Privacy Policy
Effective date: 13 October 2026 Last updated: 13 October 2026
1. Who we are
Logged ("we", "us", "our") is a search-first personal web archive. It lets you save web pages, keep snapshots of them, organise them and search them. Logged is operated by Found OÜ, Tööstuse 47D, Tallinn, Estonia.
We are the data controller of the personal data described here, under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").
Contact for all privacy matters: talk@logged.site
This policy covers the Logged web application, the Logged marketing website (logged.site), and the Logged MCP connector that lets AI assistants you authorise read your archive.
2. Personal data we collect
2.1 Data you give us
Account data: email address and password (stored only as a salted hash by our authentication provider). If you sign in with Google, we receive your Google account identifier, email address, and basic profile information (such as name and profile picture).
Your library: the URLs you save, plus titles, descriptions, notes, tags, folders and any other organising information you add.
Search and AI queries: the text you type into search and into the AI question feature.
Waitlist email: if you submit your email on our website to be told when Logged ships, we store that address and the form it came from.
Messages to us: anything you send when you contact us.
2.2 Data we create when you save a page
When you save a URL, we fetch the public page and store:
the page title, description, preview image and extracted text content;
a snapshot of that content, and later versions when we re-check the page for changes;
for supported video pages (for example YouTube), the video metadata and transcript where one is available;
an AI-generated summary and a numerical representation of the content ("embedding") used for semantic search.
Important: the pages you save can contain personal data about other people (for example a public profile or a news article). We process that content only to give you your private archive. You are responsible for saving only content you are entitled to keep for your own use.
2.3 Data collected automatically
Technical data: IP address, browser and device type, operating system, and timestamps, collected by our hosting providers when you use the service.
Error reports: when the app crashes or hits an error, our error-monitoring service (Sentry) receives technical details about the error, such as the error message, the page or screen, and browser and device information. We have configured it not to collect personal data by default. We do not use session recordings.
Usage counters: how many AI requests your account has made, so we can apply fair-use limits.
Local storage: see section 9.
We do not knowingly collect special-category data (such as health or political opinions) and do not ask for it. You may nonetheless save pages whose content touches such topics. See section 4 on how we treat your library.
3. Why we use your data and our legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and run your account, sign you in, keep you signed in | Account data | Contract (6(1)(b)) |
| Save, snapshot, re-check, organise and search your pages | Library data, snapshots, embeddings | Contract (6(1)(b)) |
| AI summaries, semantic search and AI answers about your library | Library content, your queries | Contract (6(1)(b)) |
| Security, abuse prevention, fair-use limits, fraud detection | IP address, usage counters, logs | Legitimate interests (6(1)(f)): keeping the service safe and reliable |
| Error monitoring and fixing bugs | Technical data and error reports | Legitimate interests (6(1)(f)): maintaining and improving the service |
| Telling you when Logged launches | Waitlist email | Consent (6(1)(a)); you can withdraw it at any time |
| Service and security messages (password reset, account changes) | Email address | Contract (6(1)(b)) and legitimate interests |
| Responding to your requests and legal claims | Contact details, correspondence | Legitimate interests (6(1)(f)) |
| Complying with legal obligations | As required | Legal obligation (6(1)(c)) |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (section 8).
4. How we treat your library
Your library is private to your account. Access is restricted by database-level security rules so other users cannot read it.
We do not sell your data, do not use your library for advertising, and do not build advertising profiles.
We do not use your library content to train AI models, and our AI providers do not use it to train theirs. We send content to AI providers (section 5) only to perform the feature you requested.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing (Art. 22 GDPR). AI features only summarise, index and answer questions about your own content.
