Last updated: 2026-11-04
Custody Journal ("we", "our", "the app") is designed with privacy as a foundational principle. This policy explains exactly what the app does and does not do with your information.
Custody Journal does not require you to create an account, sign in, or provide an email address to use the app. There is no server-side user database.
All information you enter into Custody Journal — including child profiles, custody exchanges, wellbeing entries, communications, expenses, photos, and receipts — is stored entirely on your device using Apple's SwiftData framework. Preferences such as the selected child, reminder timing, App Lock settings, review-prompt history and cached subscription access are kept in on-device UserDefaults. The App does not automatically upload those records to a developer-operated server. Files you explicitly export or share, Apple services and support correspondence are handled separately as described below. Generated PDF and CSV files are written to the App temporary directory before sharing. Separate exports use separate files. These readable copies are not encrypted App backups, and may remain until the operating system clears temporary storage; deleting a source record does not erase an already generated file or a recipient copy. A failed PDF export is not offered for sharing; removing an incomplete temporary file is attempted but is not guaranteed if file removal fails.
In version 1.4 and later, if a form cannot save, the information you entered and photos you selected stay on the open form so you can try again. Temporary entries and photos may be lost when you close the form or the app. They are not a backup.
When you edit an existing child profile, changes to the name and notes may save automatically, even if you close the editor without tapping Save. Date-of-birth changes and adding, replacing or removing a profile photo take effect only after a successful Save.
Apple device backups may include local Custody Journal records according to your settings and successful completion. Recovery requires a usable saved copy and Apple's process; enabling backup alone does not guarantee recovery of every record or original attachment. We cannot read or restore those backups. CSV and PDF exports are readable copies, not complete restorable App archives, and Restore Purchases restores eligible access rather than custody records.
Custody Journal can optionally attach GPS coordinates to custody exchange records when you tap "Log Exchange" and enable GPS tagging. Location is requested only at that moment and only while the app is in the foreground. Custody Journal does not track your location in the background and does not transmit your location to any server. You can deny location permission at any time and still use the app; exchanges will save without GPS coordinates.
Custody Journal uses the system Photos picker to attach the images you select to supported records. The current App does not offer in-app camera capture and does not require full-library read permission. Selected copies are stored in the App's local records. The free wellbeing-entry allowance supports photos; creating communication and expense records requires Pro. Existing records and attachments remain available for viewing, editing and deletion without an active subscription. Apple may retrieve an iCloud item before import; reports or other files leave the App when you choose a sharing destination.
Child profile photos are optional. You can add, replace or remove the selected copy in the child profile editor without a subscription. Removing a profile photo clears it from the saved profile; it does not delete the original from the system photo library, an earlier backup or an independent copy, and does not guarantee immediate physical erasure of database storage.
Custody Journal may schedule local notifications on your device to remind you of upcoming custody exchanges. These notifications are handled entirely by your device's operating system. No notification content is transmitted through our servers. Version 1.4 requests permission when you choose a reminder setting or save an upcoming exchange with reminders enabled, rather than on Home. Notifications can show the child name, exchange time and location outside App Lock; control previews in device Settings.
If you enable app lock, Custody Journal uses Apple's LocalAuthentication framework on-device. The biometric match is performed by your device's Secure Enclave; the biometric data itself is never sent to us or made available to the app.
With App Lock enabled, version 1.4.2 and later place an opaque cover over the App window when its scene actually enters the background, keep that cover during background return checks, and require successful authentication before showing a locked journal. The selected immediate, 30-second or 5-minute delay still determines when a real background departure requires another authentication. Temporary foreground interruptions, including notification or location permission alerts, photo selection, rating prompts and purchase panels, do not cover an unlocked journal or start another lock cycle. A journal that is already locked stays covered until authentication succeeds.
This cover is intended to obscure journal content in background snapshots and while switching apps. Older installed builds may briefly show the previous page or an earlier snapshot before the lock cover appears. App Lock does not erase existing screenshots, earlier system snapshots or independently saved copies. Widgets and notification previews remain outside App Lock as described separately.
Custody Journal offers optional auto-renewing subscriptions for access to Pro features. Subscriptions are processed by Apple's StoreKit through your Apple ID. We do not receive your payment information. Apple provides Custody Journal with an anonymous subscription entitlement only.
Custody Journal does not use analytics SDKs, tracking pixels, advertising identifiers, or any third-party service that would report your behavior. The app has no crash reporting service and no user behavior telemetry.
Custody Journal is intended for use by parents or guardians as a personal documentation tool. It is not directed to children under 13. The app does not collect personal information from children. Information about a child is entered by the adult user and stored locally, subject to the user-directed exports, device backups, widgets and notification visibility described in this policy.
In version 1.4 and later, if a deletion fails, the affected records remain available so you can retry.
Deleting a child profile removes that profile and its stored profile image after a successful save. Exchanges, expenses, wellbeing records and communication history are separate records linked by identifiers; deleting the profile does not cascade-delete that history or its attachments. Manage those records separately. There is no Recently Deleted or complete database-archive import; a shared PDF or CSV is not restoration of the complete journal.
In version 1.4.1 and later, PDF and CSV exports require a selected child profile that still exists. A missing or deleted selection is rejected rather than combining retained histories. Creating a new profile does not reconnect records retained under a deleted profile identifier. Communications without a child association remain shared entries in exports for a valid selected child.
In version 1.4.1 and later, the Free Preview PDF contains exchange records, their summary and parenting-time estimates; it excludes wellbeing, communication and expense counts or summaries. The full evidence report and CSV export remain Pro features. Earlier App builds may include those additional summaries in a Free Preview PDF or combine retained histories when no child profile is available. Files you already exported keep their original contents.
Removing the App normally removes its local container, not independently kept original media, exported files, recipient copies or older backups. Manage those copies separately. Device-backup recovery requires a usable completed backup; the developer has no record archive to retrieve.
If we update this privacy policy, the revised version will be posted at the same URL. Continued use of the app after such an update indicates acceptance of the revised policy.
Custody Journal's widget displays locally prepared summaries of app records. The app and its widget exchange the relevant summary and preferences through an on-device shared container; this is not a developer-operated record upload. Information displayed by a widget can be visible to people able to view the Home Screen or Lock Screen where it is placed. Use the widget and device display settings to control that visibility. Screenshots and independent copies remain separate from the records you later edit or delete.
These legal pages are hosted on Vercel. Opening a page sends ordinary request information, such as the IP address, browser information and requested URL, to the host for delivery and security; see Vercel’s Privacy Notice. This website request is separate from App record storage. If you email support, we receive the address and information you choose to send so we can respond. Send only the details needed for that request.
Questions about this policy? Email captainlongevity@gmail.com.