Privacy policy

01

Who we are

Loadout Ledger is published by The Phalanx Project LLC, a limited liability company in Honolulu, Hawaii, United States ("we", "us"). This policy covers the Loadout Ledger app for iPhone, iPad and Android, the web app at loadoutledger.com/app, the optional cloud account behind them, and this website.

Our general policy at thephalanxproject.co/privacy covers our company website and the commitments every one of our apps keeps. This page is Loadout Ledger's own policy and describes exactly what this app collects. Where the two differ, this page controls for Loadout Ledger.

02

On your device, with no account

Loadout Ledger works fully with no account. Choose Continue on this device and everything you enter stays on that device.

• Your records live in an encrypted database (SQLCipher, AES-256) whose key is generated on the device and kept in the iOS Keychain or the Android Keystore, readable only on that device. Photos, manuals and documents sit in the app's own private storage, under iOS Data Protection on iPhone and iPad and the device's encryption on Android.
• The app never opens a connection to us without an account. Nothing about your records, your collection or your use of the app is sent to us.
• Search, statistics, reports and the insurance PDF are all worked out on the device.
• Maintenance reminders are local notifications scheduled on the device. By default they never name a firearm; naming it is an opt-in under More.
• The camera and photo library are used only when you add a photo, a document or scan a barcode, and the pictures stay on the device. On Android, photos come through the system photo picker, so the app never gets access to the rest of your library. Face ID and Touch ID are handled by iOS, and fingerprint or face unlock by Android; the app only learns whether the check passed. The app never asks for or records your location.

Without an account, the app uses the network in only three ways. First, features you tap that name where they go: Use manufacturer photo, Fetch manufacturer photo and Search the web for a photo, described under Photos from the web. Second, on iPhone and iPad, Apple: when the app opens it asks the App Store, through Apple's StoreKit, whether your Apple ID has a Loadout Ledger Pro subscription. That exchange is between your device and Apple, carries nothing from your records, and does not reach us. The Android app does not sell Pro yet and makes no such check. Third, on Android, Google: when you scan a barcode, Google's ML Kit reads it on your device and sends Google diagnostic information about how the scanner ran: device and app details, an identifier, performance measurements and error codes. That information does not reach us.

03

The optional cloud account

An account lets you sync between your phone and the web app and keeps an encrypted copy of your vault. It is optional, and nothing uploads until you create one or sign in.

What you give us

A username (3 to 32 letters, digits, dots, underscores or hyphens) and a password. We do not ask for an email address, a phone number or your name.

Your password never reaches us

Your device turns the password into a master key (PBKDF2-SHA256, 600,000 rounds) and sends us only a verifier derived from that key, which we store as a further scrypt hash. The master key protects a random vault key, and only the wrapped, unreadable form of the vault key is stored with your account. Because nobody but you holds the password, there is no password reset: we cannot recover a forgotten password or open your vault for you.

Encrypted before it leaves

Every record that syncs is sealed on your device under the vault key (XChaCha20-Poly1305) before upload, and photos, stored manuals and documents are encrypted the same way. All traffic also travels over TLS.

What the service can see

Account

Your username, when the account was created, and your plan (Free or Pro), where the plan came from, and when it ends.

Devices

Each signed-in device's random id, a generic name such as "iPhone" or "Web (Safari on Mac)", its platform, and when it was last seen. Sign-in tokens are stored only as hashes.

Records

For each synced record: what kind of record it is (such as firearm or range day), a random id, a version number, and when it was changed or deleted. The contents are ciphertext.

Files

For each photo, manual or document: a random id, its size in bytes, and when it was stored. The file itself is ciphertext.

Totals

How many records and how many bytes your account holds.

What it never receives: your password, your master key, your vault key, or the readable contents of any record or file. No serial numbers, makes and models, values, notes, photos or range history reach us in a form we can read.