5. Who we share data with (processors and recipients)
We use the following service providers, who process data on our behalf under data processing agreements:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase (EU, Ireland) | Database, authentication, file and function hosting | All account and library data |
| Lovable (Lovable Cloud) | Website and app hosting; sign-in services (including Google sign-in); connection gateway to some services below | Account/sign-in data; technical data; page URLs sent for fetching |
| Firecrawl | Fetching and rendering the public web pages you save | The URL you save and the page content returned |
| OpenAI | Summaries, embeddings and AI features | Page text and your AI queries, as needed |
| Anthropic | AI answers about your library | Relevant library content and your question |
| Google (Gemini) | Checking saved pages for changes and summarising | Page text |
| Sentry (EU data region) | Error monitoring | Error reports and technical details |
| Google (sign-in) | Optional "Continue with Google" | Identifier, email, profile basics |
| Resend | Sending transactional emails and launch notices | Email address and message content |
We may also disclose data:
to AI assistants and apps you authorise through the Logged MCP connector or OAuth consent screen. You choose which to connect, and you can revoke access at any time. Once you authorise a third-party assistant, its own privacy policy governs what it does with the data it receives;
to authorities or advisers where required by law or to establish, exercise or defend legal claims;
to a successor in a merger, acquisition or sale of assets, subject to this policy.
We do not sell personal data and do not "share" it for cross-context behavioural advertising.
6. International transfers
Our primary database is hosted in the EU (Ireland). Some of our providers are based in, or may access data from, countries outside the European Economic Area (EEA), including the United States. Where we transfer personal data outside the EEA, we rely on one or more of:
an adequacy decision by the European Commission, including the EU–US Data Privacy Framework for certified US providers;
Standard Contractual Clauses approved by the European Commission, together with supplementary measures where needed.
You can request a copy of the safeguards we use by contacting us (section 14).
7. How long we keep data
| Data | Retention |
|---|---|
| Account, library, snapshots, embeddings, AI usage counters | Until you delete the item or your account |
| Deleted account | Removed from our live systems immediately; residual copies in encrypted backups are overwritten within 30 days |
| Waitlist email | Until you ask us to remove it, or 24 months after the launch announcement, whichever is first |
| Error reports | Up to 90 days |
| Correspondence with us | Up to 3 years after the matter closes |
| Records we must keep by law (e.g. accounting) | For the legally required period |
8. Your rights
Under the GDPR you have the right to:
Access your personal data and receive a copy;
Rectification of inaccurate data;
Erasure ("right to be forgotten");
Restriction of processing;
Data portability: receive your data in a structured, commonly used, machine-readable format;
Object to processing based on legitimate interests;
Withdraw consent at any time (for example, for the waitlist), without affecting earlier lawful processing;
Not be subject to solely automated decisions with legal or similar effects.
How to use them: much of this is available in the app. You can edit or delete saved items and folders, and you can delete your account and all associated data from Settings. For anything else, email talk@logged.site. We will respond within one month (extendable by up to two further months for complex requests, with notice). We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints: you have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA country where you live, work, or where an alleged infringement occurred. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tallinn, Estonia, www.aki.ee, info@aki.ee. A list of other authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to resolve your concern first.
9. Cookies and local storage
We use only what is strictly necessary to run the service:
authentication tokens stored in your browser's local storage so you stay signed in;
interface preferences, such as theme and sidebar state.
These do not require consent under the ePrivacy Directive. We do not use advertising or cross-site tracking cookies or analytics trackers.
10. Security
We protect your data with measures including encryption in transit (HTTPS/TLS), encryption at rest at our database provider, row-level access controls that isolate each user's data, hashed passwords, least-privilege access to production systems, and monitoring for errors and abuse. No system is perfectly secure. If a personal-data breach is likely to put your rights at risk, we will notify the competent authority within 72 hours where required, and notify you without undue delay where the risk is high.
11. Children
Logged is not intended for anyone under 13. We do not knowingly collect data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.
12. Third-party websites and content
Saved pages and links lead to third-party sites that we do not control. This policy does not apply to them. We fetch only publicly accessible pages on your instruction, using our web-fetching provider, and do not bypass logins or paywalls.
13. Changes to this policy
We may update this policy. For material changes we will give reasonable notice, for example by email or an in-app notice, before they take effect. The "Last updated" date above shows the current version.
14. Contact
Found OÜ Tööstuse 47D, Tallinn, Estonia Email: talk@logged.site