Privacy Policy

Last updated: 13 November 2026

This policy is also available in German. The German version is the binding one.

1. Who is responsible

Felix Rief, trading as Rief Digital Apps (Einzelunternehmen), Herbert-Weichmann-Straße 8, 22085 Hamburg, Germany. Email: privacy@loggerfish.com.

No data protection officer is required at this size (§ 38 BDSG: fewer than 20 people processing personal data). Supervisory authority: the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg.

2. What we process, why, and on what legal basis

What	Why	Legal basis (GDPR)
Account data: email address, password (stored only as a hash), optional display name	Create and secure your account, let you sign in	Art. 6(1)(b) — performing the contract
Sign in with Apple, if you use it: the identifier Apple gives Loggerfish for you, the email address Apple shares (your own or an Apple forwarding address), and a token Apple issues to let us end the sign-in link later	Let you sign in with your Apple ID, and, when you delete your account, tell Apple to revoke Loggerfish's access, as Apple requires	Art. 6(1)(b)
Sign in with Google, in the Android app, if you use it: the identifier Google gives Loggerfish for you, your Google account's email address, and the name and profile-picture link Google includes when it confirms who you are	Let you sign in with your Google account	Art. 6(1)(b)
Your log: dives (optionally with how you got in, the surface, the altitude and, from a dive computer's file, where the dive ended) and their dive profiles (depth, temperature and tank pressure over the dive), sites, sightings, conditions, gas, notes, trips, gear, certifications, dive target, settings	Provide the logbook, statistics, sync between your devices	Art. 6(1)(b)
Dives downloaded from a dive computer by Bluetooth, on iPhone, optional: the dive logs on the dive computer, and its model and serial number. A marker (the dive computer's own identifier for each dive fetched, called its fingerprint, and the order they arrived in) stays on your phone only and is never sent to us	Let you bring dives in without a file, and fetch only the new ones next time	Art. 6(1)(b), the same as for the dives you log yourself; see 3·2
Names you enter about other people (buddies, instructors) and identifiers such as certification or member numbers; and, if you ask someone to sign a dive on your phone, their name, role, optional agency and number, the signature they draw, and the stamp they design or upload	Part of your own log. You are responsible for entering only what you are comfortable recording; we use it only to show it back to you. A signature is kept with that dive in your log, and in your account while you are signed in, in your backups and in your exports; it is shown only to you and never in the buddy feed, and it appears on a dive card only if you tick "Signer's stamp" when you share it	Art. 6(1)(b)
Emergency contact, optional: the name, phone number and relationship of the person you want called if something happens to you	Show it on the SOS screen of your devices so a buddy or boat crew can reach them. Only you can read it; it is never shown to other users. It is kept on your device, and also in your account while you are signed in	Art. 6(1)(b) for you; for the contact person, Art. 6(1)(f) — the legitimate interest of you and them in being reachable in an emergency. We do not write to that person about this entry: we hold nothing but what you typed, and contacting them would take more data than we have (Art. 14(5)(b))
Dive passport, optional and part of Pro: your insurance (insurer, policy number, emergency number, expiry date) and, only if you agree when you add it, the dates of a medical fitness certificate and a photo of it	Show them on one screen at a dive centre's counter, with no connection. They are kept on your device, inside the app, and nowhere else that we run: never uploaded to us, not in your account, not synced, not in our backups, not in the Excel export, and never sent to the usage statistics. Your phone's own backup (iCloud or Google) may include them, as it includes the rest of the app's storage on that device. A medical certificate is health data: we store it only after you explicitly agree, you can remove it in the passport at any time, and it is deleted from the device where you reset your logbook, delete your account or press Remove (another device keeps its own copy until you remove it there). The passport belongs to the account that saved it, on that device: when another account signs in on the same device, what the first stored is removed, and a signed-out device does not show it	Art. 6(1)(b) for the insurance details; Art. 9(2)(a), your explicit consent, for the medical certificate. Because none of it is sent to us, we neither receive nor hold either. The consent is recorded on the device only, with the time and the version of its wording
Subscription data: plan, status, renewal date, payment reference (not card numbers)	Give you Pro features, handle billing and accounting	Art. 6(1)(b), Art. 6(1)(c) — legal duty to keep accounting records
Referrals and creator codes, if you use one: who referred whom (your account, the account whose code you entered, and when), whether the referred account then paid for Pro or Duo with real money, and the free months each side received. If you take part in our creator programme: the name you work under, your code, after how many paying referrals you get Pro for good, and a note of what we agreed	Run the referral and creator programme. When you enter a code you are shown the referrer's display name, or the creator's name, so you know whose code it was. When the referred account first pays, each side gets a month of Pro, and a creator gets Pro for good after the agreed number. Whoever referred you sees only counts — how many signed up with their code, how many pay, how many months they earned — never who. Our own figures for a creator are counts as well, and any number under five is not shown	Art. 6(1)(b) — performing the contract: the terms of the referral and creator offer
Dive-professional verification, only if you ask for it: a photo of your pro card, your agency, your level and your member number	Check that you are an active dive professional (divemaster or higher): we look the number up in the agency's own public pro lookup, such as PADI Pro Check, and if it holds, give you 12 months of Pro free. Only you and we can see the photo. The photo and the member number are deleted as soon as we have decided, whether we say yes or no. We keep whether you were verified, the agency, the level, the dates and, if we said no, the reason we gave you	Art. 6(1)(b) — performing the contract: the terms of the offer you asked for
Trial marker: a hash (SHA-256) of your email address, stored when your free trial starts — not the address itself. A hash cannot be turned back into the address, but anyone who already knows an address could check it against the list, so we treat it as personal data	Make sure the free trial runs only once per email address, including after an account is deleted and a new one is opened with the same address	Art. 6(1)(f) — legitimate interest in preventing repeated free trials
Google Play buyer marker, only if you bought Pro through Google Play and then delete your account: your account's internal number and the time of deletion — nothing else, not your email address and not a hash of it	Google Play keeps that number on your purchase and gives us no way to change it. The marker is how we know that a purchase naming it belongs to an account that no longer exists, so the same Google account can put the subscription or licence it paid for onto a new Loggerfish account instead of losing it	Art. 6(1)(b) — the purchase you paid for; Art. 6(1)(f) — legitimate interest in not leaving a paid purchase stranded
Reviews you publish: the site, your rating and text, the name you choose to show, the date you dived it, the language	Show your review publicly to everyone, with that name. Nothing else from your account or log is shown	Art. 6(1)(b)
