Hobbs — Privacy Policy

Last updated: 21 August 2026

1. Overview

Hobbs is operated by 10265008 MANITOBA LTD., a corporation incorporated in Manitoba, Canada ("Hobbs", "we", "us"), which is the organization accountable for the personal information described here. This Privacy Policy explains what personal data we collect, why, and your rights over it. It applies to Hobbs wherever you use it: the web application at loghobbs.com and the Hobbs apps for iOS and Android. We aim to collect as little as possible and to give you full control over your data.

2. The data we collect

• Account: your email address and a securely hashed password (we never store your password in plain text).
• Sign in with Apple: if you choose it, Apple gives us an opaque identifier for you and an email address — either your own or a private relay address, whichever you pick. We use the identifier only as the key to your account. Apple does not give us your Apple ID password.
• Push notifications: if you turn them on, the device token your phone or browser issues, so we can send the alerts you asked for. Turning them off deletes it.
• Logbook data: the flight records you enter — dates, aircraft, times, routes, remarks, and any custom fields you add.
• Page scans: images of logbook pages you upload, and the structured rows we extract from them, so you can review and correct them.
• Optional GPS tracks: only if you turn on automatic flight detection, the app records the route of a flight. Raw coordinates are stored only as the flight's track and are never written to the audit log.
• Technical data: basic request information (e.g. IP address, browser/user-agent, timestamps) used for security, abuse prevention, and debugging.
• Consent records: which agreements you have accepted, and when.

3. Why we use it (and our legal basis)

• To provide the logbook, page scanning, totals, currency tracking, exports, and map — necessary to deliver the Service you asked for (contract / legitimate interest).
• To secure the Service and prevent abuse — legitimate interest.
• Terms of Service and Privacy Policy acceptance — your consent, recorded at sign-up.
• Optional analytics — only if you opt in; off by default. You can withdraw it anytime in Settings → Privacy & data.
• We do not sell Your Data, share it for advertising, or use it to train third-party models.

4. Who processes your data

We name our processors rather than describing them, because "a third-party document-processing provider" does not let you make an informed decision about handing over a photograph of your logbook. Each of these receives only what its job requires:

• Akamai (Linode) Managed Databases — hosts the database holding your account, profile and logbook.
• Anthropic — reads the logbook pages you choose to scan. When you scan a page, the image is sent to Anthropic's API and the extracted rows are returned to us. That image may contain your name, your instructors' names, aircraft registrations and your handwriting. Nothing is sent to Anthropic unless you scan a page, and we are contractually assured your content is not used to train their models.
• Stripe — takes payment if you subscribe. Stripe holds your card details; we never receive or store a card number. We keep a record of what plan you have and when it renews.
• Twilio SendGrid — sends account email: verification, password reset, receipts, and the currency and milestone alerts you opt into.
• Sentry — receives crash and error reports from the app and the server so faults can be found and fixed. These are scrubbed: no request bodies, no passwords, no tokens, and links are stripped of credentials before they leave.
• Expo and Apple/Google push services — deliver push notifications, if you turn them on. They receive a device token and the notification text.
• Flightradar24 — consulted only if you use the flight-import feature, and receives the aircraft registration or flight identifier you are importing.

These providers process data only on our instructions and may not use it for their own purposes.

Where your data goes. Hobbs is operated from Winnipeg, Manitoba, and your logbook is stored in Canada. Several of the providers above are based in the United States, so some of your personal information — including the pages you scan, your email address, and crash diagnostics — is processed there. While data is in another country it is subject to that country's laws, and may be accessible to its courts and law-enforcement or national-security authorities. We rely on contractual safeguards, including standard contractual clauses where they apply, but we cannot exempt data from foreign law. If that is not acceptable to you, you can use Hobbs without ever scanning a page, and you can turn off push notifications and flight import.

5. How long we keep it

• Your logbook, profile and account — while your account is active, and for 3 years after your last sign-in. We email you at least three times in the final 90 days before deleting a dormant account.
• Scanned page images — 30 days from upload, then deleted automatically; sooner if you delete the scan or erase your account. The flights we read from a page become part of your logbook and are kept like any other flight — only the photograph is removed. We keep the image this long so you can check the original against what was read; after that it is a photograph of your handwriting with no remaining purpose.
• Technical data (IP address, user agent) attached to audit entries — kept with the audit record, below.
• The audit log — kept indefinitely in anonymized form after account deletion, because a legal-grade logbook requires a tamper-evident history. It no longer identifies you.
• Billing records — 7 years, as tax law requires.
• Crash and error reports — 90 days, then deleted by Sentry.
• Email delivery logs at our email provider — 30 days.
• Database backups — 7 days of point-in-time recovery, so a deletion reaches backups within that window.

When you delete your account we erase your flights, profile, scans and consents, cancel any subscription, delete the scanned images from storage, and anonymize your account record so the audit history still resolves without naming you.

6. Your rights

You can, at any time:

• Access & export all your data as a JSON file (Settings → Privacy & data → Export my data).
• Correct your records by editing them in the app.
• Delete your account and erase your data (Settings → Privacy & data → Delete my account).
• Withdraw optional consents (e.g. analytics).
• Object to or restrict certain processing, and ask questions, by contacting us.

Hobbs is operated from Winnipeg, Manitoba, so the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs how we handle your personal information. If you think we have got something wrong, tell us first — and if we do not resolve it, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you are in the EU/UK you also have the right to complain to your local data-protection authority.

7. Security

Passwords are hashed with bcrypt. Access requires authentication, sessions can be revoked, and every change to your records is written to an immutable audit trail. Connections are encrypted in transit (HTTPS). No system is perfectly secure, but we take reasonable measures to protect your data.

8. Children

The Service is not directed to children under the age required to hold a logbook or medical in your jurisdiction, and we do not knowingly collect data from such children.

9. Changes

We may update this Policy. If changes are material we will notify you before they take effect. The "Last updated" date above shows the current version.

10. Contact

Privacy questions or requests: privacy@loghobbs.com. Written enquiries can be addressed to 10265008 MANITOBA LTD., 344 Oak Street, Winnipeg, Manitoba R3M 3R5, Canada.