LoadOut Privacy Policy

Effective date: 2026-11-01

What this app is

LoadOut is a local-first reloading reference and tracking application for iOS, Android, macOS, and the web. It enables you to record your loads, firearms, and components, and to consult cartridge specifications. Reference catalogs (cartridges, powders, bullets, primers, brass, firearms, parts) are bundled with the application for offline browsing.

The short version

• We do not track you. We do not use analytics. The application contains no advertising. We do not sell your data.
• Your reloading data (loads, firearms, components, batches, brass logs, and ballistic profiles) resides on your device. We do not operate a server that stores it.
• We send information to our service providers only when a feature needs it: for sign-in (your email address and OAuth tokens), in-app purchases (anonymous purchase records), crash reports (on unless you turn them off), the weather when you ask for conditions (your coordinates), Improve with AI when you tap it, Urgent Notices for a match you turn them on for, a code from your organization or a match when you use one, and Siri Voice Commands if you turn them on. The sections below say what each one sends.
• If you opt in to cloud backup (a Pro feature), your data is encrypted on your device with a passphrase known only to you, and is then uploaded to your own iCloud Drive, Google Drive, or Microsoft OneDrive. We never receive the encrypted file.
• If you turn on Siri Voice Commands (free, and off until you do), your spoken question and LoadOut's spoken answer are handled by Apple's assistant under Apple's privacy terms. We still receive nothing: we operate no server that gets your reloading data.

What we collect

Account & authentication (Firebase Authentication)

We use Firebase Authentication (Google Cloud) to identify you and to enable sign-in across devices. Firebase stores the following on Google's servers:

• Your email address.
• A Firebase-assigned anonymous user ID (UID).
• OAuth tokens for any third-party providers you use (Google, Apple, Microsoft).
• Sign-in metadata (timestamps, last sign-in IP) maintained by Firebase.

We use this data solely to authenticate you, and not for marketing or analytics purposes.

In-app purchases (RevenueCat)

If you purchase LoadOut Pro, the App Store or Google Play processes the transaction. We use RevenueCat to verify your purchase and to unlock Pro features across devices. RevenueCat receives the following:

• Your Firebase UID (so your purchase follows your account).
• The store-level transaction record (product ID, purchase date, expiration if applicable).
• Anonymous device and platform metadata RevenueCat needs to validate receipts.

RevenueCat does not receive your email address or any reloading data.

Diagnostics (Firebase Crashlytics: on by default, opt-out)

LoadOut includes Firebase Crashlytics to record crash and error reports. Collection is enabled by default so that we may identify and correct crashes promptly. You may disable it at any time from Settings → Send crash reports.

While collection is enabled, crash reports include:

• Technical metadata Crashlytics needs to diagnose the crash: device model, operating-system version, app version, stack traces, the name of the screen you were on, and the database schema version. We do not attach your Firebase UID or any other account identifier to a crash report.
• Non-fatal errors the app catches and reports for diagnostic purposes.
• The organization whose look the app is showing, by ID only: the organization’s ID (LoadOut’s own when you are in none), the ID of the look, the version of its settings, and whether those came with the app or were downloaded. Never a name, a code or anything you typed.

Crash reports do not include your reloading data or any user-typed text. If you subsequently disable collection, it ceases immediately.

Data we download (read-only catalog updates)

When the application starts, it makes a one-way read request to Firebase Storage to determine whether the bundled reference catalog has been corrected or expanded since the version you installed. If a newer catalog is available, it is downloaded and cached on your device. No information about you, your device, or your reloading data is uploaded when this check runs. The catalog files are identical for every user.

App Update Check (Only When You Ask)

When you tap Check for Updates in Settings → Help & Support, LoadOut asks your phone's app store whether a newer version of LoadOut is published. On iPhone, it sends one read request to Apple (itunes.apple.com) that names only LoadOut's App Store listing. On Android, it asks the Google Play app on your phone, which asks Google Play. LoadOut includes no information about you, your reloading data, or your region; as with any request, Apple or Google sees your IP address. LoadOut never runs this check on its own, and it stores nothing about the answer.

