Privacy Policy

This Privacy Policy explains how Prima Aventura LLC (“we”, “us”), an Oklahoma limited liability company, collects, uses, shares and keeps information about you when you use LogTotals, the website at logtotals.com and the LogTotals app for iPhone and iPad (together, “LogTotals”), and the choices you have. It is part of our Terms of Service. Questions or requests: legal@primaaventura.com.

LogTotals is offered only to people in the United States and is not directed to anyone outside the United States. We store and process your information in the United States, as described in Section 7.

1. Information we collect

• Account information. Your email address and, if you give it, your name. If you sign in with Google, Microsoft or Apple, we receive from that provider your account identifier with it, your name, email address and a link to your profile picture if the provider shares them, and the sign-in tokens it issues. If you use a password, we store it only as a salted one-way hash (scrypt); we never store the password itself.
• Two-factor authentication. The key for your authenticator app, stored encrypted, and your recovery codes, stored only as keyed hashes, with the time each was used.
• Logbook content. The photos and scans of logbook pages you upload; what the automated reader read from them; the entries you review, edit, submit, add by hand or import; the edit history of each entry; your logbooks’ names and column layouts; and the names of files you import. Logbook pages and entries can contain personal information about you and others, such as pilot and instructor names, certificate numbers, signatures, endorsements, remarks, and places and dates of flights.
• Aircraft and learned values. The aircraft in your records, with their type, attributes and any private notes you add, and the values LogTotals has learned from your corrections and confirmations (such as airports, tail numbers and your own abbreviations).
• Submission and attestation records. Each time you submit a page, we record the attestation you agreed to (its exact text and version), the date and time, the number of entries, the amount recorded for the page, your IP address and your browser type (user agent).
• Terms acceptance. Which version of the Terms of Service and this Privacy Policy you accepted, when, and how.
• Account activity (audit log). A record of actions in your account, such as sign-ins, failed sign-ins, uploads, edits, submissions, imports, exports, backups and security changes, each with the date and time, your IP address and your browser type. You can see it under Audit log in your account menu.
• Backups. Copies of your flights (including deleted ones), aircraft, learned values and logbook names, described in Section 8.
• Payment information. On the website, payments are handled by Stripe. We keep a Stripe customer identifier, your plan, its status and billing dates, and how many scans you have used. Stripe holds your card and billing address; we can see limited card details such as the brand and last four digits, and we never receive or store your full card number. In the iOS app, subscriptions are bought from Apple. Through RevenueCat, we receive the subscription’s plan, status, dates and whether it was refunded, linked to your LogTotals account; Apple does not share your payment details or Apple Account with us.
• Permission for page reading. Whether, and when, you allowed your page photos to be sent to Google for reading (Section 5), and when you withdrew it.
• The iOS app. If you allow notifications, the push token Apple issues for your device, so we can tell you when a page has been read. The app identifies itself and its version to our servers with each request.
• Referrals. If you sign up through someone’s referral link, we record that link between your accounts, and whether your first payment qualified them for a reward. To stop self-referrals, we compare an anonymous fingerprint of the card used, provided by Stripe, with the cards on the referrer’s account. The person who referred you sees only how many people joined through their link, never who.
• Communications. What you send us by email, and our replies.
• Technical information. Our hosting provider records basic request information in server logs, such as IP address, time, page requested and errors, under its standard practices.

We do not ask for, and you should not upload, information unrelated to your flight records, such as government identification numbers other than what is written in your logbook.

2. Cookies and browser storage

LogTotals uses only cookies that are strictly necessary to sign you in and keep your account secure, and cookies that remember your preferences. We do not use analytics, advertising or tracking cookies, we do not use third-party tracking pixels or scripts, and we do not track you across other websites.

When you choose to sign in with Google, Microsoft or Apple, you go to that provider’s site, which may set its own cookies under its own privacy policy. Because LogTotals does not track you, it does not change its behavior in response to Do Not Track or Global Privacy Control signals; there is no tracking to turn off.

3. How we use information

• to provide LogTotals: read your pages, show them for review, store your records, compute totals and currency, run checks, and produce exports and backups;
• to learn your handwriting conventions and corrections, for your account only, so later pages read better for you;
• to create and secure your account, including sign-in, two-factor authentication, rate limits and detecting misuse;
• to keep records of your attestations, terms acceptance and account activity, to show you what happened in your account, and to establish, exercise or defend legal claims;
• to send you service messages, such as sign-in links, security notices, changes to our terms, receipts and renewal reminders;
• to process payments, apply plan limits and referral credits, and prevent payment fraud;
• to respond to you, provide support, fix problems and improve LogTotals; and
• to comply with law and enforce our Terms.

4. What we do not do

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising, and we do not show targeted advertising.
• We do not use your logbook pages or records to train artificial intelligence models.
• We do not send you marketing email from third parties, or give your information to others for their own marketing.

5. Service providers

We use these providers to run LogTotals. Each receives only what it needs for its part and processes it on our behalf.