When sync runs

Only while you are signed in: when the app opens, a few seconds after a change, and when you tap Sync now. An open web app also checks for changes every 30 seconds and when its tab comes back into view.

Deleted records

When you delete a record, the deletion syncs to your other devices. The encrypted copy of that record, and of any file it held, stays in the cloud, still unreadable to us, until you delete the cloud account.

Signing out

Signing out forgets the vault key and the sign-in token on that device. The records on the device stay there.

04

The web app

The web app at loadoutledger.com/app uses the same account. It unlocks your vault inside your browser: your password, master key and vault key are used only in the page, and records are decrypted there, never on our servers.

• The sign-in token and the vault key are kept in your browser's local storage, so an installed web app stays signed in. A copy of the vault, sealed under your vault key, is kept in the browser's IndexedDB so the app opens quickly and works offline. Lock forgets the key, which leaves that copy unreadable; Sign out deletes the copy.
• Its offline cache holds only the app's own files, never your records or anything the service sends back.
• This website and the web app set no cookies. Their fonts load from Google Fonts, so Google receives your IP address and browser details when a page loads. The phone app carries its fonts inside the app.

05

Research and barcode lookup

Two Pro features ask our service to look something up for you. Both need a synced account and run only when you ask: the service never forwards a request from an account without Pro.

Research with AI

When you tap Research with AI on a firearm, the app sends our service that firearm's maker, model, variant, caliber and type. Nothing else from the record goes with it: no serial number, price, notes or photos. Our service asks Anthropic (Claude), with Anthropic's web search tool, to research that model. The answer is shown to you and is written to your record only when you tap to apply it.

Ammo barcode lookup

When you scan a box with Scan a box or type its code, the app first checks codes this device already knows. Otherwise it sends our service the barcode digits, and nothing else. Our service asks UPCitemdb, a product barcode database, for its listing of that code and may ask Anthropic to read the listing. If UPCitemdb has no listing, Anthropic's web search looks for the code. Your device remembers each product it identifies, so the same box is not looked up again.

What the processors receive

Anthropic and UPCitemdb receive these requests from our servers, not from your device, and receive nothing that identifies you or your account: only the make, model, variant, caliber and type, or the barcode (with UPCitemdb's listing, when Anthropic reads one).

Shared answers

Answers are stored by what was asked, not by who asked. A model's research is kept for 30 days and a barcode's answer for a year, and either is returned to any account that asks the same question. The stored answer does not record which account asked.

What we keep about your requests

• To enforce the daily limit, a note that your account made a research request and when, without what was asked.
• While a request is being worked on, a job record that names your account and what is being researched. It is cleared when the work succeeds or is asked for again.
• Operational logs, described under Keeping and deleting.

06

Photos from the web

These work with or without an account, and only when you tap them. Each request goes straight from your device to the service named, so that service sees your device's IP address. Their own privacy policies apply.

Manufacturer photo

Use manufacturer photo (adding a firearm) and Fetch manufacturer photo (on its record) download one product image for the catalog model you picked, from a fixed address built into the app: the manufacturer's own website or the image server it uses. The request carries no identifiers, no search terms and no cookies, so the manufacturer learns only that a device asked for that image.

Search the web for a photo

Search the web for a photo sends your search words (filled in with the make, model and variant, which you can change) to Wikimedia Commons (commons.wikimedia.org) and Openverse (api.openverse.org). Result thumbnails load from those services, and the image you pick downloads from where it is hosted: Wikimedia, Flickr, or another source Openverse indexes. The image is stored with its credit and license.

Links you open

A manual link, a research source or the web app opens in your browser when you tap it, and that site then sees the visit like any other.

07

App Store subscriptions

Loadout Ledger Pro is sold through the App Store. Apple handles payment; we never receive your card details, your billing address or your Apple ID. Apple's own privacy policy covers what Apple collects when you buy.