Urgent match notices (Firebase Cloud Messaging: off unless you turn it on)

When you turn Urgent Notices on for a match, your phone registers with Firebase Cloud Messaging (Google) and joins that match's notice list, so its director can send a notice to your lock screen. Google holds a registration identifier for your phone and the lists it joined. A notice carries only the identifiers of the match and of the announcement, never the director's words: the text on your lock screen is LoadOut's own, and LoadOut then fetches the announcement itself. Turning a match off, or leaving its organization, takes your phone off that match's list. Once no match is on, and whenever you use Reset This Device or Delete My Account & All Data, the registration is deleted, at the next launch if your phone is offline at that moment. A notice already on your lock screen stays until you clear it; a withdrawn notice is replaced by one saying it was withdrawn.

Organization and Match Codes (Only When You Use One)

When you type or scan a code from your organization or a match, or open a link that carries one, LoadOut uses it in up to three ways. To learn what a code it does not already know is for, LoadOut looks it up in its match files on Firebase Storage (Google) by a one-way fingerprint of the code, never the code itself. If the code can turn on LoadOut Pro, your phone sends the code, your Firebase user ID and your sign-in token to LoadOut's server, which checks the code and asks RevenueCat to turn Pro on for your account. The server keeps a fingerprint of the code with your Firebase user ID for two years, so one code cannot give the same account Pro twice, and its log keeps only the first characters of each. If a match's course of fire stays sealed until a set time, your phone sends the code with each request for that match's key, so LoadOut's server can give your phone the key ahead of time; the course of fire still opens only at its set time. The server checks that code against the codes the match lists and does not keep or log it. LoadOut keeps the code on your phone only while it needs it: for Pro, until Pro shows on your phone or the code is refused, and for a match, until you leave its organization. It is not part of a LoadOut export, Cloud Backup or Cloud Sync, but your phone's own backup includes it with your settings. Reset This Device removes it from your phone only. Delete My Account & All Data removes it from your phone and asks the server to erase the record of its fingerprint, which stays its two years if the server does not confirm.

What we don't collect

• Reloading data. Your loads, firearms, custom components, batches, brass logs, ballistic profiles, and shots-fired counts remain in the on-device SQLite database. We do not operate a server that receives them.
• Photos. LoadOut reads the photos you take or pick on your phone, and what it reads becomes part of what you save. A photo leaves your phone only when you share it yourself or choose Improve with AI; what LoadOut read from it leaves only with the record you save it in, or when you choose Improve with AI. The Camera bullet and AI Smart Import, below, say what Improve with AI sends. LoadOut keeps no photo, and nothing read from one, on any server.
• Location: we operate no server that receives it. We use your location only when you ask for it: when you pull current conditions for a ballistics calculation, when you start a Live Feed (it repeats that pull at the interval you choose, only while the app is open, until you stop it), or when you save a range location. Your coordinates go to the weather provider with each pull, with nothing that identifies you or your account attached, and no LoadOut server ever receives them. They are also saved on your device, alongside the records that use them: the ballistic profile's Coriolis latitude, your range-day and atmosphere entries, and any range location you save. Because they are part of those records, they are included in the unencrypted JSON file that the local export action produces, and, if you enable cloud backup or Cloud Sync, inside the encrypted blob uploaded to your own cloud, which is unreadable without the passphrase we never have. You may review and clear them with the records that hold them.
• Microphone. LoadOut uses the microphone only for three things: Microphone Witness in SG Pulse dry fire, which you turn on, only while a dry fire session runs; Listen for Timer, which you tap to hear any shot timer's start beep, only while Timer Capture is listening; and Shot Witness, which you turn on for your Apple Watch or Wear OS watch, only while its shot capture is running. It listens for the click of your trigger or your timer's start beep: the sound is analyzed on your phone as it arrives, and no audio is recorded, stored, or sent anywhere. LoadOut keeps only a mark on each dry fire shot saying whether its click was heard, and the moment a start beep was heard. If you choose your watch for Microphone Witness, it listens the same way and sends your phone only the moment it heard a click, never the sound. Your Apple Watch or Wear OS watch listens for the start beep the same way when you tap Listen on its Listen page or its DOPE page, and, during a Dry Fire session you start on your phone, without a tap while LoadOut is open on its Listen page with the screen on, and your phone is waiting for the start. It sends your phone only the moment it heard the beep, never the sound. Once a listen has started, it can keep running, including while your wrist is lowered. Shot Witness listens on your watch or your phone, whichever you choose, for the sound of your shot: the sound is analyzed on that device and never stored or sent, and LoadOut keeps only the moment a shot was heard, which goes from your phone to your own watch when your phone listens.
• Bluetooth. Bluetooth is used only to connect to devices you already own: a Kestrel 5-series weather meter, a WeatherFlow WEATHERmeter, a Calypso wind meter, another wind meter that uses the Bluetooth standard Environmental Sensing service, a Shooters Global SG Timer, or a Shooters Global SG Pulse. Each connection is established directly between your phone and that device; readings and shot times are delivered to the application on your phone and are never transmitted to us. On Android, the scan permission is declared never-for-location, so pairing does not disclose your location.
• Weather history. While a weather meter you paired is connected, LoadOut records its readings on your phone as that meter's weather history: wind speed, lull, gust and direction, temperature, humidity, station pressure, altitude and the density altitude the meter reports, with the meter's name and model. It keeps recording with the phone locked while the meter stays connected. No location is stored with it, and it is never transmitted to us. It stays in the on-device database until you clear it or forget the meter, and Reset This Device and Delete My Account & All Data erase it too. It is included in the local export and, if you enable cloud backup, inside the encrypted blob uploaded to your own cloud. You can turn recording off for each meter on this phone from its Weather History screen.
• Contacts, calendar, health data, advertising identifiers, and browsing history. The application does not request access to any of these.

