diff --git a/play-services-core/src/main/java/org/microg/gms/auth/AuthManagerServiceImpl.java b/play-services-core/src/main/java/org/microg/gms/auth/AuthManagerServiceImpl.java
index 1f5c26a796..8f1c5a09a1 100644
--- a/play-services-core/src/main/java/org/microg/gms/auth/AuthManagerServiceImpl.java
+++ b/play-services-core/src/main/java/org/microg/gms/auth/AuthManagerServiceImpl.java
@@ -37,6 +37,7 @@
 import com.google.android.gms.common.api.Scope;
 
 import org.microg.gms.common.PackageUtils;
+import org.microg.tools.CondLog;
 
 import java.io.IOException;
 import java.util.ArrayList;
@@ -79,7 +80,7 @@ public Bundle getToken(String accountName, String scope, Bundle extras) throws R
         packageName = PackageUtils.getAndCheckCallingPackage(context, packageName, extras.getInt(KEY_CALLER_UID, 0), extras.getInt(KEY_CALLER_PID, 0));
         boolean notify = extras.getBoolean(KEY_HANDLE_NOTIFICATION, false);
 
-        Log.d(TAG, "getToken: account:" + accountName + " scope:" + scope + " extras:" + extras + ", notify: " + notify);
+        CondLog.print(TAG, CondLog.DEBUG_SENSITIVE, "getToken: account:" + accountName + " scope:" + scope + " extras:" + extras + ", notify: " + notify);
 
         /*
          * TODO: This scope seems to be invalid (according to https://developers.google.com/oauthplayground/),
diff --git a/play-services-core/src/main/java/org/microg/tools/CondLog.java b/play-services-core/src/main/java/org/microg/tools/CondLog.java
new file mode 100644
index 0000000000..41c695642c
--- /dev/null
+++ b/play-services-core/src/main/java/org/microg/tools/CondLog.java
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2019 microG Project Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.microg.tools;
+
+import android.util.Log;
+import com.google.android.gms.BuildConfig;
+
+import static android.os.Build.VERSION.SDK_INT;
+
+public class CondLog
+{
+
+	private CondLog()
+	{
+	}
+
+	// special log level only for use with auth tokens
+	// and other privacy-sensitive information
+	public static final int DEBUG_SENSITIVE = 42;
+
+	public static boolean isLoggable(String tag, final int level)
+	{
+		// Note: Log.isLoggable() will only return true for levels of INFO and above by
+		// default. To override this behavior, set system properties as described in the
+		// documentation for Log.isLoggable(), or add appropriate filtering code here.
+
+		// Log.isLoggable() will throw an exception if the length of the tag is greater than
+		// 23 characters, on API Level 23 or prior, see:
+		// https://developer.android.com/reference/android/util/Log.html#isLoggable(java.lang.String,%20int)
+		// so trim it if necessary to avoid the exception.
+		if (tag.length() > 23 && SDK_INT < 24)
+		{
+			tag = tag.substring(0, 22);
+		}
+
+		if (! BuildConfig.DEBUG && level == DEBUG_SENSITIVE) {
+			return false;
+		} else {
+			return Log.isLoggable(tag, level);
+		}
+	}
+
+	/**
+	 * Call Log.*(tag, msg, tr) if loggable
+	 * 
+	 * @param tag
+	 *            Used to identify the source of a log message. It usually identifies the class
+	 *            or activity where the log call occurs.
+	 * @param level
+	 *            Requested log level
+	 * @param msg
+	 *            The message you would like logged.
+	 * @param tr
+	 */
+	public static void print(final String tag, final int level, final String msg, final Throwable tr)
+	{
+		if (isLoggable(tag, level))
+		{
+			switch (level) {
+				case Log.VERBOSE:
+					Log.v(tag, msg, tr);
+					break;
+				case Log.DEBUG:
+					Log.d(tag, msg, tr);
+					break;
+				case Log.INFO:
+					Log.i(tag, msg, tr);
+					break;
+				case Log.WARN:
+					Log.w(tag, msg, tr);
+					break;
+				case Log.ERROR:
+					Log.e(tag, msg, tr);
+					break;
+				case Log.ASSERT:
+					Log.wtf(tag, msg, tr);
+					break;
+				case DEBUG_SENSITIVE:
+					Log.d(tag, msg, tr);
+					break;
+			}
+		}
+	}
+
+	/**
+	 * Call Log.*(tag, msg) if loggable
+	 * 
+	 * @param tag
+	 *            Used to identify the source of a log message. It usually identifies the class
+	 *            or activity where the log call occurs.
+	 * @param level
+	 *            Requested log level
+	 * @param msg
+	 *            The message you would like logged.
+	 */
+	public static void print(final String tag, final int level, final String msg)
+	{
+		if (isLoggable(tag, level))
+		{
+			switch (level) {
+				case Log.VERBOSE:
+					Log.v(tag, msg);
+					break;
+				case Log.DEBUG:
+					Log.d(tag, msg);
+					break;
+				case Log.INFO:
+					Log.i(tag, msg);
+					break;
+				case Log.WARN:
+					Log.w(tag, msg);
+					break;
+				case Log.ERROR:
+					Log.e(tag, msg);
+					break;
+				case Log.ASSERT:
+					Log.wtf(tag, msg);
+					break;
+				case DEBUG_SENSITIVE:
+					Log.d(tag, msg);
+					break;
+			}
+		}
+	}
+}