only then is that one photo, compressed, sent to our server, which passes it to a third-party AI vision service, OpenAI or Google, chosen by our server configuration. It returns an estimated Bristol type and color and, when they are visible, an apparent texture and appearance. Your notes, symptoms, dates, and other log details are not sent.

Our server handles the photo in memory only for as long as it takes to get the estimate. We do not store or log the photo or the result, and neither is linked to your identity or to an account you connected. OpenAI and Google may keep API data for a limited time for abuse monitoring, under their own terms. As with meal scans, each request carries the random install identifier, and our server uses the request’s IP address to apply daily limits. Pro includes up to 30 analyses a day, subject to shared service limits.

When an estimate comes back, the app saves it as a new entry on your iPhone, with the estimated type and color and a short note of the apparent texture and appearance. You can edit anything. The photo itself is kept with the entry, on your device only, if you switch on "Keep analysis photo with this entry", which starts off. Estimates can be wrong. The feature does not check for blood or other symptoms and does not diagnose any condition. Manual poop logging stays free and never sends a photo.

Ask Poopy (optional)

Ask Poopy answers everyday gut-health questions. It stays off until you allow AI features and agree to how it works. Answers that include health information link to reputable sources, such as NIDDK, the NHS and the Cleveland Clinic, under the answer. When you ask a question, the app sends your typed question and the last few messages of the conversation to our server, which passes them to OpenAI or Google, chosen by our server configuration, to write an answer. If you switch on "Use my recent stats", it also sends a few averages, such as visits per day, your most common type, water and fiber per day, and your streak. Food and symptom names from your Insights patterns are added only if you also switch on "Include food patterns". It never sends your notes, your photos, or the dates of your entries. The app checks each question first, and if it looks urgent, such as a mention of blood in your stool, it shows guidance to check with a doctor instead of sending it. Our server runs a similar check on the questions it receives.

We do not store your questions, the answers, or your stats, and they are not linked to you or to an account you connected. OpenAI and Google may keep API data for a limited time for abuse monitoring, under their own terms. Each request carries the same random install identifier used for photo requests, only to limit abuse. The conversation stays on your device (Poopy Pro keeps up to the last 50 messages there). You can delete it, or turn Ask Poopy off, in Settings, then Data & Privacy. Ask Poopy gives general wellness information, not medical advice.

Crash reports

If the app crashes, stops responding, is closed by iOS for taking too long or using too much memory, or hits certain processing errors, it can send a technical report to Sentry so we can fix it. A report contains the app version and build, the iOS version, the device model, the type of error, and a stack trace. Before sending, the app removes user identity, request data, activity trails, and error text. Screenshots, screen recordings, logs, and performance tracing are off, and a report never contains your logs. Sentry also receives basic session data, such as when the app opens and closes and whether a session ended in a crash, tied to a random install id that is not linked to you or to any account you connect. Crash reports and session data are separate from the usage events choice below and stay on. Caught processing errors use fixed categories, with at most five reports per category per device per UTC day and a 30-minute gap for the same category and component. These limits stay after deleting local logs, so deletion cannot bypass the cap. Sentry may process your IP address to deliver the report.

Anonymous usage events

Anonymous usage events are on by default, and you can turn them off any time in Settings, then Data & Privacy, with the Share anonymous usage switch. In the European Union, the European Economic Area, the United Kingdom and Switzerland, the app asks first: it asks you once, and until you say yes no usage event is queued or sent. The app decides this from your iPhone's region setting, never from your IP address, and also asks first when the region is unknown. When usage events are on, the app sends a few anonymous usage events to PostHog, such as onboarding steps, paywall views, purchase and restore outcomes, app sessions, which kind of entry you logged (for example a meal or a note; a bowel entry is reported only as a log, and the time of these events is rounded to the hour), or that Ask Poopy answered a question (never the question itself). Sync adds a few more fixed events: that sync was turned on or off, that a sync problem happened (with a fixed reason such as network), which choice you made when combining logs, and that an account was deleted. Couples adds a few more fixed events: that an invite was created, that you paired or unpaired, which of the six fixed reactions you sent, and which widget size was added. They never include your partner or any account id. Event names and values come from fixed lists and include the app version. They are tied only to a random analytics identifier, separate from the identifier used to limit abuse of photo and Ask Poopy requests, from purchase identifiers, and from any account you connect. They contain no log content, notes, photos, questions, or answers. The local queue accepts at most 100 events per device per UTC day, holds up to 200 pending events for at most seven days, and sends small batches with limited retries. Delete all data, or turning the switch off, clears events still waiting on your device and replaces the analytics identifier; it does not delete reports already received by a provider. Delete all data keeps your choice. We turn off location lookup and person profiles for analytics, and our crash and analytics providers may process your IP address to deliver requests. These events are not used for advertising, not sold, not linked to your identity, and not used to track you across other apps or websites.

