WorkplaceLog is published by an independent iOS developer. For any privacy-related question, write to captainlongevity@gmail.com.
The App does not automatically upload the following information to us, sell it, or use it to train a model. User-selected sharing and voluntary support correspondence are handled separately:
Journal records use local SwiftData storage. Apple device backups may include the store and attachments depending on your settings and successful completion. We cannot access or restore those backups. Verify any recovery process before relying on it.
The current implementation checks database saves and keeps the editor open on failure, retaining form input for retry. Only fields changed in an editor are applied; unrelated pending changes are not globally rolled back. Cancel discards the current form draft rather than reverting other records. Unconfirmed employer setup and record editors use temporary in-memory form state; reopening a dismissed form does not restore an unsaved draft. The onboarding-complete preference is set only after the employer record saves. If the original App Group store cannot open, a recovery message is shown without creating an empty memory or alternate Documents database; existing files remain. Any older fallback files are retained and are not automatically merged. Do not delete or reinstall the App as a recovery step without a usable backup.
Image selection is prepared as a whole batch before entering the form’s draft. If any selected image cannot be read, that batch is not partially added: retry or clear the selection; previously accepted images remain. Save waits for the unresolved selection to be retried or cleared. Cancel discards staged form images; it does not delete originals in system Photos. Selected image bytes may retain embedded metadata. Existing saved attachments remain viewable and removable after paid access ends; adding new incident photos requires Pro, while the current HR complaint, retaliation and communication forms allow selected image attachments with their existing record limits.
Preferences, purchase-access cache, rating prompts and onboarding status use UserDefaults; the App Group also stores a numeric widget snapshot. These are separate from the journal database and are not protected by a separate App password or journal export. Optional anxiety, sleep, symptoms, therapy and medication entries are sensitive health-related user input even though no HealthKit permission or developer journal upload is used.
Features process data locally on your device only:
WorkplaceLog uses Apple StoreKit for a yearly subscription and a one-time non-consumable Lifetime purchase. Loading products, checking offer eligibility, purchasing, restoring and verifying access communicate with Apple. The app reads verified product and entitlement information, including expiration or revocation status where applicable, and keeps local access state. Apple processes payment; WorkplaceLog does not receive your payment-card details or Apple Account password. Current and supported historical purchase access depend on verified transactions. See the WorkplaceLog terms for the available plans and subscription handling.
WorkplaceLog does not request Camera, Microphone, Location, Contacts, Calendar, Health, or Bluetooth permissions. It has no reason to. You can revoke any granted permission at any time in iOS Settings > WorkplaceLog.
WorkplaceLog is not directed to children under 13. The app has no child account or developer-operated record collection. Contact support if a child has sent personal information to us. The App Store age rating is separate from this intended audience statement.
Individual record deletion commits the database change before reporting success; a failed delete retains the affected records for retry. Deleting an incident removes that record and its embedded attachment references, not other independent complaints, witnesses, communications or emotional logs. Deleting an HR complaint leaves separately stored retaliation entries; its old complaint identifier may no longer resolve. There is no normal workplace-wide wipe or Recently Deleted recovery control. SwiftData manages externally stored attachment payloads; successful row deletion does not certify immediate removal of every underlying file or prior backup. System Photos originals, temporary generated reports, exported files, recipients’ copies and device backups remain separate.
The free single-entry PDF can include that entry’s readable attached images and selected detailed fields; Markdown is another free text format. Pro combined Evidence/Timeline PDFs contain selected record fields and emotional summaries, omit embedded original images and various private notes/details, and are not complete backups. Pro CSV creates separate text tables for nonempty record types; images, the workplace profile, preferences and some fields are omitted. A failed CSV-table write prevents sharing a partial set, although an unsuccessful cleanup may leave temporary output. Generated PDF/CSV files are first written to the App’s temporary directory, where copies can remain until system or App cleanup; choosing a share destination sends a copy outside the App. No CSV/PDF import or complete journal-archive restoration is built in. Restore Purchases restores eligible access, not records. Apple device-backup recovery depends on a usable completed backup and its actual exclusions.
We recognize that documentation of workplace harassment, discrimination, or retaliation is among the most sensitive personal data imaginable — a user being identified by their employer as "building a case" can trigger immediate retaliation or termination. The design of this app reflects that: no account, no cloud, no AI, no analytics, optional free App Lock on a real background transition, neutral notification text, numbers-only widget, and a neutral app icon. If the app ever introduces a feature that would change how data is handled — for example, an opt-in cloud backup — we will update this policy and surface the change in the app before you can use that feature.
WorkplaceLog is a personal documentation tool, not a legal service. The employee-rights reference content in the app is general information sourced from EEOC.gov and public legal-education materials and does not constitute legal advice. For advice about your specific situation, consult a licensed employment attorney in your jurisdiction.
The App does not upload journal records to our own server. Apple services, user-selected sharing, website hosting and support correspondence may involve processing outside your region. The app is published in English and is primarily marketed in North America. US federal employment law (Title VII, ADA, ADEA, EPA) and state employment law are the frames of reference for the in-app rights guide and date-comparison calculator.
If we ever change how the app handles data, we will update this policy and surface the change in the app before you can use that feature. The "Last updated" date at the top of this page reflects the most recent revision.
Privacy questions: captainlongevity@gmail.com
These WorkplaceLog legal pages are served by Vercel. Opening a page sends ordinary request information, such as IP address, browser information and the requested URL, to the host for delivery and security; see Vercel's Privacy Notice. These pages contain no advertising or analytics scripts. If you email support, we receive the address and information you choose to send to answer your request. Avoid including sensitive records that are not needed for that request.