Privacy policy

Last updated November 7, 2026

Dive Log is run by Rec-Safe (RECSAFE), a Washington corporation ("we" and "us"). This policy says what Dive Log keeps about you, why, who else sees it, and what you can do about it. It covers Dive Log only; our other sites and apps have their own.

What we keep

When you use Dive Log, we keep:

• your email address and name, your time zone, your units, your currency, and the number of dives you logged before
• your dives: date and time, site, trip, depths, bottom time and surface interval, temperatures, visibility, gas, tank and pressures, weight and suit, entry and current, the kind of dive, your buddy, guide, and dive centre, a rating, notes, and the name and certification number of anyone who signed it off
• your certifications and cards: the agency, the level, its number, when it was earned and expires, the instructor or doctor and their number, the dive centre, and notes
• your gear: make, model, size, serial number, tank size, purchase details, value, warranty, status, and notes, with its service schedule and service history, and the shops and dive centres you use
• dive sites (with a location if you give one), trips, costs, and dates to keep
• photos, receipts, and files you upload, such as dive photos and photos of your certification cards
• the email addresses of people you invite to share your log
• a sign-in log (the time, IP address, and browser), to keep your account safe

You sign in with a one-time link emailed to you, or a passkey.

Every file you upload is encrypted when it arrives, with a key for your log, and is only ever decrypted for you and the people you share it with. Photos are re-saved first, which removes the location and other camera details saved in them.

Like any website, our servers also keep a short log of the pages asked for (with the IP address, the browser, and the time), to keep the site running and safe. We don't use analytics, advertising, or tracking services.

Why we keep it

Only to run Dive Log for you: to show you your log and work out what's due, to send your sign-in links, reminders, and the invitations you ask it to send, and to keep it working and secure. We don't sell or rent your information, we don't show ads, and we don't use it for anything else.

Who else sees it

Nothing in your log is public: there are no share links, and every page and file needs you to sign in. The people you invite see and can change your whole log. Certification, membership, and policy numbers, notes on your cards, gear serial numbers, and every uploaded file are encrypted where they're stored, with a key for your log, and only the server decrypts them, for you and the people you share with. The people who run Dive Log don't look at your log. Your calendar feed opens for anyone with its link, so keep the link to yourself; it has names and dates only, never a certification, policy, or serial number, and you can turn it off at any time. Reminder emails never include those numbers either. A diver summary is only what you choose to print. Everything is stored on servers in the United States.

We use these services to run Dive Log, and each sees only what it needs:

• Amazon Web Services, which hosts our servers in the United States, where everything the app keeps is stored
• Postmark, which sends our emails, so it handles your email address and the message

We'd share information if the law makes us (a court order, for example), or to protect someone's safety. If Rec-Safe ever handed Dive Log to someone else, this policy would go with it.

Cookies

Dive Log uses cookies to keep you signed in (for up to 60 days). They aren't used for advertising or tracking.

How long we keep it, and deleting it

We keep your information while you use Dive Log. You can delete dives, cards, gear, records, and files yourself; in Settings you can download everything (decrypted, so keep the download somewhere safe), and delete your account and your whole log, with every file in it, for good and we'll do it, apart from anything the law makes us keep (such as payment records). Server logs are kept only as long as they're needed to run and protect the site, and backups are overwritten in time.

Keeping it safe

Every page uses an encrypted connection (HTTPS). Sign-in links work once and expire, passkeys can't be guessed or phished, and certification and policy numbers, serial numbers, and every file are encrypted at rest with a key for each log. No website is perfectly secure, but if something ever goes wrong in a way that puts your information at real risk, we'll tell you, and the authorities when the law requires it.

Children

Dive Log isn't meant for children under 13, and we don't knowingly keep a child's information. If you think a child has given us theirs, email us and we'll delete it.

Your choices and rights

You can ask us what we keep about you, ask us to correct it, or ask us to delete it, by emailing info@rec-safe.com. We'll answer within 30 days. Depending on where you live (for example in Canada, a US state such as Washington or California, the UK, or the EU), the law may give you more rights, and we honour them for everyone.

Our servers are in the United States, so if you're elsewhere, your information is stored and handled there, under US law. In Canada, if you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Changes and questions

If we change this policy, we'll change the date at the top, and if a change is big, we'll say so on Dive Log first. Questions? Email info@rec-safe.com.