ProvoLog privacy policy

ProvoLog is a private field-notes app. Your notes, photos, audio, video and locations stay on your phone. We run no servers for the app, there is no account, and we never receive your content. This page explains exactly what the app stores and which network connections it can make.

What ProvoLog stores on your phone

• Notes, text entries, photos, audio recordings, videos, tags, project names and settings.
• GPS coordinates and a street address for entries, when you allow location. Location is optional.
• A hash of your app PIN (never the PIN itself), your duress-PIN hash if you set one, and your Pro purchase status.
• Transcripts of voice notes and short descriptions of photos (scene labels and text found in the photo), created on your phone.

All of this is stored only on your device. The database is encrypted with SQLCipher (AES-256). Photos, audio and video are encrypted with AES-256-GCM. The keys are held in the Android Keystore. App backups are switched off, so ProvoLog data is not copied to Google Drive or to a new phone.

Exports are different: a PDF or ZIP you create is not encrypted, and it goes where you send it.

What runs on your phone and never leaves it

• Voice transcription, using an OpenAI Whisper model that runs on your device.
• Photo analysis (Pro): Google ML Kit image labelling and text recognition, using models bundled in the app. No photo is sent anywhere.
• Summaries and rewrites of your notes (Pro), done by simple on-device text processing.
• Content Credentials (Pro): photos are signed on your device with a key held in the Android Keystore. The signed record travels inside the JPEG file and can include the time, GPS position and your phone’s make and model. If you share or export a signed photo, that record goes with it. It does not include your name, account or serial numbers.

When ProvoLog uses the internet

ProvoLog works without a connection for notes, photos, audio, search, signing and export. It connects to the network only in these cases:

1. Advertising (free version only). The free version shows ads through Google AdMob. AdMob and Google may collect your advertising ID, device and app information, approximate location from your IP address, and ad interactions, to show and measure ads. Where the law requires it (for example in the EEA and UK) the app first shows Google’s consent form, and you can change your choice later in Settings. Pro users do not load the ads SDK. See Google’s policy: https://policies.google.com/privacy
2. Voice model download. The first time you use transcription, the app downloads the speech model (about 42 MB) once from huggingface.co. The host can see your IP address.
3. Map (Pro). The map loads street-map tiles from OpenStreetMap servers. They receive your IP address and the map area being viewed. They do not receive your note content.
4. Street addresses. To turn GPS coordinates into an address, the app asks Android’s geocoder, which is provided by Google. The coordinates are sent to that service. If you deny location, no coordinates are collected or sent.
5. Purchases. Buying Pro goes through Google Play Billing. We receive no payment details. Google confirms the purchase to your device.

We do not use analytics, crash-reporting or tracking SDKs of our own.

Permissions

• Camera: to take photos and record video.
• Microphone: to record voice notes.
• Location (precise and approximate): to stamp entries with a position and show them on the map. Used only while the app is open. Optional.
• Biometrics: to unlock the app with your fingerprint or face. We never receive biometric data; Android handles it.
• Internet and network state: for the cases listed above.
• Photos you choose: when you import a picture, Android’s photo picker gives the app only the files you select.

Security features

You can lock the app with biometrics, a device lock or an app PIN, lock individual projects with a passcode, and set a duress PIN. Entering the duress PIN erases all ProvoLog data on the device immediately and permanently. Screenshots and the recent-apps preview are blocked inside the app.

Your choices and deleting your data

All data is on your device, so you control it. Delete notes or projects in the app, use the duress PIN, or uninstall the app to remove everything. We hold no copy and cannot recover deleted data.

Because we do not receive or store your personal data, there is nothing for us to access, correct or delete on our side. For data that Google collects through ads, billing or the geocoder, use Google’s own controls and requests.

Children

ProvoLog is not directed at children under 13, or under the minimum age in your country. We do not knowingly collect personal data from children.

Does anyone get paid for my data?

No. We do not sell or share your content. The only third parties involved are the services listed in “When ProvoLog uses the internet”.

Changes

If this policy changes, the date at the top changes too. Questions: prathieshnav@gmail.com