Device permissions

LoadOut requests the following device permissions only when you use the relevant feature. You may decline any of them and continue to use the remainder of the application.

• Camera. To take a photo, scan a QR code or aim at a target, only when you choose to in LoadOut. LoadOut reads, on your phone, the photos you take of an ammunition box's label and barcode, a chronograph's screen, load notes or a recipe page, handwritten or printed, and a DOPE card. You can also photograph a target for a shot group's analysis, and add a photo to a firearm, load, inventory item, brass log or piece of equipment. LoadOut keeps on your phone a box's photo with the box you save, a target's photo with its analysis, a photo you add with the item you added it to, and, for up to 90 days, the photos behind a chronograph import you have not finished. It does not save the other photos with your data. A box's, a target's and an added photo go into a LoadOut export only when you choose Data and Photos. No photo is part of Cloud Backup or Cloud Sync, and a photo goes to your photo library only when you save it there. A photo leaves your phone only when you share it yourself, or when you choose Improve with AI on a chronograph import, which sends a cropped picture of its screen, never the whole photo, with any numbers LoadOut has already read. Improve with AI on load notes sends only the text from your notes and the recipe fields LoadOut filled in from it, never the photo. AI Smart Import, below, says where these go. The QR codes are a recipe or other data another LoadOut user shared with you, a code from your organization or a match, and the code your e-reader shows, for its address. LoadOut uses only the text in the code, as it would text you type or paste, and does not keep the picture. A code from your organization or a match goes to LoadOut, as a typed one does, when it is needed to unlock what the code gives you. When you aim at a target with the camera, the bearing and angle come from your phone's compass and tilt, and nothing the camera shows is saved or sent.
• Photo library. To pick a photo you already have instead of taking one, for a chronograph's screen, load notes, a DOPE card, a target for a shot group's analysis, or a photo you add to a firearm, load, inventory item, brass log or piece of equipment; and to save into your library, only when you choose to, a shot group's annotated card or video, in a LoadOut album, and a chronograph import's screen photos when you tick the box to save them. LoadOut reads only the photos you pick, and keeps or sends a picked photo only as the Camera bullet above says for a photo you take.
• Location (when in use). To retrieve current conditions for ballistics calculations when you request them, including each update of a Live Feed you start, and to record a range location when you choose to save one. Your coordinates are transmitted only to the weather provider, and only for a conditions request.
• Bluetooth. To connect to a device you already own and read from it: current conditions from a Kestrel 5-series weather meter, a WeatherFlow WEATHERmeter, a Calypso wind meter or another wind meter that uses the Bluetooth standard Environmental Sensing service, split times from a Shooters Global SG Timer, or your rifle's cant and detected shots from a Shooters Global SG Pulse. This applies to Android 12 and newer only. LoadOut never uses Bluetooth to determine your location.
• Microphone. To hear the click of your trigger during SG Pulse dry fire, when you turn on Microphone Witness for your phone. LoadOut asks when you turn it on. It listens only while a dry fire session runs, including with your phone locked or LoadOut behind another app, and stops when you turn Dry Fire off, your Pulse disconnects or the session ends. Your phone shows that the microphone is in use while LoadOut listens, and on Android LoadOut also shows a notification, if notifications are allowed. It also hears your shot timer's start beep, from any shot timer, when you tap Listen for Timer: LoadOut asks the first time you tap it, and listens only while Timer Capture is listening. Your Apple Watch or Wear OS watch asks for its own microphone the first time it listens, and listens for no longer than its Listen Timeout each time: when you tap Listen on its Listen page or its DOPE page, and, during a Dry Fire session you start on your phone, without a tap while LoadOut is open on its Listen page with the screen on, and your phone is waiting for the start. That Dry Fire listening stops when the string starts, when you leave the Listen page, or when the session ends. Once a listen has started, it can keep running, including while your wrist is lowered. For Shot Witness, when you choose your phone, LoadOut asks the first time you choose it and listens only while your watch's shot capture is running; when you choose your watch, your watch asks for its own microphone.
