WagDev LLC Data Security Standards

Effective Date: November 8, 2026 Last Updated: November 8, 2026

1. Introduction

WagDev LLC ("Company," "we," "us," or "our") is a small, independent app developer. This page explains, in plain terms, how we protect information in our apps and what our limits are. It works together with the WagDev Privacy Policy and each app's Privacy Policy Supplement, which says exactly what that app does.

2. Two Kinds of Apps

Our apps follow one of two models. Each app's Privacy Policy Supplement says which one it uses.

• On-device apps (for example sesh and Ears Up). There is no account and no WagDev server. What you record stays in a database on your phone. We never receive it, so we cannot see, sell, lose or leak it. Protecting it depends mostly on your device: its passcode, its encryption and its backups.
• Account apps (for example Life Log). You sign in, and with a paid plan your content syncs through Google Firebase so it is available on your other devices and in shared logs. For these apps we hold data on cloud services, and Sections 4 and 5 apply.

3. Our Approach

• Collect less. We design apps so that the data we would have to protect never reaches us. Where an app can work fully on your device, it does.
• Use established providers. We do not run our own servers. Where data must leave your device, it goes to large providers named in Section 6.
• Be honest about limits. We are a one-person company without a dedicated security team. Section 10 lists what that means.

4. Technical Measures

4.1 All Apps

• Network traffic from our apps to the services in Section 6 uses encrypted connections (HTTPS/TLS).
• Our error reporting is set not to send personal information: no names, emails or the content you create, and passwords, tokens and keys are removed from logs before they are sent.
• App updates are signed and delivered through the App Store, Google Play and Expo's update service.

4.2 On-Device Data

• What you record in an on-device app is stored in the app's private storage on your phone. Other apps cannot read it.
• We do not add a separate layer of encryption to that database. It is protected by your device's own encryption when your phone is locked with a passcode, PIN or biometric.
• Device backups (for example iCloud or a computer backup) and files you export are outside our control. Protect them as you would any personal file.

4.3 Account Apps (Cloud Data)

• Google Firebase encrypts data in transit and at rest.
• Firebase Security Rules limit each account to its own data, and to shared data only where you have been invited.
• Sign-in is handled by Firebase Authentication. We never see or store your password.
• Life Log encrypts the content of synced entries on your device before upload, so the copy in the cloud cannot be read without your account's key. The Life Log Privacy Policy Supplement describes this in detail.

5. Access Controls

• Only the company owner has administrative access to our cloud consoles (Firebase, Google Cloud, Sentry, Expo, the App Store and Google Play).
• These accounts use two-factor authentication.
• Secrets and API keys are kept in a password manager and in our build service's encrypted settings, never in source code.
• We do not browse user content. For account apps, access to stored data happens only to operate the service, answer a request you make, or meet a legal obligation.

6. Service Providers

Data that leaves your device goes only to these providers. Each app's supplement says which of them that app uses.

We do not sell your personal information. Apps that show ads share limited device data with Google for advertising, as Section 4.3 of the WagDev Privacy Policy explains.

7. Development and Operations

• Changes go through a protected main branch with automated checks before release.
• We keep app dependencies and SDKs up to date and act on security advisories.
• Our development computer uses full-disk encryption.
• Crash reports in Sentry alert us to errors so we can fix them.

8. Security Incidents

If we learn of a security incident that affects your personal information, we will:

• investigate promptly and take steps to contain it;
• tell affected users, and regulators where the law requires it, within the time the law requires and without undue delay;
• explain what happened, what data was involved and what you can do.

For on-device apps we have no contact details for you, so any notice would come through the app, the app's store listing or our website.

9. Your Choices

• On-device apps: delete individual records in the app, or delete the app to remove its data from your phone. Copies in device backups or files you exported stay until you delete them.
• Account apps: delete content in the app, or delete your account in Settings. The app's supplement explains what deletion removes and when.
• Everyone: write to privacy@wag.dev with any privacy question or request.

10. Our Limits

• We are a small company without a dedicated security team or a formal security certification.
• We rely on the security of the providers in Section 6 and of your device.
• We have not commissioned an independent security audit.
• No system is perfectly secure, and we cannot promise that data will never be exposed.

11. Reporting a Security Issue

If you find a vulnerability, email security@wag.dev with the details and please do not share it publicly until we have had a chance to fix it. We aim to reply within 2 business days.

12. Contact

• Security: security@wag.dev
• Privacy: privacy@wag.dev
• General support: support@wag.dev

These Data Security Standards apply to all WagDev LLC apps and are part of the WagDev Privacy Policy. Where an app's Privacy Policy Supplement is more specific, the supplement governs for that app.