• Google (Gemini API), to read your pages. We send the logbook page images you upload. Before reading, we send small copies of each image, turned different ways, to find which way is up. After the first reading, we may send an enlarged image of one page of the spread together with its column headings and the line numbers and columns of cells to read again. We do not send your name, email address or account details. We use the paid tier of the Gemini API. Under Google’s terms for that tier, Google does not use these images or its responses to improve its products, including training its models. Google keeps prompts, images and responses for a limited period (currently stated as 55 days) solely to detect and prevent abuse and for legal and regulatory requirements, and authorized Google staff may review them for that purpose. Google states that this data may be stored transiently or cached in any country where it or its agents have facilities.
• Cloudflare (R2 storage). Stores your page images and backups privately.
• Railway. Hosts the application, its background worker and its database, in the United States.
• Resend. Delivers email from LogTotals, such as sign-in links and account notices. It receives your email address and the message.
• Google, Microsoft and Apple sign-in. Only if you choose to sign in with them. They learn that you are signing in to LogTotals, and share with us the information described in Section 1.
• Stripe. Processes payments and subscriptions. It receives your email address, name, payment details and billing address, and handles payment information under its own privacy policy.
• Apple. In the iOS app: sells and bills subscriptions through the App Store, under its own terms and privacy policy; delivers notifications (Apple Push Notification service), which receives your device’s push token and the notification text, such as the name of a logbook; and, if you choose Sign in with Apple, confirms your sign-in as described in Section 1.
• RevenueCat. Checks App Store purchases for us and tells us their status. It receives your LogTotals account identifier and Apple’s purchase records for LogTotals, and no logbook content.

LogTotals also uses public data, such as the FAA aircraft registry and OurAirports, which it downloads and stores itself. We do not send your information to the FAA or to OurAirports.

6. Other disclosures

We may also disclose information:

• when you ask us to, or with your consent;
• if we believe in good faith that the law, a subpoena, court order or other legal process requires it;
• to protect the rights, property or safety of you, other users, us or the public, including to investigate fraud, security incidents or violations of our Terms, and to establish, exercise or defend legal claims; and
• to a buyer, successor or other party in a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, who will be bound by this Privacy Policy for information it receives.

7. Where your information is stored

We store and process your information in the United States. As described in Section 5, Google may cache images sent to the Gemini API, transiently, in other countries where it has facilities, and sign-in providers operate globally under their own policies.

8. How long we keep information

• Your account and records, including page images, entries, edit history, aircraft, learned values, submission and attestation records, terms acceptance and the audit log, are kept until you delete your account, so that LogTotals can serve as a backup of your logbook. When you discard a page before submitting it, its images are deleted. When you delete an entry, it is kept in a recoverable state, with its history, until your account is deleted; email us to ask for permanent deletion sooner.
• Backups. A backup of your flights, aircraft, learned values and logbook names is taken each night when something has changed, whenever you make one, and automatically before a backup is loaded or many flights are changed at once. We keep your last 30 nightly backups, the last 20 you made, and automatic ones for 90 days. Backups are deleted when your account is deleted.
• Deleting your account. You can delete your account yourself on the Security page. That permanently deletes your page images, entries, edit history, logbooks, aircraft, learned values, backups, sign-in methods, two-factor authentication data and audit log.
• The record kept after deletion. When an account is deleted, we keep a minimal record for 5 years, solely to establish, exercise or defend legal claims (for example, a dispute about records you attested to). It contains no logbook content: only a keyed hash of your email address (not the address itself), the account identifier, the dates the account was created and deleted, the numbers of pages and entries you submitted, and the date, time and version of each accuracy attestation you made. After 5 years it is deleted.
• Server logs are kept by our providers under their standard retention practices. Gemini API data is kept by Google as described in Section 5.
• Payment records are kept as long as needed for tax, accounting and legal purposes, and records of your consent to automatic renewal for as long as the law requires, even after your account is deleted.
• Emails you send us are kept as long as needed to deal with them and any related legal matter.

9. Security

We take reasonable measures to protect your information, appropriate to a small service. Among them: page images and backups are stored privately and shown only to you through links that expire after a few minutes; connections to LogTotals are encrypted in transit; passwords are stored as salted hashes; repeated failed sign-ins are paused; accounts that use a password, and anyone loading a backup, must enter a code from an authenticator app; and authenticator keys are stored encrypted and recovery codes as keyed hashes. No method of storage or transmission is completely secure, and we cannot guarantee the security of your information. Keep your sign-in details and devices secure, and tell us at legal@primaaventura.com if you believe your account has been accessed without permission.

10. Your choices and rights

• Access and export. You can see your records at any time and download all of them from the Export page. You can see your account activity on the Audit log page.
• Correction. You can correct your entries, aircraft, learned values and name in LogTotals.
• Page reading by Google. LogTotals asks before it first sends a page photo to Google. You can withdraw that permission on the Security page at any time; LogTotals then stops reading new pages, and everything else keeps working.
• Notifications. You can turn the iOS app’s notifications off in your device’s Settings.
• Deletion. You can delete individual records in LogTotals, and delete your whole account yourself on the Security page, as described in Section 8.
• Requests. You can also ask us, at legal@primaaventura.com, for a copy of your information, to correct it, or to delete it. Write from the email address on your account so that we can verify the request; we may ask for more information to confirm your identity. We will respond within 45 days, and tell you if we need more time where the law allows it. If we decline a request, we will explain why, and you may reply to ask us to reconsider. We will not treat you differently for exercising these rights.

Depending on your state, you may have additional rights under state privacy laws. We will honor them as those laws require. Because we do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling with legal effects, there is nothing to opt out of.

11. Children

LogTotals is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will delete the account and its data. If you believe someone under 18 has given us information, tell us at legal@primaaventura.com.

12. If there is a security breach

If a security breach affects your personal information, we will notify you and any authorities as required by applicable law.

13. Changes to this policy

We may update this Privacy Policy. The date at the top shows when it was last updated. For a material change, we will tell you by email or in LogTotals before it takes effect. We will not use information we already have in a materially different way than this policy described when we collected it without telling you first and, where the law requires, asking for your consent.

14. Contact

Prima Aventura LLC, operator of LogTotals (logtotals.com). Email: legal@primaaventura.com.