HostLog is published by an independent iOS developer (Apple Developer Team ID ZM8LF8494F). For any privacy-related question, write to captainlongevity@gmail.com.
We do not collect, transmit to our servers, sell, share, or analyze:
All record data you enter is stored locally on your iOS device using Apple's SwiftData framework. This data may be included in your standard iOS device backup (iCloud Backup, or iTunes/Finder backup) if you have device backup enabled, subject to the availability and successful restoration of a usable completed backup. We do not have access to your device backups.
Device-backup contents and recovery depend on your system settings, a successfully completed usable backup and Apple’s restoration process; enabling backup alone does not guarantee recovery of every record or original file. We cannot retrieve or restore your device backups.
From Settings > Your data, Export JSON backup creates a portable JSON copy of the supported property, stay, damage, inspection, deadline, communication and Recently Deleted records. Original photo and attachment files are not included. The updated export stops and reports an error if a record query, encoding, folder creation or file write fails; it does not substitute empty records for a failed query or present a partial export for sharing. A genuinely empty archive can still be exported. Each successful export creates a separate file without replacing earlier archives. Only the completed file opens in the iOS Share Sheet for the destination you choose; nothing is sent to us. Import does not automatically create a safety backup, so make and check any copy you need before importing.
HostLog processes records locally on your device. Some capabilities require Pro, while privacy and reminder controls are free for everyone:
HostLog offers optional Pro access through Apple's StoreKit 2: a monthly auto-renewable subscription and a one-time Lifetime non-consumable purchase. Existing annual subscribers keep access while their verified legacy subscription remains active, but Annual is not offered to new customers in version 1.2. When you purchase, restore, load products, or when the app verifies your entitlement, your device communicates directly with Apple's servers. HostLog receives only the entitlement status and purchase identifiers needed to unlock Pro. We do not see your Apple ID, payment method, billing address, or transaction history. Apple's handling of purchase information is governed by Apple's Privacy Policy.
HostLog does not communicate with Airbnb, VRBO, Booking.com, or any rental platform's servers, ever. Platform names that appear in the app (when you tag a stay's source platform) are user-selectable tag values only — not API calls, not listing scrapers, not message readers. We do not access your platform inboxes, Resolution Center messages, payouts, calendar, listing details, or guest profiles.
You can revoke any of these permissions at any time in iOS Settings > HostLog.
HostLog is not directed to children under 13. We do not knowingly collect any information from anyone, including children. The app's age rating reflects this.
Because all record data is stored on your device, you control retention completely. Removing the App can remove its local container; exported archives, original system media, recipients' copies and device backups remain separate. There is no remote copy on our servers to delete — we have no servers.
The app does not transfer your data internationally because it does not transfer your data to any servers we operate. Your records are on your device, governed by Apple's standard iOS data-handling practices. The app is published in English and is primarily marketed in North America.
If we ever change how the app handles data, we will update this policy and surface the change in the app before you can use any new feature that involves the change. The "Last updated" date at the top of this page reflects the most recent revision.
The JSON archive contains structured records and references to locally stored photo and attachment paths, but does not bundle those original files. It is not password-encrypted. Photos held only in HostLog's app container are not automatically copies in Apple Photos; do not assume they will transfer with the JSON file. Import adds supported missing records and updates supported fields on records with matching identifiers; matching records are not simply skipped. The updated import validates the complete JSON archive before changing records. Unsupported format versions, invalid or duplicate record identifiers, invalid parent references and non-empty parent references missing from the file reject the whole import. UUID letter case is normalized. An explicitly empty parent link is supported and can detach a matching record from its former parent. References are resolved from the imported archive, not silently substituted from the current device. Every supported existing record type is then read; if an imported identifier matches multiple local records, the whole import is rejected without changes. Existing duplicates are not automatically repaired. Successful import counts include only the validated records added or updated. If any read fails, it stops without inserting or updating records. Import edits and insertions use one checked save; a failed save restores affected field values and relationships and removes new objects from that attempt while preserving earlier pending input. This does not repair duplicates from an older import or recover absent original media. Local records absent from the file are not removed by this import. A file you save or share leaves the app for the destination you select, and that destination handles the copy. Keep the original media or an independently verified device backup before moving or deleting the app. We cannot reconstruct absent files from path references.
HostLog's widget displays locally prepared summaries of app records. The app and its widget exchange the relevant summary and preferences through an on-device shared container; this is not a developer-operated record upload. Information displayed by a widget can be visible to people able to view the Home Screen or Lock Screen where it is placed. Use the widget and device display settings to control that visibility. Screenshots and independent copies remain separate from the records you later edit or delete.
Privacy questions: captainlongevity@gmail.com
These legal pages are hosted on Vercel. Opening a page sends ordinary request information, such as the IP address, browser information and requested URL, to the host for delivery and security; see Vercel’s Privacy Notice. This website request is separate from App record storage. If you email support, we receive the address and information you choose to send so we can respond. Send only the details needed for that request.
The updated App saves a separate snapshot for each record cascade-deleted with a property, stay or damage entry, in the same checked database operation. New stay and damage snapshots retain their full supported fields and media-path references. Recovery is per record: restore the property, stay and damage parents before their children. Missing or ambiguous parents, duplicate identifiers, unsupported payloads or a failed save leave the snapshot for retry instead of linking it to another record or overwriting existing data. Older snapshots remain readable, but missing fields and children that an older version never saved cannot be recreated. Snapshots do not duplicate original media bytes. Expiry purge runs when Recently Deleted opens, rather than on a guaranteed timer. Expiry purge and Delete Forever first queue known file paths, then commit snapshot removal; cleanup removes only unreferenced queued files. Failures can retain files and are retried during normal App startup or with Retry attachment cleanup. Unreadable reference data postpones removal. Original system photos, shared exports and earlier backups remain separate.
The updated App pauses the normal record interface if its persistent database cannot be opened and only a temporary in-memory store is available. New recording and editing through that interface are blocked. The App keeps the existing database and attachment files rather than treating the temporary empty store as your archive. Database-dependent startup work in that interface is paused; previously scheduled reminders, widget snapshots or independent copies may remain.
Older versions may have written records to a separate fallback database. The updated App leaves those files in place and does not automatically merge, replace or delete them. Check available device storage, close and reopen the App, and contact support before deleting or reinstalling it. This recovery screen is not a backup, a repair guarantee or an automatic restoration of missing records. Older installed versions may behave differently until updated.
The updated property, stay, communication, inspection and damage editors report failed saves and retain entered fields and selected photos where applicable. Original files selected for removal are queued rather than erased before saving. Damage records and their automatically prepared deadlines are committed together; reminder updates follow successful saving. Snapshot creation, deletion, restoration and permanent removal must save before the action reports success. A local filename-only cleanup journal is prepared before the database change. After a successful save, cleanup checks saved references in a separate database context and removes only queued, unreferenced files. Files still referenced by other records or retained deletion snapshots are kept. Failed cleanup is retried during normal App startup and through Retry attachment cleanup; unreadable references or journal data postpone removal. This is not guaranteed immediate or secure erasure and does not scan unknown older files. If a discarded new file cannot be added to the journal, its name is retained only in memory for retry while the App stays open; interruption can leave an untracked draft file.
Earlier exports should be checked before relying on them; the App update cannot repair an already saved incomplete JSON file. Older installed versions may use different save or cleanup ordering and may not offer these retry controls.