Dayline Privacy Policy
Contact for privacy questions, requests and grievances (our grievance officer): Sahil Singh, privacy@dayline.online. Postal address: C3/385, 3rd Floor, Janakpuri, New Delhi 110058, India.
This policy covers the Dayline website, web app and Android app. Sahil Singh decides why and how the personal data described here is used: the "data fiduciary" under India's Digital Personal Data Protection Act 2023, and the "controller" under the EU and UK GDPR. It applies wherever you use Dayline.
Where Dayline is available. Everywhere except the European Union, the other EEA countries (Iceland, Liechtenstein, Norway), the United Kingdom and Switzerland: new accounts can't be created from those countries. We check the country Cloudflare's network places your connection in, only when a new account would be created, and we don't store it. An existing account keeps working when you travel, and this policy (including the EU and UK rights below) still applies to it. If you're in the US, the Consumer Health Data Privacy Policy below also applies.
The plain summary
- Dayline encrypts your entries on your device with a key only your devices, your passkey and your recovery key can open. We store the encrypted copy so your devices can sync. We can't read your entries, journal, health records or spending. On the web this depends on the app code we serve being honest (see section 11).
- Signing in with Google tells us your email address. It does not unlock your data.
- If you lose all your devices, your passkeys and your recovery key, we can't recover your data. Nobody can.
- AI features need to read text:
- You choose the AI mode when you set up Dayline, before your first entry: Standard AI or On-device only. Nothing is pre-selected and you can't continue without choosing; you can change it at any time in Settings › Privacy & security. We record your choice, the version of the choice you saw and the day inside your encrypted settings.
- Standard AI: when you log a message, the message and about a page of related context (which can include health and money details) are sent over an encrypted connection through our server to Cloudflare's AI service. If it needs more to get the message right, the AI can look things up in your history for that message (for example a whole earlier day with its spending, up to 20 matching entries from any dates, up to 15 expenses, or what Dayline knows about a person or place, over up to 5 AI calls). All of it is used for that request and discarded. Not stored by us, and not used to train AI; Cloudflare's terms say the same for them. AI day stories are off until you turn them on; each one sends the whole day's log (entries, money, health, moods, people) plus a few wins worked out on the device from your history (a journaling or workout streak, a personal best). AI week and month reviews, which you ask for on the Review screen when AI stories are on, send only that period's totals and counts worked out on your device (money by category with the top merchants, mood, health, habits with your repeating tasks' names), the names of the people and places that came up most, and each day's title and wins (which can name a person, a meal, a task or a plan): never the entries themselves. The Review itself, its charts and mood patterns are computed on your device. This is a promise backed by contracts, not by cryptography.
- Private AI (coming soon, not available yet): would run inside hardware-isolated "confidential computing" machines that your device checks first.
- On-device only: no AI model reads your entries; Dayline's built-in rules do, on all your devices. Your entries still sync encrypted.
- Voice entries (the mic in the composer, Standard AI only): your recording (two minutes at most) is sent over an encrypted connection through our server to Cloudflare's AI, which writes it down; with Clean up on, that text goes to the AI once more to fix punctuation and drop filler words. Both are used for that request and discarded: we don't store the recording or the text, and nothing is saved until you send the entry, which is then encrypted on your device like any other. We keep only how many seconds you recorded each month. This is a promise, not encryption. In On-device only mode no audio leaves your device: use your keyboard's own dictation instead.
- No ads, no trackers, no analytics SDKs, no selling or sharing data for marketing. We do keep usage counts: totals for the whole service of which features are used, which kinds of errors happen and how long things take, and how many accounts are active each day. They aren't linked to your account or device, and you can turn them off in Settings › Privacy & security › Usage counts.
- Dayline is for people 18 and over: the sign-in screen asks you to confirm it, and to accept the Terms (a separate tick; accepting them isn't consent to anything in this policy) before an account is created.
