Privacy Policy

Controller

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is Keibel Software, Munich, Germany. The postal address is shown in the Imprint.

Contact for all privacy questions and requests: contact@keibel-software.de.

Your rights

Where the GDPR applies, you have the following rights:

• access to your personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection to processing based on legitimate interests (Art. 21 GDPR);
• withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR).

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise your rights, write to contact@keibel-software.de. We will answer within one month and may ask you to confirm your identity first.

Legal bases

We process personal data on the following legal bases:

• Art. 6(1)(b) GDPR, to provide the app, the website and the dashboard and the functions you choose to use;
• Art. 6(1)(f) GDPR, for technical security, stability and the improvement of our services, where your interests do not override ours;
• Art. 6(1)(a) GDPR, where you have given consent, for example to optional product analytics;
• Art. 6(1)(c) GDPR, to meet legal obligations.

Recipients and processors

Depending on the features you use, data is processed by the following recipients:

• Apple (iCloud/CloudKit, Apple Maps, StoreKit, Sign in with Apple, the Apple Push Notification service and the App Store) under Apple’s own terms and privacy policy;
• Vercel Inc. (hosting and delivery of the website and the dashboard);
• Neon (hosting of the PostgreSQL database behind the dashboard);
• an S3-compatible private object-storage provider (profile images and organization logos);
• Functional Software, Inc. (Sentry), for crash and performance diagnostics in the app;
• PostHog, only if you switch on product analytics in the app;
• OpenStreetMap Overpass servers and OpenFreeMap (map and place data), as described below;
• the organization, its owners, administrators and members, to the extent that you share data with an organization.

Transfers to third countries

Some providers, in particular those based in the United States, may process data outside the European Union and the European Economic Area. Where this is the case, the transfer is based on an adequacy decision, for example the EU–U.S. Data Privacy Framework for certified companies, or on the standard contractual clauses of the European Commission.

Children

StarLog is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us and we will delete it.

Security

We protect personal data with technical and organizational measures appropriate to the risk. These include encryption in transit, role-based access control, private storage of uploaded files and an append-only audit log for administrative actions in the dashboard. No method of transmission or storage is completely secure.

Changes to this policy

We update this policy when the app, the website, the dashboard or our data handling changes. The date at the top of the page shows the latest version. Material changes to the app are also reflected in the App Store privacy information.

In short

• Your trips, routes, vehicles, notes and receipts are processed on your device and, if you switch on iCloud sync, in your private iCloud.
• iCloud sync is optional. We recommend it because it protects your logbook against the loss of a device and keeps your devices in step. You can switch it off at any time.
• We cannot read the contents of your private iCloud database.
• Data reaches our server only if you choose to use organization features and share trips, vehicles or your profile name.
• StarLog contains no advertising, does not use the advertising identifier and does not track you across other apps or websites.
• You can use StarLog as a manual logbook without granting location or motion access.

Data in the app

To provide the logbook you use, the app processes the following data:

• trips and routes: places, times, distance, speed, route events, pauses and parking locations;
• signals from Motion & Fitness that help tell driving apart from walking, cycling and public transport;
• vehicles, categories, tags, notes, purposes and cost information;
• business profiles and customers that you enter, including company details, tax and bank details and a signature drawing, for business-receipt PDFs;
• receipt images and the text recognized from them, and linked fuel or charging details;
• saved places, automation rules, settings and transit corrections;
• your profile name and the vehicles you assign to trips.

Permissions and system features

The app asks for a permission only when a feature needs it and explains it first. You can decline or withdraw every permission in iOS Settings; StarLog then continues as a manual logbook.

• Location (while using or always): to record routes, to show your position on maps and to detect trips in the background.
• Motion & Fitness: to recognize how you are moving.
• Notifications, including time-sensitive notifications: to ask you to confirm a possible trip, to report saved trips and to remind you about exports or organization events.
• Camera: to scan fuel and charging receipts and QR codes of organization invitations.
• Photo library (add only): to save a receipt image, only when you tap Save.
• Apple Watch fall events, where available and authorized: to show a safety check-in notification on your device.
• Background modes (location and remote notifications): to detect trips in the background and to deliver organization notices.

iCloud sync

If you switch on iCloud sync, StarLog mirrors your logbook to the private database of your own iCloud account using Apple’s CloudKit. The data is stored by Apple under your Apple Account. We, as the developer, have no access to this database.

When sync is switched off or unavailable, your data remains on the device. Deleting data in StarLog also starts the deletion of the synchronized copies that the app can control; other devices need time and a connection to reflect it. Apple’s terms and privacy policy apply to iCloud.

Maps and place information

Map display, place search and address lookup use Apple Maps services, and only when you use these functions.

To suggest a category for a destination and to understand road and rail context, StarLog can send a search area (a coordinate and a radius) to public OpenStreetMap Overpass servers. These requests are made on a best-effort basis, are not linked to an account and identify only the app name and version. Recording a trip does not depend on them.

Receipts and text recognition

Text on receipts is recognized on your device with Apple’s Vision framework. For better recognition the app can download a recognition model package hosted by Apple; the model runs on your device, and receipt images and text are not sent to us or to any recognition service.

Subscriptions

Paid plans are sold as in-app subscriptions through the App Store. Payment, renewal, trials, cancellation and refunds are handled by Apple. The app checks your entitlement locally through StoreKit. We do not receive your payment data.

Notifications, widgets, Live Activities and Shortcuts

Local notifications, widgets, Live Activities and Shortcuts are created on your device. Widgets and Live Activities use a small summary (for example month totals or the state of a running trip) that the app shares with its widget through an App Group on the same device. No route history is placed in this summary.

