Effective Date: October 27, 2026 •
Application: HaptiLog for Wear OS (com.haptilog.watch) & Web Portal
HaptiLog is designed around local-first capture and privacy by design. Audio memos are recorded only when explicitly initiated by the user, stored locally on watch flash memory, and never sold or shared with advertising third parties.
Adults 18+: HaptiLog is intended for adults. Optional cloud synchronization and AI processing require an explicit declaration that you are at least 18 and consent to processing. This declaration is not independent age verification. Declining leaves watch recording local. Turning cloud sync off stops future watch synchronization and queues server consent withdrawal when online; requests already sent may finish. Existing cloud copies remain until deleted in the portal or through a support request.
1. Information We Collect and Process
A. Audio Recordings (Microphone)
HaptiLog records audio strictly when you explicitly tap to start a recording on the watch display, Wear OS Tile, or Complication.
Local Storage: Audio files (AAC/M4A) are saved to your watch’s private application storage immediately. Offline voice logging works without an internet connection.
Cloud Sync & AI Processing: If cloud sync is active, audio files are securely uploaded via encrypted HTTPS to our backend (Supabase) to generate text transcriptions and structured summaries (expense amounts, tasks, journal notes) using Google Gemini AI.
No Continuous Listening: HaptiLog does not listen passively, record in the background without user initiation, or collect ambient audio.
B. Location Data (GPS)
When location permission is granted and the location recording scope includes recordings (the default), HaptiLog captures a geographic snapshot (latitude, longitude, altitude, and velocity) during voice recording. You can also choose to start a separate location journal from watch settings.
Purpose: Geotagging your voice memos (e.g. marking where an expense was incurred, field notes taken, or running intervals logged).
Voice-memo location: Snapshot acquisition ends when voice recording stops. Saved location metadata may be uploaded to Supabase with the recording if you enable cloud sync.
Combined cloud synchronization (new watch builds): A new explicit adult declaration enables synchronization of completed recordings (including existing audio and attached location), saved places, and retained stays from the past seven days. Raw movement points remain on the watch unless you separately approve the precise raw-location scope described below. Audio and recording time are processed by Google Gemini; location summaries are not sent to Gemini. Turning off this common setting stops subsequent audio and location uploads; previously uploaded data must be deleted separately. Existing audio-only or location-only permissions are not automatically expanded. First activation imports local places; subsequent activations use cloud place settings.
Precise continuous location originals (explicit scope upgrade): After an additional adult declaration on the watch, future sensor observations (precise coordinates, UTC and monotonic timestamps, fix age, accuracy, session and sample identifiers, and available altitude/speed) may sync to Supabase. These originals can reconstruct a route and are readable only by your watch identity or an authorized connected browser through the developer map. They are not sent to Gemini. Existing combined consent does not authorize raw upload, and observations captured before raw approval are never backfilled. Collection still requires the Always location scope; approval does not start collection. Common cloud withdrawal stops raw uploads too. Server originals expire seven days after observation and are hidden immediately on expiry; the daily location cleanup physically removes expired rows. Deleting all raw locations prevents delayed pre-deletion samples from reappearing and leaves audio and stay summaries intact. Stay deletion also suppresses its contributing raw interval. Local original files are separate from audio: acknowledged and unconsented originals are retained for up to seven days when the store is accessed; unacknowledged originals remain durable through network failure until the server reports receipt or a terminal exclusion. Collection stops at a 20,000-sample storage safety limit rather than silently discarding pending originals.
Optional location journal: Off until you explicitly start it, grant precise location access, and enable notifications. During a journal session, the app periodically obtains locations even when the watch screen is off, displays an ongoing location notification, and offers a stop action. Location collection has no app-imposed time limit and continues until you stop it. The default location scope only attaches location when recording audio; collecting outside recordings requires an explicit scope change. System termination, permission changes or reboot may stop any session; sessions do not automatically restart after app process death or reboot. The journal saves filtered points with timestamps and accuracy, named places you create, and derived arrival, departure, and dwell events. Using the place editor's current-location action also obtains a location to fill the place's coordinates.
Local by default: Journal history stays in private watch storage unless you explicitly enable cloud synchronization. Legacy voice-only cloud consent does not enable location synchronization. Filtered movement points and legacy arrival/departure events remain local.
Optional place and stay synchronization: With explicit cloud consent (combined in new watch builds, independent location consent in older builds), saved place names, coordinates and radii, and stay summaries (identifiers, observed times, representative coordinates, accuracy, duration and ending status) are uploaded to Supabase for the connected web portal. Raw movement trails and audio are not included in this path, and journal data is not sent to Gemini. Combined consent includes retained stays from the preceding seven days as disclosed before enabling; older builds offer a separate retained-history choice. Enabling synchronization does not start location collection. Turning it off stops future uploads and queues server withdrawal when online; already sent requests may finish. Existing cloud data must be deleted separately. Connected portal sessions can access this data and manage places; the journal does not provide remote tracking or family sharing.
C. Optional Diagnostic & Crash Reports
Diagnostic reporting is off by default. If you explicitly opt in through Watch Settings:
Uncaught JVM exception class names, limited HaptiLog code locations (class, method, and line number), app build version, device manufacturer/model, and Android OS level are collected to fix bugs. Reports are linked to your anonymous cloud user ID.
Strict Exclusions: Crash reports never contain audio data, transcripts, GPS coordinates, file paths, device IDs, or exception message strings.
D. Support Reports and Cloud Identity
When you choose to send an issue report from Watch Settings, we collect the description you enter, a report ID, app/build version, device manufacturer/model, Android API level, and an anonymous cloud user ID. Issue submission is optional and separate from the crash-report switch. Do not include sensitive personal information in your description.