Your public diver profile, only if you switch it on — it is off until you do: the display name and handle you choose, the year of your first and most recent dive, and whichever of these you enable separately: how many dives, countries, species and hours you have; your life list of species by name; the countries you have dived, as country codes	Show that page to anyone who has the address. No dates, no coordinates, no dive-site names, no buddies or instructors, no gear, no certifications, no notes and not your email address — those columns are never read, not even as an option	Art. 6(1)(a) — your consent, given by switching it on and withdrawn by switching it off
Buddies, only if you use them: the name you show your buddies (up to 40 characters, separate from your account's display name); who you are linked with, and since when; the invite codes you make; each dive you choose to share — its date, country, maximum depth, duration, water temperature, visibility, sightings, a note you write, and the site name and exact position only if you choose to share the exact site (otherwise a position rounded to about 10 km, and only if you tick "Include where the site is"); the cheers you give and receive (which account cheered which shared dive, and when); and when you ask a buddy, or a member of the same shared trip, "Dived together?", the question and their answer	Show the dives you share, and your buddy name, to the buddies you have linked with; let them cheer; and, when a buddy accepts "Dived together?", add that dive's date, time, site, depth and duration to their log. Only buddies you have linked with see any of it — not other users, not the public, and not your account name or email address — with one exception, and only if you ask: if you ask "Dived together?" of a member of the same shared trip who is not your buddy, that person sees that one dive's date, time, site, country, depth and duration and your name (your buddy name if you have one, otherwise your account's display name, which everyone on the trip already sees). They see it only while you are both on the trip and the dive falls within its dates, and the dive is added to their log only if they accept; if either of you leaves the trip first, the question disappears. If you cheer a buddy's shared dive, we store that your account cheered that dive, and when. Only the buddy who shared it sees who cheered; nobody sees a count. Cheers are deleted when you unlink, unshare the dive or delete your account. A shared dive carries only the country and a position rounded to about 10 km unless you choose to share the exact site.	Art. 6(1)(b) — providing the feature you chose to use
Shared trips, only if you share one: the trip as you entered it — its name, dates, organiser, type, country, place, group, number of days and planned dives, and likelihood — but not the costs, which stay visible only to you; the invite code for it; and who has joined. Everyone on a shared trip sees the account display name of the person who shared it and of the others who joined	Let the buddies you invite see the trip in their own Loggerfish. They can read it but not change or delete it; only you can	Art. 6(1)(b) — providing the feature you chose to use
Reports you send about a review, and moderation decisions	Keep reviews lawful and on topic, act on reports, prevent spam	Art. 6(1)(f) — legitimate interest; Art. 6(1)(c) where the EU Digital Services Act requires it
Usage statistics, unless switched off in Settings or your browser asks not to be tracked: which screens are opened, counts of actions (a dive logged, an import run or failed, the first dive in a logbook), plan tier, settings chosen, device category, whether you use the web app or the iPhone or Android app, which button on loggerfish.com opened the app if you came from there, approximate location (country, region, city) derived from the IP address, which is not stored. No cookies, no identifier stored on your device, never the content of your log or the name or content of a file you import	Learn which features are used, to decide what to improve	Art. 6(1)(f) — legitimate interest in improving the app with data that does not identify you. § 25 TDDDG does not apply, because nothing is stored on or read from your device for this
Error reports, under the same switch as usage statistics: when the app hits an error, or a save, sync or import fails — the kind of failure and a reason from a fixed list (for example "device full"), the technical name of the error, a shortened fingerprint (hash) of the error message with all numbers, quoted text, web addresses and email addresses removed before it is computed, the place in the app's code (file and line), which screen was open, the app version and whether it is the web or iPhone app. Each start of the app also sends one "session started" signal with a random number made up for that session, so we can count how many sessions ran without an error. Never the error message itself, never the content of your log, never your account, email address, location or a file name; no cookie and no identifier that lasts beyond one session. To stop one device flooding error reports, a salted fingerprint of the IP address is kept for at most 2 hours, then deleted (see "Error reports" in section 3)	Find and fix errors, and see whether a new version is more or less reliable than the last	Art. 6(1)(f) — legitimate interest in a working app, with data that does not identify you
Website visit counts, unless your browser asks not to be tracked: which page of loggerfish.com was opened, the referring site, device category and approximate location derived from the IP address, which is not stored. No cookies, nothing stored on your device. Of the address's query part, only campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term — which link or campaign brought you to the site) are recorded, never anything else in it. Same statistics server as the app	Know which pages and languages are read, and where visitors come from and which links and campaigns bring them	Art. 6(1)(f), as for usage statistics
Feedback you choose to give: how the app is working for you (not working well, OK, love it), an optional comment, an email address to reply to if you give one, and feature suggestions; stored with your account and your plan, never shown alongside your log. Without an account, 'Not working well' opens an email to us instead, which adds the app version, platform (web, iPhone or Android), language and a rough count of your dives (for example '11–50'), and nothing from your log	Understand why features are or aren't used, and answer you when something isn't working	Art. 6(1)(a) — you choose to send it; Art. 6(1)(f) for the rating counted in usage statistics
Technical data: IP address and request logs, kept briefly; for error reports and the cancellation page, a salted fingerprint of the IP address, kept for at most 2 hours	Keep the service secure and working, detect abuse	Art. 6(1)(f) — legitimate interest
Support messages	Answer you	Art. 6(1)(b) or (f)
A cancellation sent through our cancellation page ("Cancel contracts here"): the kind of cancellation and any reason you give, your name, the email address you type, the contract and any customer number you name, the end you want, and the time it was received	Find your subscription, end it, and confirm the cancellation to you, as § 312k BGB requires; keep proof of when the contract ended	Art. 6(1)(c) — a legal obligation; Art. 6(1)(f) for keeping the proof
Waitlist or newsletter, if you sign up: email address, language, what you ticked, the consent wording's version and time, and when you confirmed	Confirm the address is yours, then send what you asked for	Art. 6(1)(a) — consent, withdrawable at any time
Monthly email about your diving, only if you switch it on: your email address, display name, language and units; from your synced logbook your dives, sightings, gear service dates and yearly target; whether you have Pro; your choice (on or off, the wording you agreed to and when) and a record of each email sent (month, time, language)	Once a month, email you figures from your own logbook — never compared with anyone else's	Art. 6(1)(a) — your consent, which you can withdraw at any time in Settings → Account → Emails, with the link in every email, or by replying "stop"

