A wiki for the parts of your life you track.

What it is

Like a wiki, for your specific domains.

A domain is one area of your life with its own vocabulary. Each has categories, and each category has the fields that make sense for it, so a feeding is not shaped like an oil change. You log entries as things happen, with photos, files, timers and notes, and over time they add up to the place you look things up: the last oil change, the dose the pediatrician gave, the year the water heater went in.

• Baby

  Feeding, diapers, sleep, growth, medicine, vaccines, appointments, milestones.

• Me

  Weight, sleep, mood, medicine, water, exercise, doctor visits.

• Car

  Oil changes, tires, brakes, repairs, fuel, expenses.

• Home

  Maintenance, repairs, improvements, utilities, groceries, purchases.

• Dependents

  For the people you care for: medicine, symptoms, vitals, appointments, notes.

• Your own

  Build a domain from scratch, or change the fields on any of the built-in ones.

Why we built it

It started with a photo we could not take back.

We were tracking our baby in an app that did what a baby tracker should. Then our caregiver, trying to help, started adding photos: meals, activities, and one day a diaper rash she wanted us to see when we got home.

She did nothing wrong. She used the app the way it was designed. But those photos now sat on someone else's servers. We did not know where, for how long, who could open them, or what would happen if that company was sold, breached or shut down. All we could do was ask for them to be deleted, and hope.

When a caregiver adds a photo of a diaper rash, it should reach the parents and nobody else. That includes us.

Once you notice it, you see it everywhere. A photo of a rash is a medical image of a child. A mood note is close to a clinical record. A cycle entry can be a legal risk in some US states. A weight log is something insurers and ad networks would pay for. People choose an app for a good reason and end up putting sensitive things into a system they do not control, cannot inspect, and cannot really delete from.

The usual answer is a privacy policy. We wanted the answer to be the way the thing is built. And because the things most worth tracking are often the most personal, and rarely fit an app someone else designed, Loggie lets you track anything, keeps it private by default, and lets you share only what you choose.

We put every feature to one question: if Loggie were subpoenaed, breached, sold or shut down tomorrow, would this expose what you logged? Where the honest answer is not yet a plain no, we say so further down this page.

How we keep your data safe

We built it so that we cannot read what you log.

That is a property of how the app works, not a promise about how we behave. The privacy policy has the complete account. The short version:

• No account

  No sign-up, no email address, no phone number, no login.

• Your device first

  Entries, photos and notes are stored on your device, and the app works fully offline. Sync is something you turn on.

• Encrypted before it leaves

  With sync on, every change is encrypted on your device with your vault key (AES-256-GCM). Our server stores ciphertext and never has the key.

• No tracking

  No analytics, no ad SDKs, no third-party trackers. This page keeps the same rule: it loads no script, font or image from anywhere else, and its content security policy forbids it.

• Yours to take or delete

  Export everything to CSV at any time. A vault's owner can delete the vault from our server from inside the app.

• Standard cryptography

  Only the Web Crypto API that ships with the platform. No custom crypto and no third-party crypto libraries.

An illustration, not real data.

So the server is not blind to everything. With sync on it holds the ciphertext, its size and when it arrived; a random vault ID; a random ID and public keys for each device, and which devices belong to the vault's owner; a few values it needs to deliver invites and let a restored device back in; and sync bookkeeping, such as which changes each device has confirmed and how many bytes a vault uses. Its request logs record the method, the kind of request, the status and the timing. They do not record the vault ID, your IP address or your user agent, and they roll over after about two weeks. The full list is in the privacy policy.

How it works

Local-first, with a relay that only passes ciphertext along.

1. You log something

   It is written to a database on your device. Nothing else has to happen: without sync, nothing you log is sent to us.

2. You turn on sync

   Your device creates a vault and generates a 256-bit key for it. A vault is the thing you sync and share.

3. Each change is encrypted

   A new entry, an edit or a delete is encrypted with the vault key and sent to our relay as ciphertext. Photos and attachments are encrypted on the device too, and uploaded as opaque blobs.

4. The relay passes it on

   Your other devices fetch the ciphertext and decrypt it locally. Once every device in the vault has confirmed a change, the relay drops its copy of that change, apart from a small buffer of recent ones. Encrypted photos and attachments stay until they are deleted.

5. You invite someone

   The vault key is encrypted on your device for the person you invite, so the relay carries it without being able to open it. Device-to-device invites use ECDH on P-256, HKDF and AES-KW. An invite link is protected by a secret in the part of the link after the #, which a browser never sends to a server. Links work once and expire, after 72 hours by default.

6. You choose what they see

   For each person you pick which domains to share: Baby but not Car, say. Nothing is ticked for you, and they see the list before they accept.

Under the hood: Lit web components packaged for iOS and Android with Capacitor, RxDB over IndexedDB on the device, and a small Node relay (Fastify and SQLite) on a VPS we manage ourselves. We plan to open source the relay, so that you have the option of hosting your own.

What it does not do yet

The limits, stated plainly.

Trust is easier when you know where the edges are. These are the ones that matter today.

• We cannot recover your data

  If you lose every device and have not exported a backup, it is gone. There is no master key on our side.

• Removing someone is not a cryptographic lock-out

  Removal stops that person's app from syncing. The vault key is not changed yet, and they keep whatever was already on their device.

• Domain sharing is enforced by the app

  Everyone in a vault holds the same key. A held-back domain stays off a normal copy of the app, but separate keys per domain are not built yet.

• The app lock is a screen lock

  The PIN or biometric lock guards the app's screen. It is not extra encryption of what is stored on the device; your phone's own lock and disk encryption do that.

• Deleting has edges

  Server backups can hold deleted data for up to 35 days. We cannot delete copies on another person's device, or anything already exported.

Coming soon

Loggie is launching on the App Store and Google Play.

The iPhone, iPad and Android apps are on their way to the App Store and Google Play. Store links will appear here as soon as each listing is live.

Contact

Talk to the people who build it.

Loggie is built and operated by Obrevaro, LLC. Write to us with questions about Loggie or about your privacy.

• Questions

  questions@obrevaro.com

• Support

  support@obrevaro.com

• Privacy, deletion and security

  privacy@obrevaro.com