PAT Logbook

PAT Logbook — privacy policy

Last updated: 2 October 2026

The short version

PAT Logbook keeps your clients, sites, appliances and test records on your own device. There is no PAT Logbook account or sign-in, and the app does not send your records to us. This policy describes the current version, 1.0.1.

In the Settings tab, open Privacy → Analytics & privacy to choose Product analytics, Usage totals or Off. Advertising measurement (AppsFlyer) is a separate switch and is off unless you turn it on. Every choice leaves your records, exports and the full offline app working.

This website

This website is delivered through Cloudflare. Like other web infrastructure, Cloudflare processes connection information needed to serve and protect the pages. Cloudflare Web Analytics is enabled for aggregate page, referrer and performance reporting. We do not add a PAT Logbook website account, advertising pixel or site-analytics cookie.

If you arrive with standard utm_ campaign parameters, a small script carries only those allow-listed parameters onto links between pages on this site. It does not generate an identifier, use local storage or send a separate event. The parameters are visible in the page address and may therefore be included in Cloudflare’s aggregate referrer and page reporting.

What PAT Logbook stores, and where

Everything you enter into your PAT records — clients, sites, appliances, test sessions and test records, your business profile, logo and signature — stays in the app's own storage on your device and is not sent for analytics or attribution. App settings are also stored locally. Depending on your choices and current UK qualification, PAT Logbook sends only the measurement described below, never your PAT-record content. It also sends an anonymous feedback message only when you deliberately press Send, and shares support diagnostics only when you tap Share.

Ideas and feedback

Share an idea or feedback lets you send an idea, feature request or problem without an account or email address. Opening the form does not send a message. Closing it keeps a draft on your device; you can explicitly discard that draft. A failed send keeps the draft available to try again.

When you press Send, the form sends your message, feedback category, the app and entry point you used, app version and build, operating-system version, platform and locale to our shared feedback service on Neon in London. A random reference for that submission prevents duplicate messages when you retry. We do not attach PAT records, an account ID, an email address, or a device or advertising identifier. Please leave personal and client details out of your message.

Neon processes the network connection and an anonymous access token, so the provider necessarily receives your connection’s IP address in transit. The feedback tables do not store the token or your IP address as part of the submission. Accepted feedback is retained until we delete it; provider backups may retain deleted data within their restore window. We use the message and context to operate the feedback feature, understand problems and plan product improvements. Feedback is separate from product analytics and advertising choices, and is sent only when you choose Send. There is no individual reply channel or account through which we can locate a submission, and we cannot promise that every suggestion will be built.

Support diagnostics

In the Settings tab, Privacy → Share support diagnostics creates a preview on your device. It contains only the app version and build, iOS and device model, a closed list of technical error categories and UTC timestamps. It contains no PAT records, file names, free text or analytics identifiers.

Nothing is sent unless you tap Share and choose a destination, such as email. Cancelling sends nothing. Recorded diagnostics stay on your device for up to 30 days, and you can clear them at any time with Clear recorded diagnostics.

Backups: your iCloud Drive, not ours

PAT Logbook can automatically back up your data as timestamped snapshot files. Those backups go to your own iCloud Drive, in your own Apple account — visible in the Files app under iCloud Drive → PAT Logbook. This is a one-way backup, not a sync service: PAT Logbook has no backup server of its own. Your backup files do not pass through our measurement service. You can turn automatic backups off at any time, and you can also create a backup file and restore from one manually, whenever you choose.

What PAT Logbook never sends for analytics or attribution

Product measurement never includes your name, email address, phone number or other personal contact details. It never includes your clients, sites, appliances, domains, test records or readings, photos, signatures, certificate PDFs, CSV exports, backup files or iCloud Drive contents. Your records remain local to your device and, where you choose, your own iCloud Drive.

Product analytics

Product analytics can start automatically only while our qualification service reports a current GB connection. The result lasts for at most 24 hours. An unknown, non-GB or expired result pauses automatic collection; outside that qualification, product analytics starts only if you choose it in Settings. This uses Cloudflare’s connection-country field, not GPS, PAT addresses or your App Store country.

When active, it sends a small, fixed list of events to our EU-hosted PostHog project:

Events carry fixed labels only, such as how the paywall was opened. They use a random identifier that changes every cold launch, so separate launches cannot be joined into an installation history. Events waiting offline keep the identifier under which they were recorded. PAT Logbook never joins this identifier to an account, Apple identifier, PAT record or AppsFlyer identifier.

