MyDiveLogPrivacy policy
Effective 22 August 2026 · last updated 22 August 2026
In short. MyDiveLog keeps your dives on your device. It collects no usage statistics, shows no advertising and profiles nobody. Data leaves your device in three cases only, all optional and all started by you: if you sign in, if you press Sync, if you ask for an AI analysis. This website uses no cookies and no analytics.
1. Data controller
The data controller is Matteo Ferrando, a private individual, reachable at m.ferrando@gmail.com. MyDiveLog is a personal, free project, not a commercial activity.
2. Where your data lives
The application stores everything in an archive on the device you are using: a SQLite file on Mac and iPhone. It holds your dives, sample-by-sample profiles, equipment, certifications, settings and any analyses already produced.
Credentials — the sign-in session, any token for a database of your own, any Anthropic API key — live in the system keychain, not in the archive. None of them is ever sent to the controller.
3. When data leaves your device
Three cases, all optional. If you enable none of them, nothing leaves.
| If you | What leaves | Who receives it |
|---|---|---|
| Sign in with Google | The code Google returns and, as a result, your Google identifier and email address | Google and the MyDiveLog sign-in service |
| Press Sync | Dives, profiles, equipment, certifications, shared settings and the deletion record | The database you are using, yours or created by the service |
| Ask for an AI analysis | The measured data of the dive being analysed | Anthropic, using the API key you entered yourself |
Dives never pass through the sign-in service: they travel directly between the application and the database.
4. What the sign-in service handles
The sign-in service is the only part of MyDiveLog that runs on a server. It does three things: it verifies who you are, it creates your database the first time, and it hands out a key that lasts two hours.
It receives from Google a signed token containing a stable identifier for your account
(sub) and your email address. From that identifier it derives a
cryptographic fingerprint, and uses it as the name of your database. The email
address is returned to the application so it can be shown in the settings, and is
not stored by the service.
There is no table of users, and therefore no record linking an email address to a logbook. The only trace of your existence is a database with an opaque name.
The service logs technical errors so they can be fixed. Those logs are retained by the infrastructure provider for a limited period and contain no dives.
5. Providers
To run the optional parts described above, the controller relies on the following providers, acting either as processors on the controller's behalf or as independent controllers.
| Provider | Purpose | When it applies |
|---|---|---|
| Cloudflare | Hosts this website and the sign-in service | Always, for the site; at sign-in, for the service |
| Turso | Hosts the shared databases | Only if you sync |
| Verifies your identity | Only if you sign in with Google | |
| Anthropic | Generates the written analyses | Only if you enter an API key and request an analysis |
Databases are hosted in a group located in the European Union (Ireland). The relationship with Anthropic is governed by the API key you entered yourself: it is your relationship, under the terms you accepted with them.
6. Legal basis
Processing related to sign-in and synchronisation is based on the performance of the service you requested (Art. 6(1)(b) GDPR): without that data the service cannot work. Use of the AI analyses is based on your consent, given by entering the key and starting an analysis, and withdrawn by removing the key.
A dive logbook can say something about your physical condition. This data is not processed for health purposes, is not disclosed to anyone and is not used for profiling; it stays in your archive and, if you choose, in your database.
7. Retention and deletion
The archive on your device lasts until you delete it, by uninstalling the application or removing the file. The shared database lasts until you close your account.
In the application settings, Delete account destroys the remote database and the dives on it. The archive on your device is left untouched: closing your account stops synchronisation, it does not take away your logbook. You can also write to the address at the top of this page.
The sign-in session expires after thirty days; database keys after two hours.
8. Your rights
You have the right to access your data, correct it, erase it, restrict its processing, object, and receive it in a machine-readable format. For most of these you need to ask nobody: the application already contains full export in JSON and UDDF, editing of any field, and account deletion.
For anything else, write to m.ferrando@gmail.com. If you believe the processing infringes the Regulation, you may lodge a complaint with your supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
9. Transfers outside the EU
Some of the providers listed above are based in the United States and may process data outside the European Union, under the safeguards set out in Chapter V of the GDPR (standard contractual clauses and, where applicable, the adequacy framework in force). Dive databases are hosted in Ireland.
10. Security
Traffic is encrypted. Credentials live in the system keychain rather than in the archive, because archives end up in backups. The key that opens the database lasts two hours and is never written anywhere: it exists only in the application's memory. Each person has a database physically separate from everyone else's.
No measure is perfect. If you find a security problem, please write to the address above rather than publishing it.
11. Children
MyDiveLog is not directed at children and does not knowingly collect data from anyone under fourteen. A young diver should use it together with a parent.
12. This website
These pages are static files. There are no cookies, no analytics, no fonts loaded from third parties and no sharing widgets. The provider hosting them records incoming requests for technical and security reasons, as any server does.
13. Changes
If this policy changes, the date at the top is updated and the previous version remains readable in the public history of the repository. Substantial changes are also announced inside the application.