Menu

FilmLedger Privacy Policy

DRAFT FOR ATTORNEY REVIEW — Not final. Not legal advice. Do not publish or rely on this document until reviewed and approved by qualified counsel.

Effective Date: [DATE — TO BE SET AT PUBLICATION]

1. Introduction

This Privacy Policy explains how FilmLedger LLC ("FilmLedger," "we," "us," or "our") collects, uses, discloses, and protects information when you use the FilmLedger website, web application, and iOS/macOS applications (collectively, the "Service"). FilmLedger is registered at 2100 N Ronald Reagan Blvd #1008, Longwood, FL 32750.

By using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account information. When you create an account, we collect your email address, password (stored as a salted hash, never in plain text), and any profile information you choose to provide.

Film, gear, and cost logs. Information you enter about film rolls, frames and exposure settings, cameras, lenses and other gear (including serial numbers), film stock, labs and development, notes, and what you paid and where you bought things.

Reference photographs and location data. Photographs you capture or upload within the Service, and, where you enable it, the GPS location associated with a shot or reference photo. Location data is only collected with your device-level permission and only for the features you actively use.

Diagnostic, crash, and tracing data. Technical data used to identify and fix problems with the Service — for example, crash reports, error logs, and request tracing across our backend, web, iOS, and macOS applications. Server logs record IP addresses and request details. When you are signed in, error and crash reports include your account identifier (never your email address) so we can find the problems you run into. This data is used for reliability and debugging and is not used to build behavioral usage profiles.

Contributions to shared directories. When you add a camera, lens, or film stock, its make, model or name, and specifications are also suggested to FilmLedger's shared catalog, which our staff review before anyone else sees it. Suggestions and corrections you send for the lab directory are reviewed the same way. Your name, serial numbers, quantities, prices and notes are not shared.

Information you submit to us directly. For example, when you contact support, send a problem report from the app (which includes technical details you can read and edit before sending), or exercise a privacy right under Section 8.

Information stored on your device. The apps keep your sign-in session and display preferences (such as light or dark mode and the light meter's calibration) on your device.

The FilmLedger marketing website does not use cookies or analytics/tracking scripts.

3. How We Use Information

  • To provide, operate, and maintain the Service (e.g., storing your film logs and photographs, authenticating your account).
  • To detect, diagnose, and fix technical problems, including through crash reporting and tracing.
  • To communicate with you about your account, security notices, and, where you've opted in, product updates.
  • To enforce this Policy, our Terms of Use, and applicable law, and to protect the security and integrity of the Service.

We do not use your data to serve third-party advertising, and we do not build individual per-user behavioral analytics profiles.

4. Legal Bases for Processing (International Users)

Where applicable law (such as the EU/UK GDPR) requires a legal basis for processing, we rely on: performance of a contract (providing the Service you signed up for), our legitimate interests (maintaining and securing the Service), and, where required, your consent (for example, location data and optional communications).

5. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing purposes.

We share information only with the infrastructure service providers necessary to operate the Service, acting as our data processors:

  • Cloudflare — domain/DNS and content delivery; your traffic and, depending on configuration, static assets pass through Cloudflare's network.
  • Interserver — our virtual private server (VPS) host; the databases and application containers that store your account, log, and photo data run on Interserver infrastructure, as does our help desk, which keeps copies of the emails you exchange with our support and privacy addresses.
  • Grafana Labs — our monitoring and diagnostics provider; server health metrics and error logs are sent to Grafana Cloud so we can detect and diagnose outages and faults. These records can include IP addresses and technical request details, and are retained for a short diagnostic window. They do not include your photographs, location data, or film log content.
  • Lettermint — our email delivery provider; it sends the emails the Service sends you, such as password resets, security and account notices, and, only if you have opted in, product updates. It receives your email address and the content of those messages. Lettermint processes and stores this data only within the European Union. We do not use open or click tracking in these emails.
  • Backblaze — our offsite backup storage; encrypted copies of our database, of the files stored with your records, and of our help desk are stored with Backblaze in its EU Central region. The copies are encrypted on our servers before they are sent, so Backblaze cannot read them.
  • Spaceship (Spacemail) — our email hosting provider; messages you send to our support or privacy addresses, and our replies, are stored in mailboxes hosted by Spacemail. Our help desk, which runs on our own server (see Interserver above), keeps a copy so that we can track and answer them.

[TBD before publication: confirm final list against docs/business/vendors.md — e.g. any future storage/CDN provider that also intersects with user data. Confirm with Lettermint and Spacemail how long each retains message data, and state it in Section 7 if required.]

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice to you).