The technical metadata kept with events is limited to app version and build, OS and SDK versions, broad device type, model and manufacturer, simulator or TestFlight status, send time and the cold-launch identifier. PAT Logbook disables UI text and element autocapture, session replay, person profiles, surveys, feature flags, automatic screen capture and exception breadcrumbs. Every event disables PostHog’s GeoIP enrichment, and the PostHog project is configured to discard client IP addresses from retained event properties. This does not describe all provider infrastructure or connection-log processing.

Fatal crashes. A retained crash event can include its exception type, stack frames and the binary name, UUID and address metadata needed for grouping and symbolication. PAT Logbook removes exception and fatal-error messages, signal messages, context lines, full binary paths and breadcrumb steps before sending. Fatal-crash reports captured while analytics was eligible can still be sent after a later relaunch. Reports from a denied or expired interval, or after you choose Off, are removed before sending.

Usage totals

Usage totals is a counts-only choice. It counts how often features are used, such as setup, saving a test, issuing or sharing a certificate, exporting records, and using the purchase or restore screens. Counts are actions, not unique people. It sends no installation identifier, event sequence, exact event times or PAT record details, and it does not start PostHog or AppsFlyer. Choosing it never enables product analytics or advertising measurement. An existing Off or Usage totals choice is respected after updating.

The app combines feature counts by day and sends them to our Cloudflare measurement service. That service combines contributions into daily totals and sends those combined totals to our EU-hosted PostHog project. A short-lived random retry token prevents a repeated delivery from being counted twice; it is not a permanent installation identifier. We do not add request logs containing contribution bodies or IP addresses. Cloudflare processes connection information to serve and protect the service, and its infrastructure can process connections internationally. The aggregation storage is configured in the EU.

Optional AppsFlyer advertising measurement

AppsFlyer is off unless you turn on advertising measurement. If you do, PAT Logbook starts AppsFlyer Strict 7 so we can measure whether advertising results in an install and later app activity. AppsFlyer creates its own pseudonymous appsflyer_id for the installation and sends its standard install and foreground-session attribution events, together with basic app and device information. AppsFlyer may store its provider identifier and reinstall state on your device. This is a different identifier and data stream from PostHog.

PAT Logbook additionally sends AppsFlyer only six fixed conversion events: onboarding completed, a test session started, a certificate issued, the paywall viewed, a purchase started and a purchase completed. They contain only fixed app-state labels, such as how the paywall was opened or whether the certificate allowance was available, and no PAT record fields. PAT Logbook uses AppsFlyer’s Strict binary, disables IDFA and IDFV collection, never supplies an account or customer user identifier, and does not request App Tracking Transparency permission. Advertising personalisation is off.

Coarse location. AppsFlyer may derive coarse location, such as country or city, from the connection and link it to its provider install ID. The AppsFlyer app is configured with IP masking, so the source IP address is not shown in raw reports or partner postbacks, but country and city fields can remain. PAT Logbook does not request or send precise GPS location.

PAT Logbook does not enable AppsFlyer’s optional anonymizeUser setting: AppsFlyer documents it as removing or hashing standard identifiers and IP data while some install and event measurement may continue. Instead, you control whether the SDK starts through your separate choice. The AppsFlyer app is also configured with Aggregated Advanced Privacy and probabilistic view-through attribution disabled.

For every AppsFlyer session, regardless of the App Store country or your location, PAT Logbook tells AppsFlyer that GDPR applies. Turning the choice on gives consent for the limited advertising-measurement data use and device storage described above; advertising personalisation is always reported as not allowed. This consent state is sent before each AppsFlyer start and again if the choice changes.

PostHog is the product-analytics service; AppsFlyer is used only for advertising measurement. Turning on one does not turn on the other.

Your choice and control

In the Settings tab, open Privacy → Analytics & privacy. Choose Product analytics, Usage totals or Off. Product events use only one of these modes at a time. Product analytics can start automatically only under the current-GB qualification described above. Advertising measurement has its own switch and never starts unless you choose it.

Choosing Off stops product measurement and clears unsent counts and event queues. Changing modes also clears pending data from the previous mode. Turning product analytics off closes the PostHog SDK and removes its unsent events. Combined totals already received cannot be matched back to your installation or separated into your individual contribution.

Turning advertising measurement off stops AppsFlyer event collection and reports data-use, advertising-personalisation and ad-storage consent as withdrawn. PAT Logbook also disables the SDK’s SKAdNetwork activity when you withdraw this choice. A later launch with the choice still off does not initialise AppsFlyer. PAT Logbook keeps the provider-generated AppsFlyer identifier locally after withdrawal so you can still make an access or deletion request. Withdrawal does not by itself delete data that a provider has already processed.

Retention and deletion of measurement data

Unsent daily counts and retry contributions are eligible for delivery only on the day they were created and the following day. Expired input is cleared when the app next checks its measurement state; this does not require the app to run in the background. The receiver combines each accepted contribution immediately; it keeps retry-token membership until that daily bucket closes, within two days, rather than keeping an individual contribution history. Server aggregation totals and pending exports expire within 30 days. Cloudflare also provides a separate 30-day recovery-history window; logically deleted data may remain recoverable during that window. Recovery is restricted to operational recovery, with expiry reapplied before processing resumes.

Completed combined totals sent to PostHog use a daily bucket identifier, not your installation identifier. We keep these combined totals for long-term product trends and do not promise automatic deletion after a fixed period. We cannot identify your part of those combined totals or separate it from the combined result.

Our PostHog project is hosted in the EU. We have not yet verified an enforced maximum retention period for product-analytics events. We are also verifying the deletion process for events collected without a person profile. Version 1.0.1 does not keep or show a durable PostHog identifier: its separate cold-launch sessions cannot be located from your identity or joined into one installation request. Version 1.0 could show a persistent PostHog identifier for requests after Detailed usage had been enabled.

AppsFlyer retention varies by advertising source and data type. We are still verifying the app-specific retention settings and the access-and-deletion process, and this policy does not claim that those provider checks are complete.

To ask about, access or delete optional measurement data:

We use the supplied pseudonymous identifier only to locate the matching provider data and to coordinate the request with the relevant provider. How long a request takes, and what the provider can locate or remove, depends on the provider. Please do not send us client details, PAT records, readings, photos, signatures, certificates or backup files. Because PAT Logbook has no account and does not connect these identifiers to your identity, we cannot locate provider data without a relevant identifier. Version 1.0.1 deliberately has no durable PostHog identifier with which to locate separate product-analytics sessions.

Purchases

The one-off unlock is handled entirely by Apple through StoreKit. PAT Logbook asks the App Store for product information and to purchase, verify or restore your unlock; Apple processes that under Apple's own terms and privacy policy. We never see your payment details. Depending on your measurement choice, PAT Logbook may send the limited purchase-flow events described above; these contain fixed app-state labels and no payment or transaction details.

Exports and sharing

When you export a certificate, an asset register, a CSV file or a full backup, PAT Logbook writes it to your device and, if you choose to email or share it, hands it to the iOS share sheet. Where it goes after that is your choice — PAT Logbook does not upload it, keep a copy, or see where you sent it.

Camera and photos

PAT Logbook uses the camera, when you choose to use it, to scan appliance barcodes and photograph appliances for your own records. Photos you take or import are stored with the appliance record on your device, in the same way as everything else.

Notifications

The optional weekly reminder digest is generated on your phone from your own data and scheduled as a local notification. Nothing about it is sent to a server.

App Store information

Apple provides developers with aggregate statistics about App Store downloads and crashes through App Store Connect. That is Apple’s measurement of the App Store, not access to your PAT Logbook records.

The PostHog software package bundled with PAT Logbook also carries an Apple privacy manifest that declares unlinked Crash Data and Other Diagnostic Data. Version 1.0.1 enables the bounded fatal-crash collection described above while product analytics is eligible. The feedback package also declares unlinked Other User Content, Product Interaction, Other Diagnostic Data and Other Data Types for App Functionality and Analytics. The App Store privacy answers are set separately in App Store Connect and are not inferred from this policy alone.

Children

PAT Logbook is a professional tool for people who test portable electrical appliances. It is not directed at children. Product measurement does not include personal contact details or PAT Logbook records. The feedback form asks people not to put personal or client details in a message.

Your rights

We do not hold your PAT Logbook records. You can export them as CSV or a full backup file at any time from Settings, and delete them from your device whenever you choose. For provider measurement data that can be located by an identifier shown in your app version, use the request route above.

Changes

If a future version changes what PAT Logbook sends, this policy and the App Store privacy answers will be updated before that version ships.

Contact

Tom Murton — support@weevolve.app

PAT testing is one way of evidencing the maintenance of electrical equipment that UK law requires — it is not itself a legal requirement. PAT Logbook is a records tool, not legal advice.