Optional cloud features use an automatically generated anonymous user ID and authenticated sessions to protect your recordings, pair browsers, and associate support reports. You do not need to provide a name, email address, or password to use the watch app. Synchronized transcripts, structured summaries, and corrections are stored with the source recording.
If you choose to record purchase or workout notes and enable cloud processing, their contents may include purchase history (such as amounts, currencies, and merchants) or fitness information (such as exercise observations). HaptiLog organizes these into expense and workout notes. It does not connect to a bank, process payments, measure vital signs, or provide financial or medical advice.
E. Product Analytics in the Web Portal
The web portal collects first-party product analytics through PostHog EU Cloud (eu.posthog.com). We record page views, generic feature interactions, and — when you tap Report a problem — the chosen category and whether you added a note; the note text itself is stored only in our own database and is never sent to PostHog. Analytics are linked to your anonymous cloud user ID and a device-local analytics identifier stored in your browser's local storage; no audio, transcript text, or GPS coordinates are ever sent to PostHog. Problem reports are stored in our database (app_reports) alongside the recording ID involved, so support can act on them. Clearing site data for this site removes the local analytics identifier.
2. How We Use and Share Information
We use captured data exclusively to deliver HaptiLog's core voice logging, transcription, and contextual organization features:
AI Transcription & Structuring: Audio data and recording timestamps are sent to Google Gemini APIs through our backend for transcription and organization. GPS coordinates, user identifiers, and internal storage paths are strictly excluded from AI provider requests. Cloud sync is off by default on the watch; enabling it can upload previously saved completed recordings as well as new ones. Spoken content within the audio recording is transcribed and processed as data by the model.
No Advertising or Profiling: We do not serve advertisements, sell user data, or share personal information with data brokers or tracking networks. The only third-party analytics processor is PostHog EU Cloud, used solely for the first-party product analytics described in section 1E.
Map Display: When reviewing locations on the web portal, map tiles are provided by OpenStreetMap. Only the displayed map coordinates and page origin are sent to tile servers; no user voice, audio, or transcript data is transmitted.
3. Data Storage, Security & Retention
Encryption in Transit: All communications between the watch, web portal, and cloud services use TLS/HTTPS encryption.
Access Control: Data stored in our database is protected using PostgreSQL Row-Level Security (RLS) ensuring each user can access only their own records.
Web Pairing Security: Web portal connections authenticate using short-lived HMAC-verified codes and cryptographically scoped session tokens.
Local Deletion: Deleting a recording on the watch removes its local files. It does not delete an already uploaded cloud copy. Revoking a browser connection removes its future access, but does not delete cloud recordings or copies already downloaded.
Cloud Consent: When you enable cloud features, we record your adult declaration, consent version, and consent/withdrawal time against your anonymous cloud identity. This is optional and is not a date-of-birth or identity check.
Retention: Local recordings remain until you delete them or remove the app's data. Cloud recordings, location snapshots, transcripts, summaries, and corrections remain until permanently deleted through the portal or removed following a verified request. Moving a recording to Trash is reversible and does not delete its stored audio. Support and crash reports are retained for troubleshooting and manually removed when no longer needed; there is no automatic 90-day deletion schedule.
Location journal retention: Local journal history is separate from audio, with up to seven days of history and limits of 2,000 location points, 500 legacy events and 500 stays. Older local entries are removed when you access or start the journal or it saves observations; deletion is not scheduled for the exact expiration time while the journal is unused. Cloud stay summaries expire seven days after the observed start and are excluded from portal reads on expiry. Expired summaries are removed by scheduled daily server maintenance, so removal from storage can follow the expiry moment by up to a day; they are already unavailable in the portal during that interval. Saved places remain until removed. In local mode, clear history and remove places on the watch; while synchronization is enabled, manage saved places through the portal. Clearing app data or uninstalling removes local records. Portal deletion removes selected or all uploaded stays and prevents their re-upload; it does not erase local journal history, audio or saved place definitions. Coordinate-free deletion identifiers are retained to enforce this protection.
Hidden place suggestions: Choosing to hide a suggested place stores its representative area in this browser, scoped to the connected watch owner. These preferences expire within seven days or earlier when their source stay summaries expire. Expired preferences are removed when accessed; they are also cleared after stay deletion, observed location-access revocation or browser sign-out. You can remove browser-local copies by clearing site storage.
Request deletion of HaptiLog cloud data
In a connected web portal, move a recording to Trash and use Delete permanently to request deletion of that recording and its associated content. For all cloud data, anonymous identity, support reports, or help with a deletion that did not complete, use the email process below.
Email support@keepory.app with the subject HaptiLog data deletion. Specify whether you want all cloud data deleted or particular recordings or reports removed. Include your portal user identifier or a support report ID if available so we can locate your data. Never send a password, pairing code, or session token. We may ask you to verify control of the associated watch or browser before deleting data.
A verified request can cover uploaded audio, location metadata, transcripts, summaries, corrections, support/crash reports, and the associated anonymous cloud identity. Disconnecting a browser or uninstalling the watch app alone does not request cloud deletion. We will explain any data that must be retained and the applicable period when handling your request.
4. Permissions Used by HaptiLog
RECORD_AUDIO: Capturing voice memos initiated by the user.
ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION: Geotagging memos and obtaining locations during explicitly started journal sessions. Precise location improves place and dwell detection.
FOREGROUND_SERVICE_MICROPHONE & FOREGROUND_SERVICE_LOCATION: Continuing user-started voice recording or the separate location journal with ongoing status notifications while the watch screen is off.
VIBRATE: Providing tactile living pulse feedback during recording.
WAKE_LOCK: Keeping the CPU awake strictly during active recording.
5. Contact Us
If you have questions, feedback, or data privacy requests regarding HaptiLog, please contact us at: