1.1 Account Information
Email address (required for Firebase Authentication) and Firebase-generated user identifiers (UIDs).
Last updated · October 23, 2025
Brass Log Privacy Policy
Brass Log ("we", "our", "us") is committed to protecting the privacy of every firearm owner who uses the Brass Log mobile application (the "App"). This policy explains what data we collect, how we process it, and the technical safeguards — including client-side encryption — that protect your information across devices.
Need help?
Have questions about your data, privacy rights, or how Brass Log protects your information?
We respond to verified submissions within 30 days.
1. Data We Collect
1.2 User-Provided Content
Range sessions, firearm records, ammunition inventories, component logs, locations, favourites, and any other entries you create.
1.3 Device Metadata
Non-identifying telemetry (device model, OS version) used to deliver push updates, diagnose crashes, or understand basic usage patterns. GPS is only collected when you take an explicit action.
2. How Your Data Is Protected
2.1 End-to-End Encryption
- Every record is encrypted on-device using AES-256 GCM before syncing to Firestore.
- A unique Data Encryption Key (DEK) is generated per account and never leaves devices in plaintext.
- The DEK is wrapped by a Key Encryption Key (KEK) derived from your password with PBKDF2 SHA-256, 210,000 iterations, and a unique salt.
- The decrypted DEK lives only in the secure enclave / Keychain while you remain signed in.
- Signing in rotates the DEK, re-encrypts data, and updates the wrapped key in Firestore.
2.2 Additional Safeguards
- HTTPS/TLS for all network traffic.
- Firebase Authentication manages credentials and tokens; we never store plaintext passwords.
- Secure storage APIs on iOS/Android keep local data protected; uninstalling leaves encrypted sync data until deletion.
3. How We Use the Data
- Deliver and improve the Brass Log experience, including multi-device sync.
- Provide customer support upon request.
- Maintain security, debug issues, and prevent abuse.
We do not sell, rent, or share your personal information with third parties for advertising or marketing.
4. Data Sharing and Processors
| Service | Purpose | Region |
|---|---|---|
| Firebase (Google LLC) | Authentication, Firestore database, analytics | United States / Global (multi-region) |
| Expo (Expo Labs, Inc.) | Build, OTA updates, diagnostics | United States |
Each provider is contractually bound to safeguard your data and comply with applicable privacy laws.
5. Data Retention and Deletion
- Encrypted user content remains until you delete it in the App or remove your account.
- Signing out removes the secure-store copy of the DEK from that device.
- Request account deletion to revoke Firebase access and purge Firestore/Storage records within 30 days.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you.
- Request corrections or updates.
- Request deletion of your account and data.
- Object to or restrict certain processing.
- Lodge a complaint with a supervisory authority.
Email [email protected] to exercise these rights.
7. Children’s Privacy
Brass Log is intended for adults engaged in lawful firearm activities. We do not knowingly collect personal data from children under 13. Contact us if you believe a child has provided information so we can delete it.
8. International Transfers
Firebase may store data outside your home country (typically in the United States). Firebase is certified under relevant frameworks (e.g., ISO/IEC 27001) and uses contractual safeguards for cross-border transfers.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated in-app or via email, and the “Last Updated” date will be revised. Continued use of the App after changes means you accept the updated policy.