1. What we hold, and why
| What | Why | How long |
|---|---|---|
| Your email address, stored encrypted under our own key (a policy protection, not end-to-end) | Sign-in, contacting you about your account, security incidents and billing | While you have an account |
| A pseudonymous code derived from your verified email address (an HMAC; it is the same code whether you sign in with Google or, in the beta, Cloudflare Access), and which of the two you used last. We don't store your Google account id. | Recognising you when you sign in | While you have an account |
| Your encrypted data, and your keys wrapped so only your passkey or recovery key can open them | Syncing your devices | Until you delete it; platform backups up to about 30 more days, unreadable |
| Account metadata: the day you joined, the month you last signed in, your devices (random ids, the days they were added and last seen), your sign-ins (the hour each started and was renewed, the day it was last used, when it ends), your unlock methods (kind, public key, the hour added; for passkeys their id, site and connection type), your vault's random id and how many times its key was rotated, record counts, padded sizes and the hour each arrived, and the hour each encrypted object or snapshot was last written and how often. If one is scheduled: the day a reset takes effect, and the day we sent an inactivity warning | Running the service, fair-use limits, security | While you have an account; sign-ins end after 90 days at the latest, and we keep ended ones 30 days (expired: 1 day) |
| Your AI choice: on your server-side sign-in (session), the version of the AI choice your device confirmed (0 when you chose On-device only or haven't chosen). The choice itself, its version and the day are in your encrypted settings, which we can't read | So our AI relay refuses AI requests from a device that hasn't recorded a Standard AI choice | With the sign-in: at most 90 days, kept 30 days after it ends |
| The version of the Terms you accepted and the day | Showing which terms apply to your account | While you have an account |
| Short-lived security items: a per-minute AI call counter, pairing requests for a new device, and the exact time of a recent Google re-sign-in | Rate limits, adding a device, confirming risky actions | Minutes: pairing requests 5 minutes, the re-sign-in time 15 minutes |
| AI usage counts: the hour of each AI call for 2 days (to avoid double charging), daily counts for the billing period, command and compute totals for this billing period and the previous one, monthly totals; for voice entries the same counts plus the seconds of audio transcribed (never the recording or its text) | Fair-use limits and billing | 2 days / billing period / two periods / 13 months |
| Usage counts, if you leave them on: your devices send counts of app events (for example "entry logged", "reminder created"), the type of an error and the screen it happened on (never its message), and timing ranges (page load, unlock, sync, AI runs), each with only the app version, the platform (website, installed app or Android app) and the day. They're sent without your sign-in cookie, and we keep only service-wide totals. Your account's vault keeps the last day it was counted as active and how many AI commands were counted that day, and adds one to the daily totals of active and returning accounts. We also count visits to the landing page, with only the kind of site the visitor came from. With very few users, a total can still be about one person. | Seeing what works and what breaks | Totals: 400 days. The vault's counting state: until you turn usage counts off |
| If you turn on notifications on a device: that device's push address (encrypted under our own key) and which push service it uses (for example Google's); for each notification scheduled for it, when it fires (to the minute) and a random id, with the notification itself encrypted on your device so we can't read it or tell what kind it is; when a notification last got through; whether it wants security notices | Showing reminders, task and day notifications while Dayline is closed. We learn how many notifications are scheduled for each device and when; we never learn what they say. Security notices ("New sign-in to your Dayline", "A reset was scheduled") are sent by us and contain nothing about you. Budget alerts are made on your device and never reach us | Each notification: until it's sent or changed. The push address: until you turn notifications off on that device, remove the device or delete your account |
| Feedback you send from the app: your message, and only what you choose to add (technical details: app version, platform, screen, the type of the last error, browser and system family; a reply-to address; the entry you're reporting, off unless you turn it on, which then leaves end-to-end encryption) | Answering you and fixing Dayline. It passes through our server and our email provider (Resend) to our support inbox, a Gmail mailbox hosted by Google; our server doesn't store it, and we keep only a count of reports per type and hour | In the support mailbox for up to 30 days, then deleted; ask privacy@dayline.online to delete it sooner. Resend keeps a copy of the emails it sends, with their content, for up to 30 days |
| If you join the waitlist (on our home page, when the beta is full, or when Dayline isn't available in your country yet): your email address, encrypted under our own key (we can read it: a policy protection, not end-to-end), what you asked to hear about, and whether and on which day you confirmed. It isn't linked to an account | Emailing you about only what you ticked. We email once to confirm; nothing else is sent until you do | Unconfirmed: 7 days. Confirmed: until you unsubscribe (a link in every email) or write to privacy@dayline.online |
| Billing records (plan, payment status, billing period, top-up balance, invoices). Only once you subscribe to a paid plan | Billing and tax law. Our payment processor (Razorpay) holds your payment details and invoices; we never see your card or UPI number. | As long as tax law requires (in India, generally six years or more) |
| If you subscribe: Razorpay's ids for your subscription and customer record, the subscription's status, monthly or yearly, when the paid period ends, whether you cancelled it, the day you subscribed (shown as "Supporter since" in Settings), and which yearly renewal we already emailed you a reminder for. Never your card, UPI, bank, name or phone, and never the amount or details of a payment or refund (when Razorpay tells us one failed or was refunded, we only count that it happened, with no link to you) | Finding your account when Razorpay tells us about a payment, showing and cancelling your plan and your Supporter mark in Settings, the reminder 7 days before a yearly renewal | While you have an account; deleted with it (until Razorpay confirms the cancellation, we keep only the subscription id) |
| After you delete your account: only the day of the deletion | So your other signed-in devices erase their copy | 90 days |
We don't store your IP address. Cloudflare's network sees it when you connect, as any website's host does. We don't keep request logs with bodies, emails or account ids. Operations counters are kept as totals per hour for the whole service, with no user id, email, IP or content, for 8 days (daily AI totals for all accounts together: 400 days); security counters (which route answered with which error, per hour, with no user id or IP) are kept by Cloudflare for 3 months. We do not collect contacts, location, advertising identifiers, or your Gmail or SMS. Settings › Privacy & security › "See what we hold about you" shows these records for your account.