Without an account, your subscription stays between your device and Apple. When you are signed in to a synced account, the app passes the service Apple's signed record of your subscription when you subscribe, restore purchases, or open the app. The service trusts it only if Apple's signature checks out, reads the product, the transaction ids and the expiry, and keeps these with your account so Pro reaches the web app:

• the plan (monthly or yearly)
• the original transaction id, so one subscription can make only one account Pro
• when it expires, and the refund date if Apple refunds it
• whether it was a test purchase in Apple's sandbox

The Android app does not sell Pro yet and does not contact Google Play about purchases. Signed in to a synced account that has Pro, it shows Pro on Android too.

08

What we never do

• No advertising, and no advertising identifiers.
• No analytics, usage tracking or session recording of our own, in the app or on this website.
• No crash reporting or diagnostics sent to us.
• No tracking across other companies' apps or websites.
• No selling or renting of personal information, and no sharing it for advertising.
• No location: no GPS, no range check-ins.
• No public profiles, feeds or searchable serial numbers.

09

Service providers

These companies run parts of the service for us and receive only what is described here.

Netlify

Hosts this website, the web app and the cloud service. Like any host, it processes your IP address and request details to deliver each request.

Supabase

Runs the cloud account's database and its private file storage, in the United States. It holds what is listed under What the service can see and the encrypted records and files. Encrypted files move directly between your device and Supabase storage through short-lived signed links.

Anthropic

Research and barcode reading, as described under Research and barcode lookup.

UPCitemdb

Barcode digits only, from our servers.

Apple

App Store payments and subscriptions, under Apple's privacy policy.

Google Play

Distributes the Android app. Google's privacy policy covers what Google Play collects when you install or update it.

Google ML Kit

Reads barcodes on the Android app, on your device. Google receives the scanner diagnostics described under On your device.

Google Fonts

Fonts for this website and the web app.

Photo sources

Manufacturers, Wikimedia Commons, Openverse and the hosts of the images you pick, directly from your device and only when you use those features.

Our service uses your IP address only in memory, to limit sign-in attempts and research requests, and does not store it. Information is processed in the United States.

10

Keeping and deleting

• On your device: your records stay until you delete them or remove the app.
• In the cloud: until you delete the cloud account. In the app, open More›, then Synced account and tap Delete cloud account. In the web app, open Account and tap Delete account. This removes the account and everything the cloud holds for it: every encrypted record and file, the wrapped vault key, devices and sign-in tokens, the plan, App Store subscription records and research usage notes. The records on your devices stay until you remove them there. Deleting the account does not cancel an App Store subscription; cancel that in iOS Settings.
• Shared answers: research and barcode answers are not tied to an account. Research answers expire after 30 days, barcode answers after a year.
• Logs: our service writes operational logs: each request's path, status and timing; the account id on account events such as creation, sign-in, sync and deletion; and for research, the make, model and variant or the barcode being looked up. They never contain your password, your username, your IP address or the contents of your records. Netlify keeps them for a limited period.

11

Export

Your records are yours to take at any time, account or not. Open More›, then Backup and restore and tap Export all data for a zip with every record (armory.json and CSV views) and every photo, manual and document, with the insurance PDF if you choose. The web app has the same export. The file is not encrypted, so keep it somewhere you trust.

12

Your rights

You can see, correct, export and delete your records yourself in the app, and delete the cloud account at any time. Because we cannot read your records, the app is the only way to see them. For any other request, such as what account information we hold, write to us through the form below; we may need to confirm the account is yours before acting. Depending on where you live, including California and the European Economic Area, you may have further rights under local law, and we will not treat you differently for using them. Our general policy explains these in more detail.

13

Children

Loadout Ledger is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

14

Changes

If what the app collects or sends changes, we will update this page and its effective date before the change ships, and call out significant changes in the app.

15

Contact

Write to The Phalanx Project LLC through our contact form at thephalanxproject.co/support and choose Loadout Ledger. Never send your password, serial numbers or other vault contents; we never need them.