We do not sell your data, do not use it for advertising, and do not make decisions about you by automated means. Your dive log is never used to train AI models, by us or by anyone else.

3. Who receives data

We use service providers who process data on our instructions under data-processing agreements. The payment providers are the exception: they act for themselves, as the entry below explains. This list is what the product actually uses:

Database, sign-in and API: Supabase Pte. Ltd, 65 Chulia Street, OCBC Centre, Singapore. Your data sits in their EU region (Frankfurt), but the company we contract with is Singaporean, so the contract itself is an international transfer and runs on the European Commission's Standard Contractual Clauses. Holds your account and, while you are signed in, your log.
Website and app hosting: Cloudflare, Inc., San Francisco, serves loggerfish.com and app.loggerfish.com through Cloudflare Pages, and sees the IP address of every request as any web host does.
Maps: every map that plots your dive sites — the Logbook's dive-site map, the dashboard's two site maps, the trip map and the site map in the dive form — is drawn by Apple Maps, and § 3c is about those. No other map provider receives anything: the dashboard's country shading and the map the app draws when Apple's cannot be loaded are drawn from outlines shipped inside the app, so they ask no server for anything. Until 15 October 2026 these maps were drawn from tiles fetched from Thunderforest (Gravitystorm Limited, United Kingdom), who therefore saw your IP address and which part of the world you were looking at; that is no longer the case, and this policy said so while it was.
Nature here and the site forecast (Pro): our server sends the rounded position of the dive site to GBIF, the European Environment Agency (EEA), MET Norway and NOAA. Your IP address is not shared with them.
Sea conditions (Pro): the waves, water temperature, algae and visibility beside the forecast come from files we host on Cloudflare Pages. The app asks for the 5° square a dive site lies in, never the site, so Cloudflare sees your IP address and that square. No one else receives anything.
divelogs.de, only if you send your dives there: your divelogs.de login and the dives you send go from your device straight to divelogs.de (Rainer Mohr, Germany), which keeps them for you as its own controller, not as our processor. § 3·4 explains it.
Payments: Stripe Payments Europe, Limited (Ireland) for purchases on the website; Apple for purchases made in the iPhone app, and Google Play once the Android app sells subscriptions. They are not our processors. Each sells Pro to you as merchant of record — the seller you pay, which takes the payment and deals with the tax on it — and is an independent controller for that, under its own privacy policy. They handle the payment details; we never see a card number. What we send Stripe when you start a checkout is the email address of your account and your account's internal number, so the payment can be matched to your account, and for a gift also the sender's name and the message you type for the recipient (up to 60 and 300 characters). What we send Apple is your account's internal number, attached to the purchase for the same reason; Apple knows you by your Apple ID, which we do not receive. What we send Google is the purchase token Google gave your phone for that purchase, so that we can ask Google what it is, confirm it to Google, stop it renewing when you delete your account and refund it if you withdraw; your account's internal number is attached to the purchase by your phone, for the same reason as with Apple. Google knows you by your Google account, which we do not receive. What we receive back from each is the subscription status, the order and a reference.
Sign in with Apple: if you sign in with Apple, Apple (Apple Distribution International Ltd., Ireland) confirms your identity to us. When you delete your account we send Apple the token it issued for you, so that it ends Loggerfish's access to your Apple ID. We send Apple nothing else about you or your log. Apple's handling of your Apple ID is governed by Apple's privacy policy.
Sign in with Google: in the Android app, if you sign in with Google, Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) confirms your identity to us on your phone. We send Google nothing about you or your log. Google's handling of your Google account is governed by Google's privacy policy.
Email delivery: Brevo. Our contract is with Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, registered at the Amtsgericht Berlin-Charlottenburg under HRB 133191 — Brevo's terms make it the signatory for customers in Germany. Its French parent, Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, RCS Paris 498 019 298, acts as a sub-processor. Brevo sends these messages the service itself writes to you: the confirmation of a withdrawal, which § 356a BGB requires us to send on a durable medium, and the confirmation of a cancellation made through our cancellation page, which § 312k BGB requires us to send at once. The legal basis for both is Art. 6(1)(c), a legal obligation, not consent. Brevo receives your email address and the content of that message. A copy of every cancellation also goes to our own support mailbox (IONOS, below), as our record of it. Brevo also sends the email that confirms a waitlist sign-up: one message with a link that proves the address is yours, and, once you have confirmed, the emails you asked for. The legal basis is your consent, Art. 6(1)(a); we keep the time you confirmed as proof of that consent, Art. 6(1)(c) with Art. 7(1). Brevo receives your email address and the content of those messages. Brevo also sends the monthly email about your diving, if you switched it on (§ 2); the legal basis is your consent, Art. 6(1)(a). Brevo receives your email address and the content of that email. Brevo stores that data on servers in the EU — Google Cloud (France and Belgium), Scaleway and OVH (France) and Hetzner (Germany). Its own support, monitoring and group companies can reach the data from the United States, India and Canada; those transfers run on the European Commission's standard contractual clauses, the EU–US Data Privacy Framework, or an adequacy decision, and the full list is Schedule 1 of Brevo's data protection agreement. The emails about your account — the code or link that confirms your address, and a password reset — are also delivered by Brevo: Supabase hands them to Brevo as part of sign-in. Brevo receives your email address and the content of those messages; the legal basis is Art. 6(1)(b), because without them you cannot open or recover an account. Our replies to a message you send us come from our own mailboxes (IONOS, below).
Email to and from our own addresses: IONOS SE, Germany, hosts the mailboxes behind support@loggerfish.com and privacy@loggerfish.com, so a message you send us is stored on their servers as any email is.
Usage statistics: Umami, run by us on a server rented from Hetzner Online GmbH, Germany (hosting only) — no analytics company receives the data. This is on unless you switch it off, under Settings → Share anonymous usage statistics. We set no cookie and store no identifier for it, which is why it runs without asking first; switching it off there stops it immediately.
Error reports: stored in our database at Supabase (see "Account and sync" above), in a table that is not linked to any account: it has no user column, and the app sends the report with the app's public key only, not with your sign-in. Supabase, like any server, sees the IP address of the request, and we do not store the address. To stop one device flooding error reports, a salted fingerprint of the IP address is kept for at most 2 hours, then deleted: the database counts the reports and "session started" signals from each fingerprint per hour and refuses any beyond the limit. The salt is random, changes every day and stays inside the database; the fingerprint is never stored with a report and is used for nothing else. Our cancellation page does the same to stop abuse: a separate salted fingerprint of the IP address (for IPv6, of its /64 network) is kept for at most 2 hours, then deleted, to allow five cancellations an hour from one address. The legal basis is Art. 6(1)(f), our legitimate interest in protecting the page from abuse. On iPhone, Apple also collects crash and hang reports from people who chose to share analytics with app developers in iOS Settings (Privacy & Security → Analytics & Improvements); that is Apple's own setting, and Apple shows us only the technical report, not who sent it. Switching off Share anonymous usage statistics stops our error reports immediately.