Crash and performance diagnostics

To find and fix problems, the app can send technical error reports, crash data and sampled performance data to Sentry, our processor. They contain, for example, the error type, a stack trace, the time, the app and iOS version and the device model. The collection of personal data by default is switched off, and the app is built not to send routes, addresses, trips, vehicle identifiers, receipts or notes. We rely on Art. 6(1)(f) GDPR for this processing.

Optional product analytics

Product analytics are off until you switch on Share product analytics under Settings, Privacy & Data. If you switch them on, the app sends a small set of fixed events, such as which main screen was opened and whether onboarding was completed, together with technical error events, to PostHog, our processor. Routes, addresses, trips, vehicle data, receipt content and notes are not sent as analytics events. We do not record user sessions. You can switch analytics off again at any time; the legal basis is your consent under Art. 6(1)(a) GDPR.

Organizations and the StarLog server

Organization features are optional. If you use them, you sign in with Apple, and the app exchanges Apple’s identity token with our server. The server returns a signed session value that the app keeps in the iOS Keychain. Your iCloud identity and your sign-in with the server are kept separate.

Joining an organization shares nothing by itself. Only the trips, vehicles, route points, costs and profile name that you share, or that you share automatically after you opt in for an organization, are sent to our server and become visible to the members of that organization according to their role. You can change or remove a share at any time, and you can leave an organization.

If notifications are allowed, the app registers an Apple Push Notification service token with our server so that we can deliver organization notices. The token is removed when you sign out.

Details on the data stored on the server are given in the part on the website and the dashboard.

Export and sharing

Exports such as PDF, CSV, Excel, GPX, HTML and JSON are created on your device from the trips you select. When you share a file, you choose the recipient and the app or service. StarLog does not send exports by email on its own.

Storage periods and deletion

Your logbook is kept until you delete entries or use Delete All Data under Settings, Privacy & Data. This removes the data on the device and starts the deletion of the private iCloud copies that the app can control, and it returns the app to onboarding.

Delete All Data does not delete data that you have shared with an organization or diagnostic and analytics events that have already been received; see the part on the website and the dashboard and contact us for those.

Hosting and server logs

The website and the dashboard are hosted by Vercel. When you open a page, the hosting infrastructure processes technical request data, in particular your IP address, the date and time, the requested page, the referring page, the response status and the browser and operating-system information. This is necessary to deliver the pages and to keep them secure and stable (Art. 6(1)(f) GDPR). Log data is deleted or anonymized after a short period determined by the provider.

Cookies and similar technologies

On the public pages we set only one functional cookie. It is called starlog_locale, remembers the language you selected and expires after one year. We do not use advertising cookies, analytics cookies or third-party trackers on the public pages.

After you sign in to the dashboard, strictly necessary session cookies keep you signed in and protect against forgery. They are deleted when the session ends or you sign out. No consent is required for these cookies.

Account and sign-in

You can sign in with Apple or, once you have set one up, with a passkey. With Sign in with Apple we receive Apple’s stable account identifier and, depending on your choice at Apple, your name and an email address, which can be an Apple private relay address. With a passkey we store only the public key, a credential identifier and a device label; biometric data never leaves your device.

For each session we store a session token, the creation and expiry time, the IP address and the browser and device description. They are shown to you in your account settings so that you can end sessions.

Data stored for organizations

The dashboard database contains the following data:

• account and profile: identifier, display name, profile image and the organizations you belong to;
• organization: name, contact details, time zone, logo, memberships, roles and invitations (invitation codes are stored in protected form);
• shared content: the trips, vehicles, route points, categories, tags, costs and odometer information that you or other members have shared with the organization;
• activity log: an append-only log of administrative events, from which sensitive details are removed;
• notification settings and Apple Push Notification service tokens of your devices;
• records needed to deliver and retry synchronization requests without duplicates.

Who can see shared data

Members can see the data that their role and the sharing settings allow. Owners and administrators manage membership and roles and can see the data that members have shared with the organization. Private trips and the other contents of your personal logbook are not part of this database.

Organizations decide who joins and how shared data is used inside the organization and are responsible for the lawful use of the data they receive.

Images and files

Profile images and organization logos are processed on our server (format and size are checked and common metadata is removed) and stored in private object storage. They are not public and are delivered only to people who are authorized to see them.

Maps in the dashboard

The dashboard shows maps and route replays. Your browser loads map styles, tiles and fonts from OpenFreeMap, which therefore receives your IP address and the map area you view. Route coordinates themselves are not sent to OpenFreeMap.

Push notifications

Organization notices, for example when an organization is deleted, are delivered through the Apple Push Notification service. The message contains generic text and no trip or route data.

Reports and exports

Owners and administrators can generate role-scoped PDF and CSV reports from the shared data. They are created when requested.

Storage periods and deletion

Shared data is kept as long as it is shared. If you remove a share, it is removed from the organization’s data. If an owner deletes an organization, its memberships, invitations, shared trips, vehicles, routes, files and audit data are deleted from the database. A minimal deletion receipt remains so that former members can read the notice and stale devices cannot restore the organization. Backups are overwritten in the provider’s regular cycle.

To delete your StarLog sign-in account and the data stored for it on our server, write to contact@keibel-software.de from the address you use with StarLog. We will confirm and complete the deletion within one month, unless legal obligations require us to keep certain records. Deleting your account does not delete your personal logbook on your devices or in your iCloud.