QSL Buddy

Privacy Policy

Last updated: February 2026

Hey there!

I'm Priit, a fellow ham radio operator who built QSL Buddy as a solo indie project for the community. This isn't a big corporation — just me, trying to make QSO logging easier for everyone. Here's what you need to know about your data.

1. What QSL Buddy Collects

QSL Buddy collects:

  • Account Info: When you sign in with Google, QSL Buddy receives your name, email address, and profile picture.
  • QSO Logs: Callsigns, dates, times, frequencies, bands, modes, signal reports, grid locators, power, and notes you enter.
  • Voice Memos: Audio recordings you create for QSO logging, stored in encrypted cloud storage.
  • Settings: Your callsign, grid locator, and default band preferences.

2. Third-Party Integrations (Your Choice)

QSL Buddy can sync your QSOs with external services, but only when you explicitly enable each integration in Settings. Nothing is sent without your opt-in.

  • QRZ.com: Your QSO data is uploaded via their API using your QRZ API key.
  • ClubLog: Your QSO data is uploaded using your ClubLog credentials (stored encrypted).
  • LoTW (Logbook of The World): Your credentials are used to query QSL confirmations (stored encrypted).
  • Google Drive: If you opt into Drive backup, your QSO log is exported as an ADIF file and stored in your Google Drive. QSL Buddy uses the limited drive.file scope, which only allows access to files created by QSL Buddy — it cannot see or access any other files in your Drive.

You can disconnect any integration at any time in Settings.

3. QSL Buddy Bridge

The Bridge desktop application stores all received QSOs in a local SQLite database on your device. This data stays on your computer and syncs to the cloud only when an internet connection is available.

  • Your Bridge API token is stored as a SHA-256 hash in the database — the plaintext token is never stored.
  • You can export your local QSO backup to ADIF format at any time from within the Bridge app.
  • I do not have access to the data stored locally on your device.

4. Data Security

I take security seriously:

  • Encryption in transit: All traffic is encrypted with HTTPS/TLS. HSTS is enforced to prevent downgrade attacks.
  • Encryption at rest: Sensitive credentials (QRZ API key, ClubLog password, LoTW password, Google Drive refresh token) are encrypted with AES-256-GCM before storage. Your third-party passwords or API keys are never stored in plain text.
  • Database: Your data is stored in a managed database on DigitalOcean with automated backups and encrypted storage.
  • Authentication: Every API endpoint requires authentication. Your session uses a secure HttpOnly cookie that cannot be accessed by JavaScript.
  • Access control: Each user can only access their own data. All database queries are scoped to your user ID — you cannot access another user's QSOs, voice memos, or settings.
  • Rate limiting: API endpoints are rate-limited to prevent abuse and brute-force attacks.
  • Security headers: Industry-standard security headers including Content Security Policy, X-Frame-Options, and X-Content-Type-Options are set to protect against common web attacks (XSS, clickjacking, MIME sniffing).
  • Voice memos: Audio recordings are stored in DigitalOcean Spaces with encrypted storage and signed URLs that expire after a short time.
  • Bridge tokens: Bridge API tokens are stored as SHA-256 hashes — even I cannot see your token after it's generated.

5. Cookies & Sessions

QSL Buddy uses a single HttpOnly session cookie for authentication. It's secure, cannot be accessed by JavaScript, and is only used to keep you logged in. No third-party tracking cookies are used.

6. Analytics

QSL Buddy uses Google Analytics in production to understand basic usage patterns (page views, feature usage). No personal data is sent to Google Analytics. This helps me improve the app.

7. Data Sharing

I don't sell or share your data. Period. Your data is only sent to third-party services that you explicitly enable (see Section 2). The only other exception would be if required by law.

8. Your Rights

You can:

  • Export your QSO logs at any time in ADIF format
  • Export your local Bridge backup to ADIF
  • Delete your account and all associated data
  • Disconnect any third-party integration
  • Ask me what data I have about you

9. Guest Mode

If you use QSL Buddy without signing in, everything stays on your device. I don't see it, I can't access it — it's 100% yours.

10. Changes

If I make changes to this privacy policy, I'll update the date at the top of this page.

11. Questions?

Have questions about your data or this policy? Use the feedback form on the About page — I'm happy to chat!

73 de Priit

← Back to Home Terms of Service →