3·1 Apple Health, on iPhone

On iPhone you can bring dives in from Apple Health instead of typing them, if you choose to. An Apple Watch Ultra and several dive computers write a dive there, and Loggerfish reads the ones you allow it to.

iOS asks you first, and the answer is yours. Nothing is read until you grant Health access in the sheet iOS shows, and you can withdraw it at any time in Settings → Privacy & Security → Health → Loggerfish. Withdrawing stops any further reading; dives already imported stay in your logbook, because by then they are your logbook.
We write only if you switch it on. With Save to Apple Health on (Settings › Import dives; off unless you turn it on, and iOS asks you first), Loggerfish adds each dive in your logbook to Apple Health as a diving workout: its start, end and duration, the water temperature and, where your dive computer recorded them, the depth over the dive and your heart rate. It never writes a dive twice, never writes back a dive that came from Health, and writes nothing else. Switching it off stops further writing and asks whether to keep the workouts Loggerfish saved or remove them; removing deletes only those. Writing sends nothing to us or anyone else: it is a copy on your phone, in Health.
What is read: the dive's start time, how long it lasted, how deep it was, and the water temperature. When importing, not your heart rate, not your workouts, not your medical records, not anything else Health holds.
Where it goes afterwards: an imported dive becomes an ordinary dive in your logbook, and is then treated exactly like one you typed — kept on your device, and in your account if you are signed in, so it syncs to your other devices.

Why we ask for this in the words the law uses. Data read out of a health app can count as data concerning health, which the GDPR protects more strictly than ordinary personal data (Art. 9). Whether a dive's depth and duration really amount to health data is arguable; we do not argue it. We treat this as needing your explicit consent under Art. 9(2)(a), which is exactly what the iOS permission sheet already asks for and what you can take back in the same place. It costs nothing to be on the careful side of that line.

Once imported, a dive is just a dive. It carries no mark saying it came from Health, which is deliberate — your logbook is one logbook, not a set of sources. It does mean we cannot pick out the dives that came from Health in order to delete or export only those: if you ask us for your data or ask us to delete it, you get all of your dives together, and each one can be deleted individually in the app.

If you never use the import, none of this applies and nothing is ever read.

3·1a Health Connect, on Android

On Android 14 and newer you can have Loggerfish save your dives to Health Connect, Android's own store for health and fitness data on your phone, if you choose to.