You need an email address (through Google sign-in) to have an account. Everything else in the table is optional or created by using the features you choose.
From Google sign-in we receive only your email address, that Google has verified it, and an account id we don't keep (the scopes openid and email). We don't receive your name, photo, contacts, mail or files. We use it only to sign you in and to contact you about your account, we don't transfer it to anyone except as section 4 describes, and we never use it for advertising.
Android widgets. If you add a Dayline widget that shows data (Today, Next up, At a glance) to your phone's home screen, Dayline, while it's open and unlocked on that phone, gives the Android app a small summary for it: counts for today, and only if you turn on "Show details on home screen" (Settings › More options, in the Android app; off by default) also today's spending and budget, the day's mood and your next reminders and tasks. The app keeps it on that phone, encrypted with a key held by Android's keystore, and doesn't send it to us or anyone else. It's erased when you lock Dayline, sign out, delete your account or remove the widget, and shown for at most 12 hours.
2. AI processing and sensitive information. Covered in the summary above. We send only what a request needs, and never your email address. You choose the AI mode when you set up Dayline (accounts made before this choice existed are asked once, with their current mode filled in, and confirm it with a tap). You can change it at any time in Settings › Privacy & security; it applies to all your devices. After unlocking, each of your devices tells our server which choice you made, and our AI relay refuses AI requests (messages, day stories, reviews, voice) from a sign-in that hasn't recorded Standard AI. That check relies on your device's word: it stops requests sent by mistake, for example by an old version of the app, but it isn't encryption. We don't use your content to train or improve AI models. The models are openly published ones that Cloudflare runs on its own network (Workers AI); their makers don't receive your requests.
What you log can include health, money and other sensitive information (in India, "sensitive personal data" under the IT Act rules; in the EU and UK, "special category" data such as health). We store it only end-to-end encrypted. It leaves your device readable only in the Standard AI requests and voice entries described above, and in feedback when you choose to include an entry.
3. Why we're allowed to use it. In India we rely on your consent, which you give by creating an account, by choosing Standard AI in the AI choice (for the AI requests, which can carry health and money details), and by using each feature, and which you can withdraw at any time (section 7); and on the uses the law allows without consent, such as meeting a legal obligation. Under the EU and UK GDPR:
- Your account, sync, sign-in, notifications and the AI features you use: to provide the service you asked for (our contract with you). Where an AI request carries health or other special-category information, we rely on your explicit consent, which you give by choosing Standard AI in the AI choice and withdraw by choosing On-device only.
- Account and security emails, fair-use limits, security counters and preventing abuse: our legitimate interest in keeping Dayline working and safe. Breach notices: our legal obligation.
- Usage counts: our legitimate interest in seeing what works and what breaks, using only service-wide totals; you can turn them off at any time.
- Feedback: answering the request you send us. The waitlist: your consent (you confirm by email).
- Billing records: our legal obligations under tax law.
We don't make decisions about you based only on automated processing that have legal or similarly significant effects. The AI only proposes and writes entries that you can review, change or undo.
4. Who processes data for us.
- Cloudflare: hosting, storage and Standard AI (Workers AI), and, for beta accounts that signed in with an emailed code, Cloudflare Access.
- Google: sign-in, and, if you turn on notifications in Chrome or the Android app, delivering them (Firebase Cloud Messaging). They're encrypted on your device first, so the push service sees only when one arrives and its size. Other browsers use their maker's push service the same way (for example Mozilla's for Firefox, Apple's for Safari).