6. Data Storage & Security

Your data is stored on infrastructure operated through Interserver, with domain/traffic services through Cloudflare. We use industry-standard safeguards including hashed passwords, multi-factor authentication support, and access controls on our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention & Deletion

We keep your information for as long as your account exists, so that the Service can show you your records. You can delete your account, and everything in it, at any time.

Deleting your account yourself. In the FilmLedger iPhone and iPad app (Profile › Your Data › Delete Account) or the web app (Profile & Preferences › Security › Delete account). To confirm it is you, we ask for your password, and your authenticator code if you use two-factor authentication. Deletion happens immediately and cannot be undone. Before deleting, you can download a copy of your data from the same screen (Download My Data).

What is deleted. Your account and profile; your film rolls, frames, and exposure details; your cameras, lenses, and other gear; the film stock and inventory records you created, with their prices and sources; your reference photographs and the locations attached to them; and your passkeys and two-factor authentication settings. Film stocks in the shared catalog, which are not specific to you, remain.

Deleting individual records. When you delete a roll, frame, or item of gear or film, it disappears from the Service immediately and is permanently erased 30 days later. A camera, lens, or film you delete that is still recorded on a roll you keep stays with that roll until the roll is deleted.

What we keep after deletion.

  • A deletion record containing the number of records of each type that were deleted and a one-way hashed reference to the account. It contains no email address, name, or content, and lets us show that a deletion took place.
  • Entries in our internal activity log that referred to your account are stripped of that reference.
  • Backups of our database and stored files, and of our help desk, which are kept for up to 12 months and then deleted. Recent backups are also kept on our own servers for a few days (up to 2 days for the Service, up to 14 days for the help desk). Backups are used only to restore the Service after a failure; deleted accounts are not restored from them for any other purpose.
  • Diagnostic logs (Section 5), which are kept for a short diagnostic window (currently up to 14 days) and then removed.
  • Your contributions to the shared film catalog and lab directory (see Section 2), which remain without your name.
  • Emails you have exchanged with us (for example, with support), which are kept for up to 2 years after the last message in the conversation.

If you cannot sign in. Email privacy@filmledger.co from the email address on your account and ask us to delete it. We will confirm that the request comes from the account holder and then delete the account as described above, normally within 30 days of receiving the request.

When you delete your account yourself, the app or website confirms the deletion on screen. When we delete an account on request, we confirm by email.

[TBD before publication, for counsel:

  • Backup retention, as deployed 2026-10-31: the Service backs up every 6 hours to Backblaze (filmledger-backups), keeping hourly copies for a day, daily for a week, weekly for a month and monthly for a year, plus the last 8 local dumps (2 days) on the server. The help desk backs up nightly to its own bucket (filmledger-helpdesk-backups), keeping daily copies for 14 days, weekly for 8 weeks and monthly for a year, plus 14 days locally. Counsel: whether deleted accounts must be re-deleted after any restore, and whether 12 months is proportionate.
  • Support email retention: 2 years after the last message is FilmLedger's proposal (DATA-INVENTORY.md F8); confirm, and set Lettermint's sent-mail retention to match or shorter. It must be enforced in three places: Spacemail, the FreeScout help desk (no automatic deletion is configured yet), and help desk backups (up to 12 months behind). Server logs: about 7 days on our hosts, 14 days in Grafana Cloud.
  • Grafana Cloud: the stack was deleted by Grafana for inactivity (RELEASE-1.0.0.md O8), so today no metrics or logs reach it. Recreate it before publication, or remove Grafana Labs from Section 5.
  • Deleted records are erased 30 days after deletion by a daily job (backup_purge_after in the Ansible backup role); keep this sentence and that setting in step.
  • The macOS app does not yet offer in-app deletion; it ships after this policy and must before it is listed here.
  • When reference photographs move from the database to separate file storage (planned), the post-deletion cleanup of those files must be in place before this section remains accurate.

]

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing (for example, under the GDPR for EEA/UK users, or applicable US state privacy laws for US residents). To exercise these rights, contact privacy@filmledger.co.

9. Children's Privacy

The Service is not directed to, and you must be at least 16 years old to create an account or use the Service. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from a user under 16, we will delete it.

10. International Data Transfers

FilmLedger is a US-based service and our infrastructure providers may process data in the United States and other countries; our email delivery provider (Lettermint) processes email data, and our backup provider (Backblaze) stores encrypted backups, within the European Union. By using the Service, you understand that your information may be transferred to and processed in countries other than your own, which may have different data protection laws.

11. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new Effective Date, and, for material changes, provide additional notice where required by law.

12. Contact Us

General support: support@filmledger.co Questions about this Policy and data deletion requests: privacy@filmledger.co FilmLedger LLC, 2100 N Ronald Reagan Blvd #1008, Longwood, FL 32750