• NFC. To write your DOPE card to a battery-free NFC e-paper card on your rifle, when you hold your phone to it. On iPhone, iOS shows its scan sheet each time you send to a card, with no one-time prompt; on Android NFC needs no prompt. The card holds only the picture written to it. LoadOut keeps, with your other settings, which card sizes fit and which did not for each kind of card, and the orientation you used, for each rifle and overall, and the fields and their order for each place you send from. These go wherever your settings go: your phone's own backup, a LoadOut export you make, and your own Cloud Backup and Cloud Sync when you use them, encrypted on your phone with your passphrase. The note you last added in each place you send from stays only on the phone you typed it on, until you clear it: it is not in your phone's own backup, a LoadOut export, Cloud Backup or Cloud Sync. It leaves your phone only as words drawn on your card, whether written to an NFC card, sent to your e-reader or shared as a picture. None of this is ever sent to LoadOut.
• Local network. To send your DOPE card to your own e-reader or e-paper photo frame over Wi-Fi, when you choose to send it there. On iPhone, iOS asks once, the first time you send to it; on Android it needs no prompt. LoadOut sends only the picture of the card you see, with any note on it, straight from your phone to the e-reader, over your Wi-Fi or the e-reader's own hotspot, while its file transfer screen is open, or to the frame, over your Wi-Fi. The picture is not encrypted, and the e-reader does not check who sends it; a frame checks only its own password, if it is locked with one. So anyone else on that network at that time could see the picture or change it. If you send to an e-paper photo frame that is locked with its own password, LoadOut asks you for that password and sends it too, only to the address you typed it for and only when the frame there asks for it. The password is not encrypted either, so anyone else on that network at that time could read it. No LoadOut server is involved, and nothing is sent to LoadOut. LoadOut keeps your e-reader's or frame's address and your choices for it with your other settings, for your next send. These go wherever your settings go: your phone's own backup, a LoadOut export you make, and your own Cloud Backup and Cloud Sync when you use them, encrypted on your phone with your passphrase. The frame's password is not one of those settings and does not go where they go: LoadOut keeps it in the iOS Keychain or Android Keystore, for that address only, so it is not in a LoadOut export, Cloud Backup or Cloud Sync. On iPhone, LoadOut keeps it for this iPhone only: your phone's own backup can bring it back to this same iPhone, but never to another iPhone restored from that backup, where the frame asks for it again; on Android it is not backed up. Reset This Device and Delete My Account & All Data erase them and the password from this phone. The card file, and the sleep screen picture if you turned that on, stay on the e-reader until you delete them there: neither of those two operations can reach it.
• Face ID. To confirm it is you before Show Passphrase shows your Cloud Sync passphrase or Save to Password Manager saves it. iOS asks once, the first time you use either.
• Notifications for downloads. To tell you when an AI download you started finishes while LoadOut is in the background. On iPhone, and on Android 13 and newer, LoadOut asks when you start a download, unless you have already answered. The notice is created on your phone, without any push notification service. If you decline, the download continues, and LoadOut tells you it has finished when you next return to it.
• Notifications for urgent match notices. Only for a match you turn Urgent Notices on for, so its director can tell you about a schedule change or a safety notice. LoadOut asks when you turn a match on, never before. If you decline, the switch stays off, and the match's announcements still appear in LoadOut.
• Notifications (Android 13 and newer). To show the notification Android requires while LoadOut keeps recording from a connected shot timer, SG Pulse or weather meter with the phone locked. LoadOut asks the first time one of them connects while LoadOut is on screen, unless you have already answered. If you decline, recording continues.
• Notifications for match reminders. To remind you before the times in a match's schedule, for a match where you turned on Remind Me. On iPhone, and on Android 13 and newer, LoadOut asks when you turn it on, unless you have already answered. Your phone schedules and shows each reminder itself, without any push notification service, and nothing about your reminders is sent anywhere. A reminder shows the match's name and a line from its schedule, which your phone may show on the lock screen, depending on its settings. If you decline, Remind Me stays off, and the schedule is still shown in LoadOut.

