Craptain's Log
Privacy Policy
Craptain's Log is a bowel-movement and gut-health tracking app. Because what you log is health data, we hold ourselves to a high standard: we collect only what the app needs, we never sell your data, we never share it for advertising, and there are no third-party analytics or ad networks in the app. This policy explains exactly what we process and the rights you have.
1. Who is responsible for your data
The data controller is the individual operator of Craptain's Log ("we", "us"):
Craptain's Log
Operator: Drew Blatz (individual)
Contact: poop@craptains-log.com
2. What we collect
Account data
- Email address, display name, and avatar received from Google Sign-In or Sign in with Apple, plus the sign-in provider's account identifier
- Username, bio, and profile settings you choose in the app
- Timezone (used to compute your local day for streaks and reminders)
Health data (special category — only with your explicit consent)
- Bowel-movement logs: date and time, Bristol scale, size, color, consistency, count, wipe details, bidet use, smell, how you felt, free-text notes, optional sketches, and an optional location label you type yourself (we never access your device's GPS)
- Symptoms you record (preset or custom ones you create)
- Custom metrics you define and their values (Craptain's Club feature)
- Streaks, weekly recap statistics, and reports derived from your logs
You give (or refuse) explicit consent for health tracking during onboarding, and you can withdraw it at any time in the app's settings. Without it, the app cannot store health logs — the server refuses them, not just the app's interface.
Social data
- Your friends list and friend requests
- Comments and reactions ("wipes") you give and receive
- Your sharing choices (profile visibility, whether friends can see entries or achievements). Sharing with friends is off unless you consent to it.
Game data
- In-app game progress: XP, level, doubloons, rations, items, equipment, quests, voyages, and visits to friends' ships
Purchases
- Your Craptain's Club subscription status. Payment is handled entirely by Apple's App Store or Google Play — we never see your card or bank details. Our subscription processor, RevenueCat, gives us an anonymized purchase record tied to your account ID.
Technical data
- A push-notification token for your device (Firebase Cloud Messaging or Apple Push Notification service), if you enable notifications
- A record of your consent choices, including the IP address and browser/app identifier at the moment you gave or changed consent (kept as legal proof of consent)
- Standard short-lived server logs for security and troubleshooting
3. Why we process it (purposes and legal bases)
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Providing your account and the app's core features | Account, game data | Contract (Art. 6(1)(b)) |
| Health tracking: logs, streaks, stats, recaps, reports | Health data | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Sharing with friends (feed, comments, reactions) | Social data, shared entries | Consent (Art. 6(1)(a)) |
| Push notifications and reminders you configure | Push token, notification settings | Consent via your notification settings (Art. 6(1)(a)) |
| Craptain's Club subscription | Purchase status | Contract (Art. 6(1)(b)) |
| Security, abuse prevention, troubleshooting | Technical data | Legitimate interest (Art. 6(1)(f)) |
| Proving consent and meeting legal obligations | Consent records | Legal obligation (Art. 6(1)(c)) |
4. Who we share it with
We share personal data only with the service providers (processors) needed to run the app, and only what each one needs:
| Provider | What for | What they process |
|---|---|---|
| Google (Firebase) | Push notifications; Google Sign-In | Push token; sign-in identity |
| Apple | Sign in with Apple; push notifications on iOS; App Store billing | Sign-in identity; push token; purchases |
| RevenueCat | Subscription management | Account ID and purchase status |
| Cloudflare | Network security and hosting for our website and API traffic | Connection data passing through their network |
Your health logs are never shared with any of these providers for their own use, never sold, and never used for advertising. The app contains no third-party analytics or advertising SDKs. Friends only see what your sharing settings allow.
We may disclose data if legally required to do so (for example, a valid court order), and we would challenge overbroad requests.
5. Where your data lives
Your data is stored on servers operated by us in the United States. If you use the app from the EEA, UK, or Switzerland, your data is therefore transferred to the United States. For our processors listed above, transfers rely on recognized safeguards such as the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.
6. How long we keep it
- While your account exists: your data is kept so the app can work.
- When you delete your account: everything is deleted immediately and permanently from our live database — logs, profile, friends, game progress, notification tokens, and consent records. Comments you left on friends' entries are anonymized (the text remains, your name is removed). Your subscriber record at RevenueCat is deleted as part of the same process.
- Backups: encrypted backups age out within 30 days of deletion.
- Server logs: kept briefly for security, then discarded.
7. Your rights
Under the GDPR (and similar laws elsewhere) you can:
- Access & portability — export everything we hold about you as JSON or CSV: in the app, Profile → Account → Export Data.
- Erasure — delete your account and all data: Profile → Delete Account, or see this page if you can no longer access the app.
- Rectification — edit your profile and any log entry directly in the app.
- Withdraw consent — change any consent (health tracking, friend sharing) at any time in Settings. Withdrawing doesn't affect the lawfulness of processing before withdrawal.
- Restriction & objection — email us and we'll respond within 30 days.
- Complain — you can lodge a complaint with your local data-protection supervisory authority at any time.
To exercise any right by email, write to poop@craptains-log.com from the email address on your account.
8. Children
Craptain's Log is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child is using the app, contact us and we will delete the account.
9. Security
All traffic between the app and our servers is encrypted with TLS. Access to production systems is restricted, sessions are invalidated on deletion, and consent changes are recorded in an append-only audit log.
10. Changes to this policy
If we change this policy in a way that matters — new data, new purpose, new provider — we'll tell you in the app and, where the change requires it, ask for your consent again. The version and effective date at the top always reflect the current text.