Draft for review by a qualified lawyer before publishing. Values in double braces are filled in by the founder.

Dayline Privacy Policy

Effective date: September 29, 2026

This policy explains how the Dayline app and the Dayline website at dayline.club handle information. Dayline is published by Dayline ("we", "us"). We are the controller of any personal data described in this policy.

The short version

• An account is optional. You can use Dayline without signing in. If you choose to, you can sign in with Apple (iPhone), with Google, or with an email link or 6-digit code.
• Signed out, everything stays on your phone. Without an account, your goals, steps, and settings are stored only on your device and the app sends nothing to us.
• Signed in, your goals sync. If you sign in, your goals, steps, and settings are copied to our database, hosted by Supabase, so they can sync between your devices. We use your email address and your Apple or Google account ID only to sign you in.
• No ads. No tracking. The app contains no analytics, no crash reporting, no advertising, and no tracking or attribution tools.
• Payments go through Apple or Google. We use RevenueCat to confirm your Dayline Plus subscription. We never see your card or bank details.
• You stay in control. Signed in, you can export your data or delete your account from the app's Settings at any time. Deleting your account deletes your data on our servers.
• The website is separate. If you join the waitlist on our website, we keep your email address to tell you about the launch. See Part B.

Part A: The Dayline app

1. Information we collect

If you do not sign in, none. A signed-out Dayline app makes no network requests to us or to any third party on our behalf. Your data stays on your device (section 2).

If you sign in, we collect the following, only to run your account:

We do not collect anything else. Specifically:

• There is no analytics, crash reporting, advertising, tracking, or attribution software in the app.
• The app does not use remote push notifications. It does not request a push token.
• The app does not download code or updates from the internet. Updates come only through the App Store or Google Play.
• We do not use your device's advertising identifier, and on iPhone the app does not ask for permission to track you.

We do not sell or rent your data, and we do not share it for advertising. We disclose it only to the service providers in section 6, who process it on our behalf.

2. Information stored on your device

The app always stores the following inside its private storage on your phone, signed in or not. If you are signed out, none of it leaves your device.

Home-screen widgets. If you add a Dayline widget, it shows your soonest goal on your home screen, where anyone who can see your phone can read it.

Share cards. When you share a card after finishing a goal, the app creates a temporary image, hands it to your phone's share sheet, and deletes it after the share sheet closes. The image goes only where you choose to send it.

3. Notifications

Dayline can send a daily nudge at a time you choose, a notification on the morning of your deadline, and a note after you finish a goal. These notifications are scheduled by your phone's operating system on the device. They are not sent from a server. Notification text includes your goal title, which may be visible on your lock screen. You can change the nudge time, turn it off in the app, or turn off Dayline notifications in your phone's settings at any time.

4. Permissions

The app asks for notification permission only to deliver the notifications above. It does not access your location, contacts, camera, photos, microphone, calendar, or health data.

On Android, the app also declares standard permissions that do not show a prompt. These are internet access (used only for sign-in, sync, and purchases), vibration (for haptic feedback), and, on Android 12L and older only, storage access (used by the share feature; the app does not read your files).

5. Signing in (optional)

You can use every free feature of Dayline without signing in. You need an account to sync between devices and to buy Dayline Plus, so your subscription stays with you.

• Sign in with Apple (iPhone). Apple handles the sign-in under Apple's Privacy Policy. Apple gives us an account ID and, the first time only, your name and email address (which may be a private relay address). To disconnect Dayline from your Apple ID, open the Settings app on your iPhone, tap your name, then go to Sign-In & Security and then Sign in with Apple.
• Sign in with Google. Google handles the sign-in under Google's Privacy Policy. Google gives us an account ID, your email address, and your name.
• Email. We send a sign-in link and a 6-digit code to the email address you enter. The email is sent by our sign-in service, Supabase, through our email delivery provider, Resend.

If you sign in with more than one method using the same verified email address, they are linked to one Dayline account.

Signing out in Settings removes your account details and sign-in session from the device and stops syncing. Your goals stay on the device, and your synced copy stays on our servers until you delete your account (section 9).

