Captain's Log
Privacy Policy (work in progress)

Full Privacy Policy

Effective Date: November 8, 2025

Introduction

Defai GmbH, a company based in Zurich, Switzerland ("we," "us," or "our"), is the developer and provider of the desktop application "Captain's Log" ("the App"). We are committed to protecting the privacy of our users. This policy outlines how we handle your personal data in compliance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable international data protection laws.

A fundamental principle of the App is that your personal data and content are never stored on our servers. All information you enter into the App is stored exclusively on your local device, giving you complete control.

1. Data We Process and Why

While we do not store your personal data, the App processes specific information to function and improve its features. The legal basis for this processing is for the performance of a contract with you (the App's services) and our legitimate interests in improving our product.

Personal Data You Provide

When you use the App, we process the following personal data you provide:

• Your CV and a description of your venture.

• Optionally, your work email address, and your venture’s website.

• Textual data entered in each day's log.

This data is processed to power the App's core functionality, including the generation of AI-driven features.

Usage and Technical Data

We use Google Analytics to process anonymized, non-personal usage data, such as button clicks. This data is aggregated and does not contain any of your personal content or identifying information. We use it to understand how users interact with the App and to improve its features. The legal basis for this processing is our legitimate interest.

2. Our Data Model: Local Storage and No Retention

The personal data and content you provide to the App—including your journal entries, CV, and venture description—are stored only on your local device. We do not store any of this information on our servers.

When you use a feature that requires an external service, such as the AI, your data is securely transmitted from your device to our service and then to the third-party service (Google Vertex AI). This transmission is encrypted using HTTPS. We do not retain or store your data on our servers at any point during this process. The data is processed temporarily and immediately deleted upon completion of the task.

3. Third-Party Services

To provide our services, we use the following third-party services that may process your data as described above. They act as data processors on our behalf.

• Google Vertex AI (paid tier): This service provides the artificial intelligence capabilities for the App. Your data is sent to and processed by Google Vertex AI to provide its features, but we have a contractual agreement in place with Google to ensure that neither we nor Google retains your data after the processing is complete.

• Google Analytics: This service helps us analyze anonymized, non-personal usage data to improve the App. No personal content or identifying information is shared with or stored by Google Analytics.

We will not sell or share your personal data with any third parties for their own commercial purposes.

4. Your Data Rights

Because your personal data is stored exclusively on your local device, you have direct control over it. You can exercise your rights by managing the data on your device.

• Right to Access and Portability: You can access your data by opening the App and viewing your journal entries. Since the data is on your device, you can also easily export or transfer it to another device.

• Right to Rectification: You can correct or update your data directly within the App.

• Right to Erasure ("Right to be Forgotten"): You can delete your data at any time by simply uninstalling the App from your device. This will remove all personal information and content associated with the App.

• Right to Object to Processing: Since we only process your data to provide the App's core functionality and for our legitimate interests, you can object to further processing by discontinuing the use of the App or by uninstalling it.

• Right to Restrict Processing: As your data is stored locally, you control the processing by choosing what information to enter and by not using specific features.

• Right to Opt-out of the Sale or Sharing of Personal Information: We do not sell or share your personal information.

If you have a California IP address at the time of purchase, you have the right to request a notice of collection, a right to know the categories of personal information collected, and the business purposes for which it is collected. Given our data model, this information is detailed in this privacy policy, and you can contact us to get more information. We will not discriminate against you for exercising your privacy rights.

5. Data Security

We have implemented technical and organizational measures to ensure your data is secure while in transit. All data transmitted between your device and our services, and from our services to Google Vertex AI, is encrypted using HTTPS. Since your personal data is stored on your device, you are responsible for the security of your device.

6. Changes to this Policy

We may update this Privacy Policy from time to time. When we make a change, we will update the App version. The next time you open the updated App, you will receive a notification to review and approve the new policy. This ensures you are always informed about our data practices.

7. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Defai GmbH

Auf der Mauer 23

Thalwil, ZH 8800

Switzerland

Email: [privacy] @ [defai] [.ai]