What Carryover keeps, where it keeps it, who can see it, and how to delete it. In plain language, because a logbook is a legal document and you should not have to guess.
When you add a page, the original photo goes to storage so the page can be read. It is kept while you check the page's grid, so that if the grid came out wrong you can turn the photo, move the split or redraw the page edges without photographing the page again.
It is deleted as soon as you confirm the page's grids. If you never do, it is deleted after 14 days at most. It is not kept as a copy of your logbook.
If reading a page fails, its photo is kept so that Try again has something to try. That copy is deleted within 24 hours whether or not you retry. A daily sweep deletes any other photo left in storage after a day.
Once a page is read, Carryover keeps the flattened image of each half of the spread and a small thumbnail for your book list. This is what lets you reopen a page, re-check a grid, or read a cell again later without photographing it a second time. These stay until you delete the page or your account.
Every value read off your pages, every correction you make, the grid you confirmed, and the aircraft and airports Carryover has learned from you are stored against your account. That is what lets you start review on a laptop and finish it on a phone.
Your email address and a password hash, held by Supabase Auth. Carryover never sees your password itself.
Payment is handled by Lemon Squeezy and your card details never touch Carryover. What is stored here is the order reference, the amount, and which logbook it paid for.
The close-up images of individual cells that review shows you are cached in this browser (IndexedDB: carryover_crops) and are never uploaded. They belong to the device you uploaded from.
So that your book opens at once, this browser also keeps the list of your pages and where each one is up to, as you last saw it, and the names of any photos that had not finished uploading. Deleting your data clears these from this device too.
Carryover runs its page processing and handwriting recognition on its own servers (Modal). Your pages are not sent to any third-party OCR or AI service.
You. Every table that holds your data is protected row by row, so a request carrying your sign-in can only ever read or write rows belonging to your account. Another signed-in pilot cannot reach your logbook, and a signed-out request reaches nothing.
I run Carryover, and I hold the keys to the database and the file storage, so your data is technically reachable by me. I do not read it, except when you ask me to look at a page that is not working. Nothing is shared with anyone else, nothing is sold, and nothing is used to train anything.
You can delete a single page from your book page at any time. To remove everything, use the button below. It deletes, in this order:
Files go before the records that point at them, deliberately: if a step fails, your account is still there and pressing the button again picks up where it stopped. Nothing is left stranded in storage with no way to find it.
It cannot be undone, and it does not export anything first — if you want your CSV, export it before you delete.
One thing it does not cover: if you also used the desktop version of Carryover with a licence key, those licence and activation records are filed under your email address rather than under this account, and deleting your account here does not remove them. Email me and I will delete them by hand.
Checking whether you are signed in…
Questions about any of this, or a deletion you want done by hand: reply to the email you signed up through and it reaches me.