Backups & exports

There are two methods by which you may transfer your data off your device. Both are designed so that we never see the contents.

Local export (free)

You may export your full reloading database to a JSON file using the in-app export action. LoadOut passes the file to your device's share sheet, and you select its destination: saving it to Files or Downloads, transferring it by AirDrop, sending it by email, or sending it to any other application. Nothing is written outside the application until you select a destination. Our infrastructure is not involved.

Your device's own backup does not include this data

LoadOut excludes its reloading database from the backup your phone makes of itself: iCloud Backup on iOS, Auto Backup on Android. That is deliberate, because those backups are made with your platform account's key rather than the passphrase you chose, so including your data would put it somewhere we had promised it would not be. The consequence is worth stating plainly, because it is the one that can cost you: if you replace or wipe your phone, restoring it from the platform's own backup will not bring your reloading data back. Your copies are the local export above, which is free, and cloud backup or Cloud Sync if you have Pro. Your settings (units, language, theme) do ride the platform backup, so they follow you to a new device.

Your settings also keep a record of how you use search in LoadOut: the searches you typed, the results you opened, and how often you picked each option in the app's lists. That record goes wherever your settings go: your phone's own backup, the local export, and cloud backup and Cloud Sync. You can remove recent searches and recently opened results in Search. Reset This Device erases all of it from this phone, and Delete My Account & All Data also deletes your encrypted cloud backups.

End-to-end encrypted cloud backup (Pro, opt-in)

If you have LoadOut Pro and you enable cloud backup, the application does the following:

• Prompts you to set a passphrase. Your data is encrypted on the device, with that passphrase, before any upload.
• Uploads the encrypted backup to your own cloud storage — iCloud Drive (iOS), Google Drive (any platform), or Microsoft OneDrive (any platform). You sign in to your cloud provider directly; we never handle your cloud credentials.
• Stores nothing on LoadOut servers. No LoadOut backend is involved in this process. The encrypted file travels between your device and your cloud provider.

We cannot read your backup, and we cannot recover a lost passphrase. If you forget it, the backup is unrecoverable. You should record the passphrase and retain it in a secure location.

Continuous Cloud Sync (Pro, opt-in)

Cloud Sync uses the same encryption model as the one-shot backup described above: encrypted on this device with your passphrase, and written to the same cloud folder you selected. The difference is that the upload occurs automatically a few seconds after each save, and the download occurs on application launch and upon your use of the manual "Sync Now" button. A kind of record you switch off on a device stops syncing on that device and stays in the cloud copy for your other devices. Weather history is never synced. We never see the encrypted file, and we operate no backend that receives reloading data.

Use Remove From Cloud on the What Syncs page to delete one type of record, like Favorites, from your encrypted cloud copy. It stops syncing on all your devices, and anything already saved on a device stays there.

Your passphrase is kept in your device's keychain, and the platform may synchronize it to your own Apple or Google account so your other devices can use it; LoadOut never receives it. On iOS and macOS this is the iCloud Keychain, and on Android it is Google's Block Store. Both are encrypted, both are scoped to this application alone, and neither of them is a saved login you will find under your device's password list. It is your platform account, not ours: no LoadOut server distributes the passphrase, holds it, or can read anything encrypted with it. Where that account synchronization is unavailable, which is the case on the web and on a device signed out of its platform account, you enter the same passphrase on the other device instead, exactly as before. If you lose the passphrase and no synchronized copy reaches your new device, the synchronized data is unrecoverable, which is why you should still record it and retain it in a secure location.

