Tenon Log — Privacy Policy

Who is responsible

Tenon Log is made by Erkam Demirci, an independent software developer established in Türkiye, trading as Tenon Tools. There is no company data department; the person who answers a privacy question is the person who wrote the code.

For privacy questions, corrections, or any request under the rights listed further down, use the contact route on the Tenon Tools support page at tenon.tools/support.

The location in your photos — read this one

Every photograph Tenon Log takes has the date, the time, the project and your position burned into the image itself: the coordinates, and the street address the phone derives from them. Not attached as metadata that a re-save would drop — drawn into the pixels, permanently.

That is the point of the stamp. A site diary is worth something because a photo in it can be placed at a time and a place months later, in front of a client or an insurer, and survive being forwarded through WhatsApp or a portal. It is also the single most privacy-relevant thing this app does, so it is stated here in plain words rather than buried in a table.

Two consequences worth being deliberate about. Tenon Log ships no stamp editor, so unlike Tenon Cam there is currently no in-app switch to leave the location off a shot. And because the location is IN the image, every copy of that photo carries it — including one you share.

• To get the address, the coordinates are handed to the phone's own geocoder — Apple's on iOS, Google's on Android. That is a request to the platform, and the platform's own privacy terms govern it.
• The photograph itself is never sent anywhere in that exchange, and never uploaded at all.
• If you deny the location permission, or no fix is available, the stamp simply omits those lines and the capture still works.

What stays on your device, always

Everything you write is stored locally and is never transmitted. That is not a promise layered on top of a server — there is no server, no account and no sign-in, so a day''s record has nowhere to be uploaded to.

The diary is a database file on your device, with an automatic local backup and an export you can put where you like. Deleting the app deletes it.

• Day entries: work performed, materials and equipment, obstructions and delays (Behinderungen), incidents and notes
• The crew: the names you pre-enter, each person's standard hours, and the hours recorded against a given day
• Photographs, with the stamp already burned in and a SHA-256 hash of the file sealed alongside
• Signatures captured on the glass, with the signer's name and role
• Projects, their client and site address, and the PDF reports generated from all of it

The five things that do use the network

None of them carries a diary entry, a photograph or a signature.

• Update check — on launch the app asks Expo's update service whether a newer JavaScript bundle exists. It sends a project id, a runtime fingerprint, the release channel, the platform and the app version.
• Clock cross-check — the app fetches a Cloudflare endpoint, and a Google endpoint if the first fails, purely to read the time from the response. A bare request with no body and no identifier of ours, at most once every ten minutes, with a two-second timeout. It is what lets a photo record whether the clock was verified or merely believed.
• Reverse geocoding — the coordinates of a shot go to the phone's own geocoder to get a street address, as described above.
• Purchases — RevenueCat confirms whether you have bought Tenon Log Pro. It receives the store's purchase receipt and an anonymous identifier the app generates for itself. No name, no email, no account; the app never sends it a user id, because there are no user accounts.
• That is the complete list. There is no analytics SDK of any kind, and no crash reporter.

What Tenon Log does not do

The absences are as load-bearing as the features, so they are stated rather than implied.

• No advertising, no advertising identifier, no ad network
• No analytics: no Google Analytics, no Firebase, no third-party measurement of any kind
• No crash reporting — unlike Tenon Calc, which ships one and says so on its own page
• No account, no login, no password, no email address collected by the app
• No cloud storage and no sync between devices
• No selling or sharing of anything with anybody

Sharing a report is your action, not ours

When you send a Bautagebuch PDF to a client through WhatsApp, email or the share sheet, that is you sending it. The app hands the file to the system share sheet and stops there — it does not upload it, keep a copy anywhere else, or learn where it went. What happens to the file afterwards is governed by whatever service you chose.

Remember the photographs inside it carry their burned-in location. That is usually exactly what you want in a site report; it is worth knowing before you forward one to somebody you would not tell where you were.

Children

Tenon Log is a tool for people doing paid construction work. It is not directed at children and nothing in it is designed to attract them or to collect their data knowingly.

Legal basis, retention and international transfer

Where the GDPR applies, the network paths above rest on Article 6(1)(b) and 6(1)(f): they are what makes the app you bought work, and the legitimate interest in shipping fixes and in a timestamp that can be trusted. The diary itself involves no transfer at all, because it never leaves the device.

Retention on our side is nothing, because there is no our side to retain it on. The purchase record lives with RevenueCat and with the store for as long as they keep it; the diary lives on your phone until you delete it or the app.

Your rights

Where the GDPR or a comparable law applies, you have rights of access, rectification, erasure, restriction, portability and objection. For the diary these are unusually direct: the data is in your hands, the export is the portability right, and deleting the app is the erasure right.

For anything held by a third party — a purchase record at RevenueCat or at the store — use the contact route on the support page and it will be passed on. You may also complain to a data protection supervisory authority, normally the one where you live or work.

Changes to this policy

When what the app does changes, this page changes with it and the date at the top moves. A new network destination cannot reach the app without being added here.