In effect from 9 August 2026.
We do not share your data with third parties. Nothing is sold, rented, or handed to anyone outside the building that keeps the log book. There is no analytics, no advertising, and no tracking of any kind in this app — not switched off, not present.
Officers are the people at the security desk who use the app. Residents are the people whose parcels get recorded. Residents have no account, no password, and nothing to sign up for — the app holds no resident identities at all.
The building that runs the desk decides what gets recorded and why. We make the software and run the server it syncs to.
The confirmation is optional in the ordinary sense: an officer can record a handover without any of the three, and the building decides whether to ask for one. A recording or photo is used for that record and nothing else — never to recognise a face, match a voice, or identify anyone anywhere else.
Nobody. The app talks to one server — the one the building's operator configures — and to nothing else. This website loads nothing from anywhere else either: no fonts, no content network, no tag manager, no cookies. Your log book is visible to the officers your building has given access to, and to no other building.
If we are ever compelled to disclose something by a valid legal order, we will say so here and, where we are permitted to, tell the building first.
The app asks for the camera, the microphone or the photo library only when an officer chooses that way of confirming a handover, and uses each only for the recording being made at that moment. Declining the permission disables that one confirmation method and nothing else.
On the device. The log book is stored on the device so it works in a basement mail room with no signal. Once an apartment has had nothing outstanding for ninety days, its entries leave the device.
On the server. The log is append-only. A mistake is corrected by recording the correction, and an entry made in error is voided rather than removed, because a record that can be quietly erased is not evidence of anything. Entries are therefore kept as the building's record of what happened, along with any signature, recording or photo attached to them.
Server logs. The server keeps ordinary web request logs, which include the IP address a request came from, briefly, to spot abuse and diagnose faults. They are not used to build a profile of anyone. When someone guesses at an invite code, the address is counted in memory to slow the guessing down; that counter is never written to the database and is lost when the server restarts.
Officers can ask us what is held about them, ask for it in a portable form, or ask for their access to be removed. Write to the address below.
Residents should speak to their building. The entries are the building's record, and the building decides what happens to them; we will help the building act on any request it passes to us.
The app is a tool for a workplace and is not directed at children.
If this policy changes, the date at the top changes with it. If a change is significant we will say so on this page rather than quietly reword it.