LoadOut makes that account copy only once the passphrase has opened your encrypted copy in the cloud, or started a new one there. On Android, LoadOut asks Google to back that copy up to your Google account only when your phone has a screen lock, so the copy in your account is always end-to-end encrypted. Without a screen lock it stays on your phone, where a reinstall or a transfer to a new phone can still restore it.

You can save your passphrase in your phone's password manager. Apple or Google keeps that copy, and LoadOut never sees it.

Each time Cloud Sync saves, LoadOut also writes a small note beside your encrypted copy in your cloud storage. It holds only the model of the device that saved, such as iPad, and the time of that save, so a device of yours that cannot open your copy can still tell you which device saved last. The note is not encrypted. It never holds the name you gave your device or any of your reloading data. No LoadOut server receives it, and Delete My Account & All Data deletes it along with your encrypted copies.

Show Passphrase, on the Cloud Sync screen, shows the passphrase stored on this device only after you confirm it is you with Face ID, Touch ID, a fingerprint, or your device passcode or screen lock, every time. Your device does that check itself: LoadOut learns only whether it worked and never receives any biometric data. Showing the passphrase sends it nowhere.

AI Smart Import (Pro, opt-in per use)

Pro users may opt in to AI Smart Import to improve a difficult read. The feature is disabled by default and runs only when you tap Improve with AI: on a photo import of load notes, or, as a last resort, on a Garmin chronograph screen LoadOut could not read well enough. It sends only what that one import produced to a minimal LoadOut-operated proxy, which forwards it to Anthropic's API on a LoadOut-held key, unless you use your own key, as described below.

• For load notes it sends the text LoadOut read from your photo and the recipe fields LoadOut filled in from that text, never the photo. For a chronograph it sends a cropped picture of the screen alone, never the whole photo, with a summary of any numbers LoadOut has already read on your phone for that import, which can include numbers from other screens you added to it. We never see your saved recipes, firearms, batches, brass logs, or any other reloading data.
• The Garmin image escalation requests your explicit consent before any image is sent (on every import, never silently) and is subject to a per-import cap. It operates only when on-device reading and guided capture have already proved insufficient.
• The LoadOut proxy logs only timestamp, a short anonymous identifier, response status, and token counts. What you send (the text and recipe fields, or the cropped image and the summary of numbers) is not logged by us. The image is processed transiently to read the numbers and is not stored.
• Hosted mode uses Anthropic, whose API terms state they do not train on API requests.
• You may override the hosted proxy by entering your own Anthropic, OpenAI, or Google Gemini API key in Settings → AI. If you do so, the request is transmitted directly from your device to that provider (the LoadOut proxy is not involved) and that provider's own terms, rather than Anthropic's, govern it. Your key is stored on this device only, in the iOS Keychain or Android Keystore.
• A monthly cap of 20 AI calls per Pro user limits the cost of the feature for hosted-mode users.

Siri Voice Commands (free, opt-in)

LoadOut can answer questions through Siri on your iPhone and Apple Watch (a firing solution, a cartridge specification, a mil-to-MOA conversion) and can queue a logged shot or a dictated note for you to confirm the next time you open the application. The feature is free, and it is off until you turn it on in Settings → AI Features.

