1. Overview

Mendlog ("we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using theMendlog service, you agree to the practices described here.

2. Information We Collect

Account Information

When you create an account, we collect your name and email address. If you sign in via Google OAuth, we also receive your Google profile name, email address, and profile picture URL from Google. We do not receive your Google password.

Content You Provide

We store the data you enter into the service, including property details, maintenance records, appliance information, contractor contacts, and any notes or descriptions you add.

Files You Upload

On paid plans you can attach photos and documents to your maintenance records. Every upload is checked for viruses by a scanner we run on our own servers; files are not sent to an outside scanning service. Photos are re-saved on upload, which removes their hidden location (GPS) and camera details. Files are stored in a private Cloudflare R2 storage bucket. Only you, signed in to your account, can open them: each download uses a link that works for five minutes. Attached files are not shown on shared report links. When you remove a file from a record it is no longer accessible from your account; stored copies are kept with your account data and deleted under the retention terms below.

Payment Information

We do not collect or store payment card details. All payments are processed by Paddle.com Market Limited ("Paddle"), our Merchant of Record. Paddle may collect and process billing details, including your name, email, and payment method, subject to Paddle's own Privacy Policy.

Usage Data

We may collect anonymized usage data such as page views, feature interactions, and error logs to improve the service. This data does not identify you personally.

3. How We Use Your Information

To provide, operate, and improve the Mendlog service
To authenticate your identity and manage your account
To process subscription payments through Paddle
To send transactional emails (account creation, subscription confirmation, PDF export delivery)
To respond to support requests
To detect and prevent fraud or abuse

We do not use your data to serve third-party advertising. We do not sell your personal information to any third party.

4. Data Sharing

We share your data only with third-party service providers that help us operate the service, and only to the extent necessary:

Paddle — payment processing and subscription management
Resend — transactional email delivery
Cloudflare: storage of files you attach to your records (Cloudflare R2)
Hosting providers — cloud infrastructure for the application and database

Each provider is contractually obligated to protect your data and use it only for the purpose of providing services to us. We do not share your data with any other third parties unless required by law.

5. Data Retention

We retain your account and property data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain it (for example, for billing records). Anonymized, aggregated data may be retained indefinitely.

6. Cookies and Tracking

Mendlog uses a single httpOnly cookie to store your refresh token for session management. This cookie is not used for advertising or tracking purposes.

If we add analytics tools in the future, we will update this policy and will use privacy-respecting, cookieless analytics where possible.

7. Your Rights

Depending on your location, you may have the right to:

Access a copy of the personal data we hold about you
Correct inaccurate data
Request deletion of your data ("right to be forgotten")
Object to or restrict certain processing of your data
Data portability — export your records at any time from your account

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Security

We use industry-standard security practices including HTTPS encryption in transit, hashed passwords (bcrypt), and secure httpOnly cookies for session tokens. We do not store payment card information. While we take reasonable measures to protect your data, no system is completely immune to breaches, and we cannot guarantee absolute security.

Mendlog staff may access account data to provide support, and every such access is logged.

9. Children's Privacy

Mendlog is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by in-app notice before the changes take effect. Continued use of the service after changes are posted constitutes acceptance.

11. Contact

Questions or requests regarding your privacy? Email us at [email protected].