We write only if you switch it on. With Save to Health Connect on (Settings › Import dives; off unless you turn it on, and Android asks you first), Loggerfish adds each dive in your logbook to Health Connect as a scuba diving exercise session: its start and end time and, where your dive computer recorded it and you allowed it, your heart rate during the dive. It never writes a dive twice, never writes back a dive that came from Apple Health, and writes nothing else. Switching it off stops further writing and asks whether to keep the sessions Loggerfish saved or remove them; removing deletes only those.
We read nothing from Health Connect. Loggerfish does not ask for, and cannot use, permission to read any Health Connect data.
Writing sends nothing to us or anyone else: it is a copy on your phone, in Health Connect. Which other apps may read it is up to you, in Health Connect's own settings, where you can also withdraw Loggerfish's permission at any time (Health Connect → App permissions → Loggerfish).

The legal basis is the same as for Apple Health in §3·1: your explicit consent under Art. 9(2)(a) GDPR, given in Android's permission screen and withdrawn in the same place.

3·2 Dives downloaded from your dive computer, on iPhone

On iPhone you can download dives straight from a supported dive computer over Bluetooth, instead of importing a file, if you choose to. The supported dive computers are the Mares Sirius, the Shearwater Peregrine TX and the Aqualung i300C. Bluetooth download for the i300C is supported in the iPhone app from version 1.0.1.

iOS asks you first, and the answer is yours. The first time you tap Download from dive computer, iOS asks whether Loggerfish may use Bluetooth. Nothing is searched for or connected before you agree, and you can withdraw it at any time in Settings → Privacy & Security → Bluetooth → Loggerfish. Withdrawing stops any further download; dives already downloaded stay in your logbook.
Your phone talks to your dive computer, and to no one else. The connection runs between your iPhone and the dive computer you pick. Loggerfish does not send us, or anyone, anything about the device or its dives during the download. No third party is involved: the download uses Apple's Bluetooth system and an open-source library, libdivecomputer, which runs inside the app on your phone. Loggerfish does not use Bluetooth to find your position or to look for anything other than dive computers it supports.
What is read: the dive logs stored on the dive computer (date and time, depth, duration, water temperature, the depth profile and gas settings where the device stores them), the device's model and, if the device reports it, its serial number. Nothing else on the dive computer, and nothing from your phone.
What is kept, and where: a downloaded dive becomes an ordinary dive in your logbook, treated exactly like one imported from a file: kept on your device, and in your account if you are signed in, so it syncs to your other devices. The dive keeps the dive computer's model and serial number, so you can see which computer it came from; they sync with the dive like the rest of it. Loggerfish also keeps a small marker so that the next download fetches only the dives that are new: with each dive fetched, the dive computer's own identifier for that dive (its fingerprint) and the order the dives arrived in. It also remembers which Bluetooth device is which dive computer (by its serial number), so the next download finds it again. The marker stays on your phone. It is kept with the dive on your device only, never sent to us and never synced to your account, and deleting the app, or the dive, removes it.
If you ask us to delete or export your data, there is no copy of the marker on our side; each dive can be deleted individually in the app.

If you never use the download, nothing is read and Bluetooth is never used.

3·3 Buddy QR codes

Your QR code. You can make a QR code with your name and, if you add them, your agency, level and member number. These details are written into the code itself and kept with your settings. Anyone who scans the code can read them, so only add what you are happy to show.

Scanning. When you scan a code, the camera picture is read on your device and is never stored or sent to us. The camera is only on while the scanner is open.

Verifying and sharing a dive. These need an account. When you ask a buddy to verify a dive, or share one with them, we store a single-use code for 24 hours. For a share, the code holds the dive's date, time, place, depth, duration and water temperature, never your notes, photos or ratings, and no place when you hid it. When your buddy verifies, we store their name and the time with your dive, so you can see who verified it. Both of you can see that record. It is deleted with the dive or your account. Legal basis: Art. 6(1)(b) GDPR, because you asked for it.

3·4 Sending your dives to divelogs.de, if you choose to

divelogs.de is an online dive log run by Rainer Mohr, Hoffeld 10b, 83229 Aschau i. Ch., Germany. If you have an account there, you can send your logbook to it from Export → Divelogs.de.

Nothing is sent until you do it. Only when you type your divelogs.de username and password and press Send. There is no automatic upload and nothing runs in the background.
Your device talks to divelogs.de directly. The app sends the requests from your device to divelogs.de. They do not pass through Loggerfish's servers, and we do not receive your divelogs.de login, the dives you send or divelogs.de's answer. divelogs.de sees your IP address, as any website does.
What is sent: your divelogs.de username and password, once, to sign in. Then the app reads the list of dives already in your divelogs.de account, so that a dive already there (same date and start time) is not sent again. Then, for every other dive in your logbook: date and start time, duration, maximum and average depth, water temperature, site name, country and the site's coordinates, buddy, notes, the dive computer's model, the cylinders (gas mix, size, working pressure, start and end pressure) and the depth and temperature profile. Not your photos or videos, ratings, tags, signatures, the dive computer's serial number, certifications, the dive passport or your Loggerfish account.
Nothing is kept. Your password is cleared from the form as soon as it has been sent, and the sign-in token divelogs.de returns is held only in memory until the sending is finished. Neither is stored on your device or sent to us. If you share anonymous usage statistics, we count that a send happened and roughly how many dives it carried, never which.
After that, divelogs.de is responsible. divelogs.de is not our processor: it receives the dives as the service you chose and keeps them in your account under its own terms and privacy policy, as its own controller. To change or delete them there, use divelogs.de. Deleting a dive or your account in Loggerfish does not delete the copy at divelogs.de.
Legal basis: Art. 6(1)(b) GDPR, because you asked for the transfer. Your buddy's name and whatever you wrote in your notes go with the dive, so send only what you are happy for divelogs.de to hold.

If you never use it, nothing is sent to divelogs.de.