• We receive nothing. LoadOut sends nothing to any LoadOut server when you use this feature. There is no LoadOut backend involved in it at all. Every promise elsewhere in this policy about our own infrastructure is unchanged.
• Your request is handled by Apple, under Apple's terms. When you speak to Siri, your request and LoadOut's answer are processed by Apple's assistant under Apple's privacy policy, not ours. Apple does not publish whether a request of this kind is processed only on your device or also on Apple's private servers, so we do not claim either. If you want to see what your own device sends, your iPhone reports it under Settings → Privacy & Security → Apple Intelligence Report.
• We ask Apple for the smallest surface available. LoadOut does not add your firearms, recipes, or ballistic profiles to the system-wide Spotlight index, does not adopt Apple's shared assistant data schemas, and does not donate a searchable index of your data. When you say the name of a firearm, the matching happens inside the LoadOut process.
• A small answer file is stored on your device. So that Siri can answer without opening the application, LoadOut writes an already-computed summary (the firearms, profiles and solved distances an answer might need) into a private container on your own device, shared only between LoadOut and its own Siri extension. It stays on the device. It is not part of the JSON file the local export action produces, and it cannot be included in a cloud backup or in Cloud Sync.
• Answers are spoken out loud. A firing solution is read aloud on the device you asked, with the same confidence caveats the screen shows. Anyone near you can hear it.
• LoadOut does not ask for your microphone for this. Siri listens; LoadOut does not. This feature adds no microphone access.
• Turning it off erases what was stored. Switching Siri Voice Commands off in Settings → AI Features erases the stored answer file. Commands you queued but haven't confirmed stay in the app until you confirm or delete them.
• Both privacy operations erase it too. Reset This Device and Delete My Account & All Data each erase the stored answer file and any queued commands, along with everything else.

Companion apps on your watch

If you install the LoadOut companion app on an Apple Watch, a Wear OS watch, or a Garmin watch, your phone sends it what it needs to be useful at the firing line: the active load, the firing solution and its holds, your target card, and the shots you log on the wrist. This travels over the paired-device channel the platform provides (Apple's Watch Connectivity, Google's Data Layer, Garmin's Connect IQ), directly between your phone and your watch. No LoadOut server is involved, and we receive none of it.

What the watch holds, it holds on the watch, in that application's own private storage. When you turn the feature off, or run either of the privacy operations below, your phone asks every paired watch to discard what it is holding. That request is best effort, and we would rather say so than imply otherwise: a watch that is switched off, out of range, or unpaired at that moment does not receive it, and the channel returns no acknowledgement, so your phone cannot confirm that any watch acted. A watch that missed the request discards what it holds the next time it connects and hears one. If you are disposing of a watch, unpair it and erase it through its own settings rather than relying on this.

Spoken output

LoadOut can read a firing solution out loud: a target card row on your phone, or the next target on your watch after you log a shot. To do it, the application hands the finished sentence to the speech engine built into the platform: AVSpeechSynthesizer on iOS and macOS, the system text-to-speech service on Android, and the browser's own SpeechSynthesis on the web. No LoadOut server is involved, and we receive nothing.

We cannot tell you whether that sentence stays on your device. Some platform voices synthesize speech locally and others do it over the network, and the platform does not reliably publish which is which. Android exposes a per-voice flag that no part of the system enforces, and iOS and the browser expose nothing at all. LoadOut prefers a voice that reports itself as local where the platform offers that signal, but a preference is not a guarantee and we will not claim one in either direction. If you would rather nothing be spoken, spoken output has its own setting and you can leave it off. Speech is output only: the application does not open your microphone for it, and requests no recording permission.

Sub-processors and third parties

We use the following third-party services to operate LoadOut. Each has its own privacy policy, which governs its handling of the data we send to it.

• Google Cloud / Firebase (Authentication, Hosting, Storage for catalog updates). https://firebase.google.com/support/privacy
• Google Firebase Cloud Messaging (urgent match notices, only for a match you turn them on for). https://firebase.google.com/support/privacy
• RevenueCat (in-app purchase verification and entitlement). https://www.revenuecat.com/privacy
• Cloudflare (LoadOut's server runs on Cloudflare Workers + KV: it receives AI Smart Import requests in hosted mode, the Pro request for a code from your organization or a match when you use one, and each request your phone makes for a sealed match's key). https://www.cloudflare.com/privacypolicy/
• Anthropic (AI Smart Import hosted mode forwards, through our proxy, the text read from your load notes with the recipe fields LoadOut filled in from it, or a cropped picture of a chronograph's screen with a summary of the numbers LoadOut already read, to Anthropic's Messages API; also available as a BYOK provider). https://www.anthropic.com/legal/privacy
• OpenAI (only if you choose OpenAI as your BYOK provider in Settings → AI — the request then goes directly to OpenAI under their terms, never via our proxy). https://openai.com/policies/privacy-policy
• Google Gemini (only if you choose Google Gemini as your BYOK provider in Settings → AI — the request then goes directly to Google under their terms, never via our proxy). https://ai.google.dev/gemini-api/terms
• Apple App Store / Google Play for purchase processing and subscription management. https://www.apple.com/legal/privacy/ · https://play.google.com/about/play-terms/
• Apple: Siri and App Intents, only if you turn on Siri Voice Commands. Your spoken request and LoadOut's answer are processed by Apple under Apple's own privacy policy. https://www.apple.com/legal/privacy/
• Sign-in providers if you use them: Google, Apple, Microsoft. We request the minimum scope needed to identify you (typically email and name).