Leaderboards (optional)

Leaderboards are off unless you join them. If you do, the app sends two numbers to Apple's Game Center: your best streak and how many logs you made this week. They appear under your existing Game Center name. No log content is ever sent, so nothing you log, no notes, symptoms, or photos. Game Center is run by Apple under Apple's privacy policy. We do not receive these scores on any server of ours and do not link them to anything else. You can leave at any time in the app, and remove scores already posted in your Game Center settings.

Purchases

Poopy Pro subscriptions are billed through your Apple ID. Apple handles the payment, and we never see your payment details. To check your subscription status we use RevenueCat, which receives an identifier, your purchase history and your IP address. It never sees your logs. If you are not signed in, the identifier is random. If you are signed in, it is your account id, so Pro can follow you to your other devices; deleting your account asks RevenueCat to delete that record.

Health information

Your gut, mood, and hydration data is sensitive, and we treat it that way. Your saved logs stay on your device and are not shared with anyone, including us, unless you turn on sync. If you do, they are stored on servers we operate, linked to your account, used only to run sync, and never used for advertising or sold to data brokers. Apart from sync, health-related information leaves your device only when you choose to send it: a poop photo you agree to share for analysis, or an Ask Poopy question and, if you switch them on, a few averages and food and symptom pattern names. We do not keep any of that on our server. If you pair with a partner in Couples, the summary items you switch on are also stored on our servers, readable only by that one partner, as described under Partner sharing (Couples).

What we collect

Apart from the items above, nothing. If you connect an account, we hold the sign-in details described under Accounts are optional. If you also turn on sync, we hold your synced logs, settings and progress as described under Sync. If you never turn on sync, we hold none of your logs. If you pair with a partner, we hold the pairing and the summary items you share, as described under Partner sharing (Couples). We do not sell your personal data or share it for advertising.

Where your data is stored

On servers we operate. We do not use iCloud to store your health logs. We do not sell your data, use it for advertising or share it with data brokers.

Deleting your data

This section describes the iPhone app. The Android steps are under Android app above, and logforyourlog.com/account/delete/ covers both.

Delete all data. In the app, go to Settings, then Data & Privacy, then Delete all data. This permanently erases everything on your device, including the Ask Poopy conversation. It also clears your Couples choices on this iPhone, such as the name you gave your partner; your pairing stays until you unpair. If sync is on, it also deletes your synced logs on all your devices; your account and settings stay. Deleting the app also removes everything on your device.

Delete cloud data. In Settings, then Account, this permanently deletes your synced logs, settings and progress from our servers, right away. Logs on this iPhone stay, sync turns off, and your account stays.

Deleting your account. Delete your Log account in Settings, then Account, at any time. It is immediate and automatic: we delete everything Log stores about you on our servers in one step, including synced logs, settings and progress. It also unpairs your partner and deletes your pairing, summaries, reactions and widget tokens. If you used Sign in with Apple, we revoke Log's access to your Apple ID, and we ask our subscription provider to delete your purchase record. If either of those steps can't finish right away, we keep retrying automatically. We keep only a small content-free marker that the account was deleted (the account id, the time and a count), so a phone that was signed in before can never upload to it again. Your subscription is billed by Apple; cancel it in your Apple ID settings to stop renewals. Because your Kinori Labs sign-in is shared with our other apps, the sign-in itself (email, name and provider id) is not removed by deleting Log; Log keeps nothing linked to it, and signing in again starts an empty Log account. Deleted data can remain in our encrypted backups until they rotate out. Logs on your device are only deleted if you choose that option.

Children

Couples is for adults 18 and older. You confirm that you are 18 or older before you pair. The Android app is also for adults 18 and older.

Changes

If this policy changes, the updated version will appear on this page and inside the app, with a new effective date. Before any change that sends more of your data off your device, we will ask for your consent in the app.

Contact

Log For Your Log is made by Kinori Labs Inc. Questions, or a request about your data? Email [email protected].