3·5 The buddy finder, if you list a trip

Nothing about you is shown until you list a trip, and only for that trip. In a trip of your own, Find a buddy lists it in the buddy finder. You choose the region you will dive in, from a list where we have one for the country. Other divers who have listed a trip in the same country and the same region, on dates that overlap yours, then see your card, and you see theirs.

Your card shows: your first name, your certification level, whether you dive nitrox, the languages you speak, and roughly how many dives your logbook in your account holds (such as "300+") and the deepest of them in whole metres (we count these; you do not type them). Divers who see it also see the country and region of your listing and roughly how much of their trip yours overlaps (all, most or part of it). They do not see your account name or email address, the trip's name or location, your exact dates, how many days your trips share, where you stay, or any of your dives.

Contact only after you both say yes. You can add a line saying how a buddy can reach you, such as a phone number or a handle. It is shown only to a diver you said yes to and who said yes to you, together with their trip dates and yours. Nobody learns that you said yes unless they say yes too. Saying yes does not make you buddies in Loggerfish: that happens only if you both choose Add as buddy, and the "Buddies" row in § 2 applies from then on.

For divers aged 18 or over. You confirm this when you make your card, and we store when you did.

Reporting and blocking. You can report or block any card, and for 30 days after your trip you can still report a diver you both said yes to. A report stores who reported whom, the reason, your note, and the card as you saw it, including the contact line, so that a person at Loggerfish can decide on it; the diver you report is not told who reported them, and they are blocked for you. A block hides you from each other on every trip, removes every "yes" between you and ends a buddy link between you; the blocked diver is not told, and you can undo it in Settings. If we remove a diver from the buddy finder after a report, their card, listings and answers are deleted and they cannot make a new card until we lift it. Names, regions and contact lines are checked against a list of offensive words before they are stored.

How long. A listing ends with its trip: it is no longer shown once the trip's last day has ended, and is deleted that night. It is also deleted at once when you stop listing the trip, delete the trip, move it to another country or delete your card. When you and another diver have both said yes, we keep that you did, and whether either of you chose Add as buddy, until 30 days after the later of your two trips ends. To limit how often a listing or an answer can be changed, we count these changes for one day. Your card stays until you delete it ("Delete my card") or your account. A report is deleted one year after we have decided on it; one we have not decided within 90 days is closed then. Reports about you are deleted when your account is. A removal from the buddy finder stays until we lift it or the account is deleted.

Legal basis: Art. 6(1)(b) GDPR, providing the feature you chose to use; for reports, blocks, the word check and the limits on changes, Art. 6(1)(f), our and our users' legitimate interest in a buddy finder that is safe to use, and Art. 6(1)(c) where the Digital Services Act requires us to act on reports. Everything is stored with Supabase in Frankfurt, like the rest of your account (§ 3), and nobody else receives it.

3a. Your public profile, if you turn it on

A diver profile is off until you switch it on, and each thing it can show is a switch of its own. While it is off the page does not exist: asking for it gets the same answer as asking for a handle nobody has, so the address cannot be used to find out who has an account.

Switching it off takes the page down at once. What it cannot do is un-publish what has already been seen — a search engine that copied the page may keep showing an old copy for a while, and anyone who read it has read it. That is true of anything public on the internet, and it is the honest thing to say before you switch it on rather than after.

Your handle stays yours once you have used it, even after you turn the profile off. It is only released when you delete your account. This is deliberate: if handles went back into the pool, somebody else could claim yours and every link anyone had ever shared would then point at a stranger's page wearing your name.

If you have Pro, you can show a small mark next to your name: "Pro", or "Founding Diver" with your number. It shows nothing else, never your plan, price or dates, and it is not shown during a free trial. To the buddies you have linked with, in the buddy feed, it is on by default; you can turn it off at any time under Settings → App → "Show my Pro mark", and it disappears from their feed straight away. Legal basis for this: Art. 6(1)(f) GDPR, our legitimate interest in showing that a diver supports Loggerfish; switching it off is your objection under Art. 21, and we honour it without asking why. On your public profile it is off until you switch it on, like everything else the profile can show (Public profile → Show on my profile → "My Pro mark"). Legal basis for this: Art. 6(1)(a) GDPR, your consent, given by switching it on and withdrawn by switching it off.

3b. Searching for dive sites near you

Typing a dive site's name sends nothing. The app carries OpenStreetMap's named dive sites with it — a few thousand of them, as of the date shown on the dashboard's nearby card — so when you type into the site field, the search runs on your device and no server is asked anything. That is true offline, on a boat, in aeroplane mode.

One thing does leave your device, and only when you ask for it. When you use Search nearby to find dive sites around you, your device asks the OpenStreetMap Overpass API (overpass-api.de, run by Roland Olbricht in Germany) for the dive sites in a radius, and sends the coordinates it is searching around in order to do it.

Be aware of what this one sends. If you have not typed coordinates in yourself, the app asks your device for your position first, so the coordinates sent are where you actually are, not the part of a map you happen to be looking at. Overpass also sees your IP address, as any server you contact does. It sends back public map data and nothing that identifies you, and nothing about your logbook, your account or your name is sent with the query.

Overpass is a free public service, not a company we have engaged: it acts for itself, not on our instructions, so there is no data-processing agreement with it and we cannot make commitments on its behalf. We send the query only because you asked for a search, which is the legal basis for it (Art. 6(1)(b)); the feature is never used on its own. If you would rather not have your position leave your device, do not use Search nearby — everything else in the app works without it, and typing a site name searches the list on your device, as above.

