Last updated: September 10, 2026
Johnson Digital Systems builds software with privacy as a foundation, not a feature. This policy covers johnsondigitalsystems.com and gives an overview of the products we publish. Where a product ships its own privacy policy, that policy is the authoritative one for the product and takes precedence over the summary here.
johnsondigitalsystems.com is hosted on Firebase. We do not add tracking, advertising pixels, or third-party analytics to this site.
If you submit the contact form or join a waitlist, what you enter — your name, email address and message on the contact form, your email address on a waitlist — is delivered to us by Formspree (formspree.io), a third-party form service that receives and stores the submission under its own privacy policy. We use it solely to respond to your inquiry or to tell you about the launch you asked about, and we do not sell or share it.
LoadOut is built local-first. Your reloading data — loads, firearms, components, batches, brass logs, range sessions, ballistic profiles — lives in a database on your device. We do not operate a server that receives it. We do not use general analytics, we do not sell your data, and we do not track what you do in the app.
The LoadOut privacy policy is maintained with the app, and that document governs. It is the complete and authoritative statement of how LoadOut handles your data — including your rights, retention periods, sub-processors, and international transfers. What follows on this page is a short orientation only. Where the two differ, the app policy is correct.
In outline, here is what leaves your device and why. Each item is tied to a feature you choose to use. This is an orientation, not the complete list — the app policy above is.
Sign-in (optional)
If you sign in, Firebase Authentication receives your email address, your name where your sign-in provider supplies it, OAuth tokens for that provider, and sign-in metadata. Used to authenticate you — not for marketing or analytics.
Purchases
If you buy Pro, RevenueCat receives your account identifier, the store-level transaction record, and anonymous device metadata needed to validate receipts, so your purchase follows your account across devices. It does not receive your email address or any reloading data.
Diagnostics
Firebase Crashlytics receives crash reports and non-fatal error reports the app catches for diagnostic purposes. Reports carry technical metadata only — no reloading data, no user-typed text, and no account identifier is attached. On by default; you can turn it off in Settings.
Cloud backup and Cloud Sync (Pro, opt-in)
Your data is encrypted on your device with a passphrase we never receive, then uploaded to your own iCloud Drive (iOS), Google Drive, or Microsoft OneDrive. Cloud Sync uses the same encryption and the same folder as a one-shot backup; the difference is that the upload happens automatically a few seconds after each save, and the download happens when the app launches or when you tap Sync Now. Nothing is stored on our infrastructure. The passphrase is kept in your device's keychain, and the platform may synchronize it to your own Apple or Google account so your other devices can use it; LoadOut never receives it. We cannot read your backup and cannot recover a lost passphrase.
Your device's own backup
iCloud Backup and Android's device backup deliberately leave your LoadOut data out, because neither is encrypted with your passphrase; they keep the app's settings only. A replaced or wiped phone therefore does not get your reloading data back that way. Your copies are the free local export and, on Pro, Cloud Backup. The Mac app carries no such exclusion.
AI Smart Import (Pro, opt-in per use)
In hosted mode, the text read from your import photo is sent to Anthropic through our proxy. For a chronograph screen that on-device reading and guided capture have both failed on, a cropped image of just that screen — never the raw full photo — may be sent as a last resort, only after you accept a disclosure shown before any image leaves the device, and capped per import. Our proxy logs a timestamp, a short anonymous identifier, the response status, and token counts — never your request body, and the image is not stored. You can instead enter your own Anthropic, OpenAI, or Google Gemini key in Settings, in which case the request goes directly from your device to that provider and that provider's terms govern it rather than Anthropic's.
Siri Voice Commands (free, opt-in)
If you turn this on, your spoken request and LoadOut's spoken answer are handled by Apple's assistant under Apple's privacy terms, not ours. We receive nothing: no LoadOut server is involved in this feature at all. Apple does not publish whether a request of this kind is processed only on your device or also on Apple's servers, so we do not claim either. LoadOut does not add your firearms, recipes, or ballistic profiles to the system-wide Spotlight index. Turning the feature off erases the answer file it stored on your device.
Location
We use your location only when you ask for it: when you pull current conditions for a ballistics calculation (Live Weather, a Pro feature, opt-in per use), when you save a range location, or — only if you have already allowed location access — to correct a weather meter's wind bearing for the local magnetic declination, a use that never prompts you and stores nothing. Your coordinates go to the weather provider, open-meteo.com, for that one request, with no account or identity information attached, and no LoadOut server ever receives them. They are also saved on your device alongside the records that use them, so they are included in the unencrypted JSON file the local export action produces and, if you turn on cloud backup or Cloud Sync, inside the encrypted blob uploaded to your own cloud. You can review and clear them with the records that hold them.
LoadOut gives you two different data operations, and they are not interchangeable. Reset This Device (Settings → Privacy & Data) clears your loads, firearms, batches, brass logs, and ballistic profiles from this device, and leaves your account and your cloud backup intact so that you can restore later. Delete My Account & All Data permanently deletes your LoadOut account, the data on this device, your encrypted cloud backups across every connected provider, and the linked subscription identity. That one cannot be undone.
Favorites, Vault, journey progress, reflections, and journal entries are stored locally on your device. None of this data is transmitted to our servers.
Daily Alignment uses Firebase Crashlytics, which receives crash reports and non-fatal error reports for diagnostic purposes. Audio content is served from Firebase Storage.
Privacy & data requests
support@johnsondigitalsystems.com
To access, correct, export, or delete your data, or to exercise any privacy right, email us here from the address tied to your account. This is the same address our app privacy policies and account-deletion pages use.
Everything else
hello@johnsondigitalsystems.com
General questions, including questions about this policy itself.
If you cannot open the LoadOut app, you can delete your LoadOut account and all of its data from the LoadOut account-deletion page.