- Payments: Razorpay (Razorpay Software Private Limited, India) takes payments for paid plans on its own page. It receives what you enter there (your email, phone number and, for cards, the name on the card), your card, UPI or bank details and the payment mandate, and the device and connection details of that page. We send it only which plan you chose, never your email or entries, and we keep only its ids for your subscription and its status. Razorpay is responsible for that payment data as a regulated payment aggregator, under its own privacy policy, and keeps it in India as RBI's payment-data rules require.
- Email: Resend sends the emails our server sends: waitlist confirmations, the feedback you send from the app (on its way to our support inbox) and account notices (that a reset was scheduled, and the warning before an inactive account is deleted). Mail to our @dayline.online addresses, including that feedback, is forwarded by Cloudflare (Email Routing) to our support mailbox at Google (Gmail), where feedback is kept for up to 30 days.
Cloudflare and Resend process data for us under their data processing terms. Google acts on its own account for sign-in, for the support mailbox and for push delivery, as do the other browsers' push services, under their own terms and privacy policies. This list is kept current here. We'll tell you 30 days before adding one that can see unencrypted content. We don't sell your personal data or give it to anyone for their own marketing.
5. Where it's processed. Dayline is run from India. Our processors work outside India too: Cloudflare in its global network (including the US and EU; Workers AI runs wherever it has capacity), Resend in the US, and Google worldwide. Payment data stays with Razorpay in India. India's law allows this except to countries the government restricts, and none has been restricted as of this policy's date. We don't offer Dayline in the EU, EEA, UK or Switzerland; for existing accounts used there, these transfers are covered by the processors' Standard Contractual Clauses (with the UK Addendum) and, for Cloudflare, also the EU–US Data Privacy Framework.
6. How we protect it. Your entries and other content are encrypted on your device with keys we don't have, and every connection uses HTTPS. Your email address and push addresses are encrypted on our server under our own key. We keep no request logs and don't store IP addresses. Only Sahil Singh has access to Dayline's systems, and our processors are bound by contract to keep data secure. No system is perfectly secure: section 11 says where the limits are.
7. Your rights. You can export and delete your data in the app (Settings › Privacy & security). Deleting your account needs your passkey or recovery key, and cancels a paid plan (until the payment processor confirms, we keep only its customer id). Someone with only your Google account can't delete your account, but they can schedule a reset (meant for people who lost every key) that erases your stored data after 7 days unless one of your devices cancels it. Every device that opens Dayline shows it with a Cancel button, and we email you when it's scheduled. You can withdraw consent for AI (On-device only), for usage counts (Settings › Privacy & security › Usage counts), for the waitlist (the unsubscribe link) or for the whole service (delete your account) at any time; withdrawing doesn't undo processing already done. You can ask us for a summary of the records in section 1 and who processes them, have them corrected or erased, restrict or object to how we use them, get a copy in a portable format, and nominate someone to act for you if you die or become unable to. Most of this is in the app already: "See what we hold about you" shows the records, and your own data is yours to export.
To make a request or a complaint, write to privacy@dayline.online from your account's email address, or include the account code shown under "See what we hold about you", so we can find your records. We'll never ask for your recovery key. We acknowledge within 48 hours and reply within 30 days at the latest (we aim for 7). In India, if you're not satisfied with our answer, you can complain to the Data Protection Board of India. In the EU/UK, you can complain to your data protection authority at any time.
8. Deleting your account
In the Dayline web app (https://dayline.online) or Android app: Settings › Privacy & security › Delete account, confirmed with your passkey or recovery key. Your encrypted data, key wraps, email address, devices, sign-ins and the other records in section 1 are deleted at once. What stays for a while: platform backups for up to about 30 days, holding only encrypted data whose keys are gone; the day of the deletion for 90 days, so your other signed-in devices erase their copy; a paid plan's customer id until the payment processor confirms the cancellation, and the billing records tax law makes us keep; feedback you sent, in the support mailbox, for up to 30 days (ask and we'll delete it sooner); copies of emails our email provider (Resend) sent, for up to 30 days (including the confirmation we email you); and security counters with no account id, kept by Cloudflare for 3 months. A device that was offline or signed out keeps a locked copy until you erase it there.
If you can't use the app, write to privacy@dayline.online from your account's email address (or include your account code from "See what we hold about you"). If you write from another address, we'll ask you to confirm from the account's address. We never ask for your recovery key. We acknowledge within 48 hours, delete the account within 30 days, the same way as in the app, and email you a confirmation. We keep the email exchange about your request for up to 30 days, like feedback mail, then delete it.