3c. The maps of your dive sites, which are Apple Maps

The maps that show where you have dived — the Logbook's dive-site map, the dashboard's two site maps and the trip map and the site map in the dive form — are drawn by Apple Maps, using Apple's MapKit JS. While one of them is on screen your browser talks to Apple directly, and Apple receives:

the part of the world the map is showing — the area, and how far in you have zoomed. That is where your dives are, not where you are now: the map is drawn from the coordinates already in your logbook, and your device is never asked for your position to draw it;
your IP address and the ordinary details of a web request (browser, language, and so on), as any server you contact sees;
the name and country of a dive site you typed in without a position, once per site, when the app looks it up to put it on the map (see below);
Apple's own measurement of the map's use. MapKit reports back to Apple how the map was used, to an analytics endpoint on apple-mapkit.com (/mw/v1/reportAnalytics). That is Apple counting its own service, and we see none of it.

Nothing else from your account or your logbook is sent, with one exception. Not your name, not your email address, not a dive, not a note. Apple is given coordinates to centre a map on and nothing that says whose they are. The exception: if you typed in a dive site that has no position, the app asks Apple Maps' search once where it is. It sends only the site's name and its country (for example "Kreidesee Hemmoor, Germany"), never your position or any other part of the dive, and never a site you have hidden. If Apple finds a match, that position is saved on the site's dives, and you can move it.

If Apple's map cannot be loaded, nobody else receives anything. MapKit JS is fetched from Apple and needs a token; if the script does not load, the token is refused, or Apple's service is unreachable, the app does not leave an empty box — it draws the world from outlines shipped inside the app and puts your dive sites on top of them. That drawing asks no server for anything, so in that case there is no recipient at all. Until 15 October 2026 that fallback was built from map tiles fetched from Thunderforest, and this policy said so; § 3's map note records that change.

The legal basis is Art. 6(1)(b) — performing the contract — the same as the rest of your logbook in § 2. Showing you where you have dived is part of the logbook you came for, and a map of the world cannot be drawn without asking somebody for it. Which provider it is remains our choice, and § 3c exists so that choice is one you can see rather than one that happens to you.

Apple acts for itself here, not on our instructions. Its Maps terms say Apple's handling of data "will be done in accordance with its publicly posted Privacy Policy", and that "Apple may collect and use data related to user activities in connection with the Service" — which is Apple pursuing its own purposes, not ours. So there is no data-processing agreement with Apple for the map, none is offered, and we cannot make promises on Apple's behalf. What Apple does with what it receives is governed by Apple's privacy policy: https://www.apple.com/legal/privacy/.

Nothing is sent until the map comes into view. The Logbook is built as soon as you open the app, but the map waits: it asks Apple for nothing until it is scrolled to, or nearly — within about 200 pixels of the screen. So if you use the Logbook and never scroll down to the map, Apple is never contacted at all. (On a browser too old to support that, it loads straight away.)

We use it because a map that reads well is worth having, and because the alternative tiles are drawn by another company that would see much the same thing.

4. Transfers outside the EU/EEA

Cloudflare and Google are US companies. Their agreements with us carry the European Commission's Standard Contractual Clauses, and both are additionally certified under the EU–US Data Privacy Framework: Cloudflare, Inc. and Google LLC each appear on the U.S. Department of Commerce's Data Privacy Framework List, checked on 15 October 2026.
Apple is not certified under the Data Privacy Framework, and this policy said otherwise until 15 October 2026. Apple's own privacy policy names the Standard Contractual Clauses and does not mention the Framework, and Apple does not appear on the Data Privacy Framework List. What protects an Apple transfer is therefore the clauses alone.
Apple Maps is a separate case from Apple's other roles here. Apple's privacy policy says personal data of people in the EEA, the UK and Switzerland "is controlled by Apple Distribution International Limited in Ireland", and that its international transfers are "governed by Standard Contractual Clauses". So the controller for the map data is Irish, and what leaves the EEA from there does so on those clauses — Apple's, not ours, because Apple is not acting on our instructions (§ 3c).
Stripe is the same in practice but not on paper: our contract is with Stripe Payments Europe, Limited, in Ireland, and it is that company which passes data to its American parent — on the Standard Contractual Clauses, and the parent, Stripe, LLC, is certified under the EU–US Data Privacy Framework.

