Legal

Privacy Policy

Effective date: 9 October 2026  ·  Loggy Co Pty Ltd (ABN 48 698 930 406 registered with ASIC), operator of toggy

toggy is designed to collect as little personally identifiable information as possible. This policy explains clearly what we do and don't collect, and how your data is handled.

Who we are

toggy is operated by Loggy Co Pty Ltd, an Australian business registered with ASIC and based in Canberra, ACT. You can contact us at hello@toggy.au.

What we collect

When a toggy is tapped, our database records:

• A unique log ID for that tap event
• A timestamp (date and time of the tap)
• The name of the toggy, if you have chosen to add one
• Any notes you choose to add to a log entry (encrypted at rest — see Notes and tags below)
• Any tags you choose to attach to a log entry (encrypted at rest — see Notes and tags below)

The name of your toggy and any encrypted notes or tags added to log entries are entirely optional and entered at your own choice. Neither is required to use the service. It is best practice to name your toggy using non-personally identifiable information. If you choose to input personal information into editable toggy fields that is your choice and you do so knowing that anyone with URL access (and the PIN, if one is set) can view information stored at that toggy.

What we don't collect

• Accounts, logins, or personal profiles
• Device identifiers
• Location data
• Advertising, analytics, or tracking cookies
• Third-party analytics

Your URL and your PIN

Each toggy has a unique, randomly generated 22-character identifier in its URL, which makes it impractical to guess.

Without a PIN, the URL is the only protection. Anyone with the URL can view the log and add to it, so keep it private if you don't want others to see your log history.

With a PIN, the PIN is required to view or log anything, so the URL alone isn't enough.

We recommend setting a PIN for any toggy used for something sensitive, such as medication.

PIN protection

You may choose to protect your toggy with a 4-digit PIN. If you do:

• Your PIN is never stored in readable form. toggy stores only a randomly salted, one-way hash used to verify whether an entered PIN is correct. Loggy Co cannot view or retrieve your original PIN.
• PIN access is rate-limited to prevent guessing. After 4 incorrect attempts on a device, PIN entry is blocked on that device for 1 minute, then 3 minutes, and for longer each time after that.
• If PIN protection is used, toggy stores a strictly necessary security cookie on that device so the toggy can remain unlocked for up to 12 months, or until the browser's cookies/site data are cleared. toggy does not use advertising, analytics or tracking cookies.
• A three-word recovery phrase is generated when you set your PIN. The phrase is shown to you once and is not stored in readable form. toggy stores only a randomly salted, one-way hash so that the phrase can be verified if you need to reset your PIN. Loggy Co cannot view or retrieve the original phrase. If you lose both your PIN and your recovery phrase, we do not have a process for recovering access, so please keep the phrase somewhere safe.
• Changing your PIN immediately revokes access for all previously unlocked devices. If someone else has entered the PIN on their phone, change it to remove their access.

Notes and tags

Notes and tags are encrypted before being stored in our database, so they cannot be read directly from it. Loggy Co controls the keys required to decrypt this information.

Authorised personnel may access decrypted notes or tags only where reasonably necessary to provide support, maintain or secure the service, investigate misuse or incidents, or comply with legal obligations.

Notes and tags are visible to anyone with access to the relevant toggy URL. Where PIN protection is enabled, the correct PIN is also required.

We may rotate encryption keys as part of normal security maintenance. We take reasonable steps to preserve access to existing encrypted data, but in exceptional circumstances encrypted information may become inaccessible.

How your data is stored

Your data is hosted on Amazon Web Services (AWS), our infrastructure provider, with servers located in Australia (Sydney region). As the operator of toggy, we remain responsible for your data regardless of where it is technically hosted.

We do not sell, share, or transfer your data to any third party for any purpose.

How long we keep your data

Log data is retained for as long as the associated toggy URL is active. When a URL is retired:

• A 30-day grace period applies before permanent deletion
• After 30 days, all associated log data is permanently deleted

URLs that are generated but never activated are automatically retired after 12 months of inactivity, after which the same 30-day deletion process applies.

If toggy is ever permanently discontinued, we will give reasonable notice and the opportunity to retrieve your log data, as set out in our Terms of Service.

Children's privacy

Because toggy doesn't require or request personal information from any user, there is no deliberate collection of children's data. However, users may choose to enter personally identifiable information — including children's names — in the name of a toggy or in notes or tags. It is best practice to avoid doing so. Loggy Co is not responsible for personal information voluntarily entered by users.

Changes to this policy

If we make material changes to this policy, we will update the effective date at the top of this page. Continued use of toggy after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy? Contact us at hello@toggy.au.