9. Legal requests. If the law compels us, we can only hand over what we have: the records in section 1 and encrypted data we can't read. We'll tell you unless the law forbids it.
10. Security incidents. If a breach affects your data, we'll tell you without delay: what happened and when, exactly what was and wasn't readable, the likely consequences, what we've done and what you can do, and how to reach us. We'll report it as the law requires, including to the Data Protection Board of India and to CERT-In, and, where it applies, to the EU or UK data protection authority within 72 hours.
11. Important limits, honestly stated.
- The web app loads its code from our servers each visit. Our protection depends on that code being honest. Today that rests on trust in us. Each release's file fingerprints (SHA-256 hashes) are listed at /verify, so you can check that the files you received match that release; we plan to publish the source so others can check what the code does, and we haven't yet.
- A device that is unlocked can show your data to whoever holds it. Malware or a browser extension that can access Dayline's site can take your key even while Dayline is locked, and read everything stored with it.
- If you save your recovery key in a password manager tied to the Google account you sign in with (for example Chrome's Google Password Manager), someone who takes over that Google account could read the key.
- Home-screen widgets show what they show to anyone who sees your phone's home screen, also while Dayline is locked, like a notification. With details off they show counts only.
12. Inactive accounts. If you don't sign in with Google for 12 months, we delete your account and everything stored in it, and we can't restore it. We email you 30 days before; we don't delete an account we couldn't warn.
13. Age. Dayline is for people 18 and over. The sign-in screen asks you to confirm that you are before an account is created; if you answer no, nothing is created or sent. Please don't use it if you're younger. We don't knowingly process children's data, and we don't track anyone or show ads. If we learn that an account belongs to someone under 18, we delete it.
14. US privacy laws. We don't sell or "share" personal information as California law (CCPA/CPRA) defines those words, and we don't use sensitive personal information to infer things about you. Wherever you live, you can use the rights in section 7, and we won't treat you differently for using them. If you live in Washington, Nevada, Connecticut or another US state with a consumer health data law, the Consumer Health Data Privacy Policy below also applies.
15. Changes. We'll tell you in the app at least 30 days before a material change to this policy takes effect, unless the law requires a change sooner. Earlier versions are available on request.
Consumer Health Data Privacy Policy
This part of the policy is for people in the United States, and is written for Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data rules. The rest of this policy also applies; where they differ for consumer health data, this part does.
What consumer health data we collect. Only what you write or say into Dayline yourself: meals and calories, mood, sleep, workouts, steps, water and weight, symptoms, medication, and any other health notes in your entries. Dayline doesn't read sensors, other apps, your location or your contacts, and doesn't infer health conditions about you.
How it's stored. End-to-end encrypted: it's encrypted on your device with keys we don't have, and our server and Cloudflare store only locked copies so your devices can sync. We can't read it.
When it leaves your device readable. Only if you choose Standard AI in the AI choice when you set up Dayline (that choice is how we ask for your consent; nothing is pre-selected). Then the messages you log and their related context, which can include health details, go through our server to Cloudflare's AI to be understood, and are discarded after the request; AI day stories (off until you turn them on), AI reviews you ask for, and voice entries work the same way. We don't store any of it. In On-device only mode no health data leaves your device readable. It also leaves end-to-end encryption if you choose to attach an entry to feedback you send us (section 1: kept in our support mailbox for up to 30 days).
Why. Only to provide what you asked for: logging, organising and summarising your own entries.
Who receives it. Cloudflare, our processor, for storage (locked) and Standard AI requests (readable, for the request only). Nobody else. We don't sell consumer health data, we don't share it with anyone for advertising or their own purposes, and we don't use geofences around health care locations. If that ever changes, we'll ask for your separate consent first.
Your rights. You can:
- confirm whether we collect your consumer health data and see it: it's all on your devices; export it in the app (Settings › Privacy & security), and "See what we hold about you" lists what our server keeps (none of it is health data);
- see the list of processors that receive it (above);
- withdraw your consent: switch to On-device only at any time (Settings › Privacy & security), or delete your account;
- delete it: delete an entry, or your whole account in the app; or email us (section 8);
- appeal if we turn down a request: reply to our answer with "appeal" and we'll review it and answer in writing within 45 days. In Washington you can then contact the Attorney General's office (atg.wa.gov); in Nevada or Connecticut, your state's Attorney General.
To use any of these rights, write to privacy@dayline.online from your account's email address. We answer within 45 days (we aim for 7), and we won't charge you or treat you differently for asking.