5. How long we keep data

Account and log: until you delete your account. Deletion in the app is immediate and cascading. The trial marker below, and the Google Play buyer marker if you bought through Google Play, are kept after deletion on purpose.
Deletions made on one device are kept for 30 days as a marker, so your other devices learn that the dive was deleted, and are then removed entirely.
Backups: we keep an encrypted copy of the database, on a server in Germany, for at most 30 days, and then it is deleted. Deleting your account removes you from the live service at once; a backup taken before that is overwritten within those 30 days.
Dive-professional verification: the card photo and the member number until we decide on your request, then they are deleted; a photo that never became a request is deleted after a day. The outcome is kept with your account.
Usage statistics: 24 months, then deleted.
Error reports: 90 days, then deleted automatically. The salted fingerprint of the IP address that limits them, and the one that limits the cancellation page: at most 2 hours.
Sign in with Apple token: kept until you delete your account; at deletion it is sent to Apple to be revoked and then removed with the account.
Feedback: until you delete your account. Reviews: until you delete the review or your account.
Reports about a review: until the review is deleted, and in any case no longer than six months after the moderation decision on it.
Moderation notices and appeals: the notice telling you of a decision about your review, and any appeal you write against it, are kept two years after the decision, or until you delete your account if that comes first.
Trial marker (the hash of an email address, § 2): 24 months after the trial started, including after the account is deleted, because that is the case it exists for.
Google Play buyer marker (§ 2): for as long as a purchase naming the account could still be put back on a new one — for a lifetime licence, that is for good — because that is the case it exists for.
Support messages: two years after your request is closed.
Cancellations sent through the cancellation page: three years from the end of the year in which we received them — the general limitation period (§ 195 BGB), for as long as either of us might need to prove when the contract ended.
Invitations (buddy, trip and duo links): deleted 30 days after they expire.
QR codes for verifying or sharing a dive: 24 hours. Verifications: as long as the dive.
Buddies: a shared dive stays until you stop sharing it (in the feed or on the dive), delete the dive, or delete your account — deleting the dive takes the shared copy out of your buddies' feeds at once. Unlinking a buddy hides everything from them at once. Kudos stay until the person who gave them takes them back, or the shared dive goes. Your buddy name stays until you delete your account. "Dived together?" questions and answers stay until either dive or either account is deleted. Unused invite codes: 30 days after they expire, as above.
Buddy finder (§ 3·5): a listing until the night after its trip ends, or until you stop listing it; a match (that you both said yes, and whether either of you chose Add as buddy) until 30 days after the later of the two trips ends; the count of listing changes and answers for one day; your card until you delete it or your account; a report one year after it is decided, and one not decided within 90 days is closed then; reports about you are deleted with your account.
Shared trips: a guest sees the trip until they leave it, you remove them, you delete the trip, or either account is deleted. An invite code works for 14 days and is deleted 30 days after that, as above.
Referrals: the record of who referred whom is deleted with either account. The months a referrer earned stay with the referrer's account until it is deleted. A creator's name, code and agreement are deleted with the creator's account.
Gifts you bought: the name and message you typed are deleted with your account; the gift code itself stays valid, so the person you gave it to can still redeem it.
Payment events received from Stripe are kept 90 days, only to recognise a repeat.
Unconfirmed waitlist addresses: 30 days after the confirmation email (or after sign-up if none was sent); the confirmation link works for 7 days.
Monthly email: your choice and the record of each email sent (month, time, language) are kept until you delete your account.
Accounting records: as long as German tax and commercial law requires — currently up to ten years (§ 147 AO, § 257 HGB).
Server logs: as short a period as the provider allows, in the order of days.

6. Your rights

You can ask for access (Art. 15), correction (16), deletion (17), restriction (18), a portable copy (20), and object to processing based on legitimate interests (21). In the app you can export everything — as an Excel file, as UDDF (the format other dive logbooks read), or as a full backup — and delete your account yourself. You can withdraw consent at any time. You may complain to a supervisory authority, for example the one in your federal state.

We answer within one month. Contact: privacy@loggerfish.com.

7. Website and app storage

The website and app store your settings (theme, language, your log while offline) on your device. Dive profiles are kept in your account with their dive when you are signed in, so they appear on your other devices; without an account they stay on your device. Deleting a dive or your account deletes its profile.

Photographs stay on your device (or in your own iCloud Drive, if you turn on photo sync). Dive photos and videos, and the photo of a certification card you add to show at a dive centre, are stored only in your browser's storage on that device: they are not uploaded, not in the account, not in backups taken by us, and not in the Excel export. The one exception is the photo of a pro card you send to be verified as a dive professional (section 2): that one is uploaded, and deleted again once we have decided. On iPhone and iPad, Pro can also keep your photos in your own iCloud Drive, if you turn on "Sync photos with iCloud" in Settings, so they appear on your other iPhone and iPad. Apple stores them under your iCloud account and terms; they never reach Loggerfish, and we cannot see them. Videos are not synced. Turn the switch off to stop; photos already in your iCloud Drive stay there until you delete them. In the iPhone app, Pro can suggest the sea life in the photos you add to a dive; your iPhone recognises it itself, using Apple's on-device image recognition, and the photos are not sent anywhere. In the Android app it is the same: your phone recognises the sea life, and reads a certification card or a logbook page you photograph, itself, with Google's ML Kit on the device, and neither the photos nor the text are sent anywhere. ML Kit runs inside Google Play services, which may send Google technical figures about how the recognition ran (never a photo or its text), as it does for every app that uses it.

The dive passport stays on your device. Your insurance details and, if you agreed, the dates and photo of a medical fitness certificate are stored only in your browser's storage on that device. They are not uploaded, not in the account, not in our backups, not in the Excel export and not in the usage statistics. "Remove" in the passport, resetting your logbook and deleting your account each delete them from the device where you do it; another device keeps its own copy until you remove it there. Your phone's own backup of the app may contain them, as it contains the rest of the app's storage on that device. When another account signs in on a device, what the first account stored there is removed, and while no account is signed in it is not shown.

The app no longer stores map images. The maps are Apple's (§ 3c), and the app keeps no copy of them. A device that used the app before 15 October 2026 may still hold map images fetched from Thunderforest at the time; the app no longer reads them, nothing in them identifies you, and clearing the site's data in your browser removes them.

Usage statistics store nothing on your device except whether you switched them off, and use no cookies. The app also remembers on your device when it last asked for feedback, how many dives you have logged by hand, on how many days you have opened it, and whether you have imported dives, so it asks at a sensible moment and not too often. None of this leaves your device.

Reminders in the iPhone app are set up on your device. If you allow notifications, the app can remind you when a trip has ended, when gear is due for service, when a certificate or document is about to expire and when your Pro trial is about to end. They are worked out from the data already on your device and handed to the operating system's own local notifications; no push service or server is involved, nothing about them is sent to us or to anyone else, and you can switch each kind off in Settings or all of them in the iPhone's Settings. Fonts are self-hosted. The only script the app loads from anyone else's server is Apple's MapKit JS, which draws the maps of your dive sites (§ 3c).

8. Age

Loggerfish is for people aged 16 or over. The buddy finder (§ 3·5) is for people aged 18 or over.

9. Changes

We will tell you about material changes by email or in the app before they apply.

← Loggerfish