FacilityLog is published by an independent iOS developer (Apple Developer Team ID ZM8LF8494F). For any privacy-related question, write to captainlongevity@gmail.com.
The app does not automatically send the following records to the developer for storage, advertising or analytics. User-selected exports, optional system services and support messages are handled as described in this policy:
We do not operate an app-record server. The app does not automatically send these fields to us; information you choose to include in a support message is an exception.
FacilityLog does not share any records with nursing home chains (Brookdale, Sunrise, Atria, Five Star, Genesis HealthCare, Ensign, or any other), assisted living operators, memory care providers, CMS, HHS, state Long-Term Care Ombudsman programs, AARP, the National Consumer Voice for Quality Long-Term Care, the American Health Care Association, LeadingAge, state survey agencies, Adult Protective Services, law enforcement, or any government, advocacy, or research database. There is no advertising SDK, no analytics SDK, and no marketing-data partnership in the app. If a future release ever introduces any such integration, it will be strictly opt-in, with a clear in-app notice before any record leaves your device.
All archive data you enter is stored locally on your iOS device using Apple's SwiftData framework. This data may be included in your iCloud or Finder device backup if you have device backup enabled.
Device-backup contents and recovery depend on your system settings, a successfully completed usable backup and Apple’s restoration process; enabling backup alone does not guarantee recovery of every record or original file. We cannot retrieve or restore your device backups.
Several features process data locally on your device only:
FacilityLog stores records locally without CloudKit sync. Every user may export and restore a structured JSON archive from Settings > Privacy & Backup. Archives are generated on the device and contain sensitive care records and file-path references, not original attachment bytes. Protect exported files; there is no developer-hosted recovery copy. Apple device backup is separate and depends on your system settings.
Family-safe JSON export is free for everyone. It filters out power-of-attorney document paths, call-recording paths and raw photo bytes; it still contains sensitive record metadata. This is a file you choose to send, not a managed family account, recipient limit or live synchronization service. The receiving destination may retain a copy under its own rules.
The app also supports user-initiated structured provider-audit file exchange. Files are generated or read on your device through Files and the system share sheet; FacilityLog does not automatically send them to a service or receive the files itself. Review a file's contents and intended recipient before sharing. Family-safe export is not a complete restoration backup.
FacilityLog uses Apple StoreKit for a monthly subscription and a one-time non-consumable Lifetime purchase. Loading products, checking offer eligibility, purchasing, restoring and verifying access communicate with Apple. The app reads verified product and entitlement information, including expiration or revocation status where applicable, and keeps local access state. Apple processes payment; FacilityLog does not receive your payment-card details or Apple Account password. Current and supported historical purchase access depend on verified transactions. See the FacilityLog terms for the available plans and subscription handling.
You can revoke any of these permissions at any time in iOS Settings > FacilityLog.
FacilityLog does not predict facility-quality outcomes, recommend complaints, detect abuse patterns, calculate official severity scores, generate ombudsman or attorney letters, or perform any artificial-intelligence analysis on your archive. Incident types and severity ratings you record are your own characterizations and are stored as text and category tags without further processing. Many U.S. states have mandatory reporter laws requiring certain individuals to report suspected elder abuse, neglect, or exploitation to Adult Protective Services or law enforcement. FacilityLog does not report on your behalf to APS, law enforcement, CMS, state survey agencies, or any other authority. Whether and when to report is your decision and may be legally required in your state — consult an elder-law attorney or your state Long-Term Care Ombudsman for guidance.
FacilityLog is not directed to children under 13. The records typically logged in the app describe care provided to adult or elderly residents. The app has no child account or developer-operated record collection. Contact support if a child has sent personal information to us. The app's age rating reflects this.
You control retention completely. Selected database records are removed only after a successful save — FacilityLog uses hard delete with a mandatory confirmation alert, and there is no Recently Deleted recovery. Before deleting, you can export a free full JSON backup so a copy survives elsewhere. Deleting the app removes its local container; separately manage exported files, automatic snapshots you saved elsewhere and earlier device backups. A record deletion does not erase every previously saved copy. There is no remote copy on our servers for us to delete because we do not have servers. If you have an iCloud device backup, that backup may contain prior versions of the FacilityLog store — you can manage iCloud device backups via iOS Settings > [your name] > iCloud > Manage Account Storage.
The app is published in English and is primarily marketed in North America. The app does not route your archive through a developer-operated record server. Apple services, website hosting, support correspondence and sharing destinations may process information outside your region, as described in this policy.
If we ever change how the app handles data, we will update this policy and surface the change in the app before you can use the affected feature. The "Last updated" date at the top of this page reflects the most recent revision.
FacilityLog's widget displays locally prepared summaries of app records. The app and its widget exchange the relevant summary and preferences through an on-device shared container; this is not a developer-operated record upload. Information displayed by a widget can be visible to people able to view the Home Screen or Lock Screen where it is placed. Use the widget and device display settings to control that visibility. Screenshots and independent copies remain separate from the records you later edit or delete.
Privacy questions: captainlongevity@gmail.com
These FacilityLog legal pages are served by Vercel. Opening a page sends ordinary request information, such as IP address, browser information and the requested URL, to the host for delivery and security; see Vercel's Privacy Notice. These pages contain no advertising or analytics scripts. If you email support, we receive the address and information you choose to send to answer your request. Avoid including sensitive records that are not needed for that request.
The free full JSON export contains supported facility, incident, call, billing, meeting and document fields, including local photo, recording and document paths. It does not bundle those original files and is not password-encrypted. The family-safe export is a filtered sharing copy and is not a restoration backup. Keep original media separately.
When restoring a compatible full JSON archive, you may choose replacement, additive merge or cancel. Replacement removes the active records first; additive merge adds missing identifiers and leaves existing matching records unchanged. Missing original attachments cannot be rebuilt from paths. The App attempts a local pre-restore snapshot, but failure to create that snapshot does not block restoration. Keep an independent backup before replacement. Earlier local snapshots, exported files and device backups are separate from current records and may retain information you later delete.
Deleting a facility removes its linked incidents, calls, billing disputes and care-plan meetings; separate Document Vault records, settings, local snapshots and exported files are not all removed by that action. Deleting a document separately attempts file removal after its database save. Attachment-file deletion can fail, and cascade deletion does not guarantee cleanup of every original photo, recording or document file. Original system-library media and old backups are independent copies.
The updated App pauses the normal record interface if its persistent database cannot be opened and only a temporary in-memory store is available. New recording and editing through that interface are blocked. The App keeps the existing database and attachment files rather than treating the temporary empty store as your archive. Database-dependent startup work in that interface is paused; previously scheduled reminders, widget snapshots or independent copies may remain.
Check available device storage, close and reopen the App, and contact support before deleting or reinstalling it. This recovery screen is not a backup, a repair guarantee or an automatic restoration of missing records. Older installed versions may behave differently until updated.