How long we keep data

• Reloading data: we do not hold it. It resides on your device for as long as you retain it there.
• Account record (Firebase Authentication): retained until you request its deletion, or until the account has been inactive for an extended period (we will define a specific retention window in a future revision).
• Purchase records (RevenueCat and the stores): retained for as long as the subscription or lifetime entitlement remains active, and as required by Apple, Google, and applicable tax law.
• Code records (LoadOut's server): when a code from your organization or a match turns on Pro, the server keeps a fingerprint of the code with your Firebase user ID for two years, so one code cannot give the same account Pro twice. Delete My Account & All Data asks the server to erase them sooner, as the deletion section below says; Reset This Device does not.
• Voice-command data: the answer file LoadOut stores for Siri lives on your device only. It is rewritten when your data changes and erased when you turn the feature off. We hold none of it.

How to delete your data

• On-device data: open Settings → Privacy & Data → Reset This Device to clear your loads, firearms, batches, brass logs, and ballistic profiles from this device. Your cloud backup and account remain active, so that you may restore your data at a later time.
• Account & all data: open Settings → Privacy & Data → Delete My Account & All Data to permanently delete your LoadOut account, the data on this device, your encrypted cloud backups across every connected provider, and the linked subscription identity. It also asks LoadOut's server to erase the records it keeps of the codes that turned on Pro for your account. If the server does not confirm that, your account is still deleted, the message at the end does not say all associated data was deleted, and those records stay until their two years end. This action cannot be undone.
• Voice-command data: turn off Siri Voice Commands in Settings → AI Features to erase the stored answers. Commands you queued but haven't confirmed are removed by either of the two operations above.
• Cloud backup: the “Delete My Account & All Data” flow above deletes the encrypted backup files from every cloud provider the app can still reach. If you had already disconnected a provider or revoked LoadOut's access to it, the encrypted file may remain in your own storage — delete it yourself from your iCloud Drive, Google Drive, or OneDrive. It is unreadable without your passphrase, which we never had.
• Uninstalling the application removes the local database and clears any cached catalog updates.

Your privacy rights

Depending on your jurisdiction of residence, you may have additional rights over your personal information.

• European Economic Area / United Kingdom (GDPR / UK GDPR): you have the right to access, correct, delete, restrict, port, and object to processing of your personal data. The lawful bases we rely on are contract (to provide the app and Pro entitlement), consent (for any optional telemetry we add later), and legitimate interest (for security and abuse prevention). You may also lodge a complaint with your supervisory authority.
• California (CCPA / CPRA): we do not sell or share your personal information for cross-context behavioral advertising. You have the right to know, delete, correct, and limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond providing the app.
• Other US states (CO, CT, VA, UT, etc.): we honor analogous consumer rights to access, delete, correct, and opt out, where applicable.

To exercise any right, send a request to support@johnsondigitalsystems.com from the email address associated with your account. We will respond within the period required by law in your jurisdiction.

Children

LoadOut is not directed at children. We do not knowingly collect personal information from any person under 18 years of age. Reloading is for adults only; refer to the in-app safety disclaimer.

International data transfers

Firebase Authentication and RevenueCat may process your data in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms to safeguard cross-border transfers.

Security

We use TLS for any data in transit between the application and our service providers. Cloud backups are encrypted on your device with your passphrase before upload, using authenticated encryption. We do not, however, guarantee absolute security; no system is invulnerable. If we discover a breach affecting your personal information, we will notify you as required by law.

Changes to this policy

If we make material changes, we will update the effective date and provide notice within the application (typically by re-prompting the disclaimer or privacy dialog).

Contact