Legal
Privacy Policy
Last updated: 30 May 2026
Decision Log (“we”, “us”, “our”) is operated at adrlog.app. This policy explains what data we collect, why we collect it, and how you can control it.
1. Data we collect
We collect the minimum data needed to operate the service:
- Account data — your email address and, optionally, a display name provided during sign-up.
- Content data — decisions, comments, attachments, and workspace settings you create inside the product.
- Usage data — page views and feature interactions, collected in aggregate to understand how the product is used. We do not build individual profiles.
- Technical data — IP address, browser type, and device type transmitted automatically with every request.
2. How we use your data
- To authenticate you and maintain your session.
- To store and serve your decisions and workspace content.
- To send transactional emails (e.g. review reminders, invite notifications).
- To improve and debug the product using aggregated usage signals.
- To comply with legal obligations.
We do not sell your data to third parties or use it for advertising.
3. Cookies & local storage
We use only essential cookies — those strictly required for the service to function. We do not set advertising, analytics, or cross-site tracking cookies.
If you click “Accept all” in our cookie consent banner, we use Google Analytics (GA4) to collect anonymous usage data — page views and key in-app actions — to help us understand how the product is used and improve it. No personally identifiable information is sent to Google Analytics. You can opt out at any time by clicking “Essential only” in the cookie banner, or by clearing your browser’s local storage for adrlog.app.
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sb-access-token | HTTP Cookie | 7 days | Stores your authentication session token so you remain signed in across page loads. HTTPOnly and Secure — not accessible to JavaScript. |
| auth_next | HTTP Cookie | 5 minutes | Holds the intended destination URL during the OAuth / email-link login flow so you are redirected to the correct page after authentication completes. Deleted immediately after use. |
| cookie_consent | localStorage | Persistent | Records that you have acknowledged this cookie notice so the banner is not shown on every visit. Stored in browser localStorage, not sent to our servers. |
| theme | localStorage | Persistent | Remembers your light/dark/system theme preference so the correct theme is applied before the first paint and across sessions. Stored in browser localStorage, not sent to our servers. |
4. Data sharing
We share data only with the sub-processors required to run the service:
- Supabase — database, authentication, and file storage (EU / US regions).
- Vercel — hosting and edge network.
- GitHub — only when you connect a repository. We request the minimum OAuth scopes needed for the integration.
We do not share your data with any other third party without your explicit consent.
5. Data retention
We retain your data for as long as your account is active. If you delete your account, all personal data and workspace content is permanently deleted within 30 days. You can request deletion at any time by emailing us (see section 8).
6. Security
All data is encrypted in transit (TLS 1.2+) and at rest. Session cookies are HTTPOnly and Secure, preventing JavaScript access. We follow security best practices and promptly address reported vulnerabilities.
7. Your rights
Depending on your jurisdiction you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your data.
- Export your data in a portable format.
- Object to or restrict certain processing.
To exercise any of these rights, contact us at the address below.
8. Contact
Questions or requests about this policy: privacy@adrlog.app.
9. Changes to this policy
We will post any material changes to this page and update the “Last updated” date above. Continued use of the service after changes are posted constitutes acceptance of the updated policy.