Privacy Policy

Effective Date: October 14, 2026

App: Pit Ledger
Contact: cairnappsstudio@gmail.com

Cairn is operated by Taylor Satterfield.

Overview

Pit Ledger is a private cook log for smoking meat on any smoker. This privacy policy explains how the app handles your data. The short version: everything is stored on your device, the app works fully with no account, the optional AI feature sends only what its disclosure lists and only after you agree, and if you choose to sign in and back up, the backup is encrypted on your phone with a key only you hold.

1. Data Storage

All data you enter into the app is stored on your device using SQLite. The app is fully usable with no account, and nothing is uploaded by default. If you sign in and back up, an encrypted copy of your records is uploaded to our backup storage, described in the Backup section below. If you turn on the optional AI feature, it sends what the AI Features section below lists. If you delete the app and have no backup, your locally stored data is permanently deleted.

2. Backup (Optional)

Backup is off until you choose it. Sign in with Apple, Google or your email address in Settings, then back up. Before anything is uploaded, your records are encrypted on your device with a key generated on your device and stored in your iCloud Keychain. We never receive that key, so a backup we hold is unreadable to us. Backing up is part of the paid subscription, on demand or automatically after changes; signing in and restoring an existing backup are free. Restoring pulls your latest backup and decrypts it on your device. We keep your five most recent backups and delete older ones automatically. Signing out leaves your backups in place, and Delete Account in Settings removes your account and every backup it holds, across all Cairn apps that share the account.

3. AI Features (Optional)

The app has one optional AI feature, Ask, which uses Anthropic, the AI provider, through Cairn's server. Ask needs a signed-in account. Nothing is sent until you turn on "Send my questions and cook log to Anthropic" in Settings and accept the disclosure. You can turn it off in Settings at any time, and nothing is sent while it is off.

Ask sends the question you type, the earlier messages in that conversation, and today's date and your time zone. To answer, it looks up your cook log on your device and sends what it finds: each cook's cut, weight, smoker, wood, pit temperature, target internal temperature, start and end times, rest and rating, and each event's time, kind and temperature, plus figures worked out from them such as hours on the pit, stalls and hours per pound, never a note or a photo. Your notes are sent only if you also turn on "Also send the text of my notes"; that switch sends the notes on each cook Ask looks up and on its events, exactly as you typed them. Photos are never sent. If you ask it to log an event on a cook, the change is made by the app on your device.

Cairn's server, hosted by Vercel, checks that you agreed and that you have usage left, then passes the request to Anthropic and the answer back. It does not store your questions, your records or the answers, with one exception: when Ask proposes a change to your records, our server keeps a copy of that proposed change with your account so that a retried request cannot apply it twice. That copy is deleted after 30 days, or sooner if you delete your account. To count usage, our server records your account identifier or, if you are not signed in, a random identifier the app creates, along with your network address. Those usage counters are deleted after 31 days. Your past Ask conversations are kept on your device only. We do not send your account identifier or email address to Anthropic. Under Anthropic's commercial terms, Anthropic does not use these requests or its answers to train its models, and keeps them only for a limited period for trust and safety. We do not use your data to train any model either.

4. Personal Information

You can use the whole app without an account. You can sign in with Apple, Google, or your email address. Email sign-in means either choosing a password, held by our authentication provider and never visible to us in plain text, or using a one-time link we email you that needs no password at all. When you sign in, we receive an account identifier and the email address you used or the one your provider gives us, which may be Apple's private relay address if you chose to hide yours. Apple also gives us your name the first time you sign in; Google gives us your name and a profile photo URL along with your email. The app does not display your name or photo anywhere; we do not otherwise collect any personal information.

5. Analytics and Crash Reporting

The app does not collect usage analytics: no screen views, no feature usage, no behavioural tracking.

We use Apple's AdServices to see which App Store ad brought you to the app, if any. It does not identify you and is not used for tracking.

The app reports crashes, unhandled errors and basic performance measurements to EAS Observe, a service run by Expo, so that faults can be found and fixed. A report contains the error and its stack trace, the app version, the device model and operating system version, and timings such as how long the app took to start. It also contains an anonymous installation identifier, which distinguishes one install from another and is not linked to you, your account or your email address. Reports never include your entries or any other content you create in the app. This data is not used for advertising and is never sold or shared for tracking.

6. Subscriptions and Payments

In-app purchases are processed entirely by Apple through the App Store. We do not collect, process, or store any payment information. The app uses RevenueCat to check your purchase and subscription status with Apple. RevenueCat receives that status tied to an app user ID: a random ID the app creates, or, once you sign in, your Cairn account identifier, so Pro follows your account to a new phone. It also receives your device's vendor identifier (IDFV, an Apple-provided device ID that resets when you delete all apps from this developer). This is used only to validate your purchase and restore it across your own devices. It is never used to track you across apps or websites, and RevenueCat does not receive your name, email address or payment details. Learn more at revenuecat.com/privacy.

7. Third-Party Advertising

The app does not display any third-party advertisements. We do not use ad networks or tracking pixels.

8. Data Sharing

We do not sell, rent, or share your data with third parties. If you turn on an AI feature, what it sends reaches Cairn's server, hosted by Vercel, and Anthropic, the AI provider, in readable form, as described in the AI Features section above. Your encrypted backups are held by Supabase, which also hosts our database, file storage, and email sign-in if you choose it over Apple or Google. Because backups are encrypted on your phone with a key we never receive, neither we nor Supabase can read their contents. Sign in with Apple or Google is handled by Apple or Google, whichever you choose. RevenueCat receives your purchase status and app user ID, as described under Subscriptions and Payments. Crash and performance reports go to EAS Observe, run by Expo, as described above; they carry no content you created and are never used for advertising or tracking. Account-related email is delivered by Resend, our email delivery provider, as described under Email below.

9. Email

If you sign in, we send the emails your account needs: confirming your address, password resets and sign-in links. If you buy Pro while signed in, we also email you a short note when it starts, when a subscription is set not to renew, and when it ends. They are sent to the address on your account through Supabase, our account provider, and Resend, our email delivery provider. Any reminder email carries an unsubscribe link. If you unsubscribed from our emails, we keep your email address on a do-not-email list after your account is deleted, so we never email you again.

10. Children's Privacy

The app is not directed at children under the age of 13. We do not knowingly collect any information from children under 13. If you believe a child under 13 has provided information through the app, please contact us at cairnappsstudio@gmail.com.

11. Data Retention

Data on your device stays there until you delete it. If you back up, we keep your five most recent backups and delete older ones automatically. Deleting your account in Settings removes your account record, every backup it holds and any AI records kept with your account, across all Cairn apps that share the account. Signing out leaves your backups in place so you can restore later. Anthropic keeps AI requests only for a limited period under its commercial terms, as described in the AI Features section above. Diagnostic reports are retained by EAS Observe under Expo's own retention policy and contain no content you created.

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted at this URL with an updated effective date. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions about this privacy policy, contact cairnappsstudio@gmail.com.