6. Service providers and payments

We use these providers to run the signed-in features. Each processes data only on our behalf and under its own security terms:

• Supabase (Supabase, Inc.) hosts our sign-in service and database. Your account details, goals, steps, settings, and subscription status are stored there, in the AWS Asia Pacific (Singapore) region (ap-southeast-1). Supabase also keeps short-lived technical logs of requests (such as IP address and time) for security. See Supabase's Privacy Policy.
• Resend delivers our sign-in emails (and, if you joined the waitlist, launch emails). It receives your email address and the message only.
• GitHub (GitHub, Inc.) stores our weekly database backups in a private repository for 90 days.
• GoDaddy hosts our [email protected] inbox. If you email us, your message and email address are stored there so we can reply.
• RevenueCat (RevenueCat, Inc.) confirms and manages your Dayline Plus subscription. When you start a trial, subscribe, or restore purchases, the app sends RevenueCat your purchase receipt from Apple or Google together with your Dayline user ID. It does not send your name, email, or goals. RevenueCat tells our server when your subscription starts, renews, or ends. See RevenueCat's Privacy Policy.
• Apple and Google provide sign-in (if you choose them) and sell Dayline Plus through the App Store and Google Play. They process your payment, subscription, trial, renewal, and any refund under their own terms and privacy policies. We do not receive your card number, bank details, or billing address.

7. Device backups and data leaving your phone

Apart from the signed-in features above, some data can leave your phone through features of your device that we do not control and cannot access:

• Backups. iPhone backups (including iCloud Backup) and Android backups (including Android's automatic backup to your Google account) may include Dayline's app data, depending on your device settings. These backups are managed by Apple or Google. We cannot see them.
• Sharing. Anything you send through the share sheet goes to the app or person you choose.
• App stores. Apple and Google process app downloads and purchases.

8. How long data is kept

• On your device: until you delete it or remove the app.
• On our servers (signed-in users only): for as long as you have an account. When you delete a goal, it is marked as deleted and no longer shown or exported, but it is kept in our database until you delete your account. When you delete your account, your account and everything linked to it are deleted from our database straight away. Copies in our weekly database backups, stored privately on GitHub, are deleted within 90 days.
• Technical logs at Supabase are kept for a short period set by Supabase, then deleted.
• RevenueCat, Apple, and Google keep purchase records under their own retention policies, including after you delete your Dayline account. Deleting your Dayline account does not delete your RevenueCat record automatically. To ask us to delete it, email [email protected] and we will do so within 30 days.

9. How to export or delete your data

Export (signed in). In the app, go to Settings > Export my data. The app downloads a copy of your account details, profile, settings, subscription status, goals, and steps as a JSON file and opens your share sheet so you can save it.

Delete your account (signed in). In the app, go to Settings > Delete account. This permanently deletes your account, your profile, your synced goals, steps, and settings, and your subscription record from our database. It cannot be undone. You can choose to keep your goals on this phone or remove them too. On iPhone, if you signed in with Apple, we also ask Apple to disconnect Dayline from your Apple ID. If you no longer have the app, you can request deletion at https://dayline.club/delete-account or by emailing [email protected] from the email address on your account. We delete the account within 30 days and confirm by email.

Deleting your account does not cancel your subscription. Your subscription belongs to your App Store or Google Play account. Cancel it in your App Store or Google Play subscription settings.

Delete what is on your device:

• iPhone: delete the Dayline app.
• Android: uninstall Dayline, or go to Settings > Apps > Dayline > Storage and tap Clear storage.

Copies inside your device backups are removed according to your backup settings with Apple or Google.

10. Security

On your phone, your data is protected by your phone's own security, including your passcode and the operating system's app sandbox, which stops other apps from reading Dayline's storage. Your sign-in session is kept in the device's secure storage where available. Everything the app sends is encrypted in transit (HTTPS). On our servers, each account can read and change only its own data, and subscription status can be changed only by our payment system, not by the app. Please keep your phone locked. Widgets and notifications can show goal titles on screen.

Part B: The Dayline website

This part covers dayline.club only. It does not apply to the app.

11. Information we collect on the website

• Waitlist email. If you join the waitlist, we collect the email address you enter. We use it only to tell you when Dayline launches and to send occasional product news. Every email has an unsubscribe link. We store the list in our database hosted by Supabase (section 6). We send the emails through Resend, which processes the list on our behalf.
• No analytics. The website has no analytics, advertising, or tracking scripts, and sets no cookies.
• Server logs. Our hosting provider, Cloudflare, keeps standard technical logs (such as IP address, browser type, and the page requested) for security and reliability. These logs are kept for a short period and then deleted.
• Web fonts. Our pages load the DM Sans and Instrument Serif fonts from Google Fonts, so your browser sends your IP address and browser details to Google when a page loads, under Google's Privacy Policy. We do not receive this data.
• Emails you send us. If you write to us, we receive your email address and whatever you include in the message.

We do not sell or share personal information.

12. Why we use it (legal bases for the EEA and UK)

• Waitlist email: your consent. You can withdraw it at any time by unsubscribing or emailing us.
• Server logs: our legitimate interest in keeping the website secure and working.
• Support emails: our legitimate interest in answering you, or taking steps you ask for.

13. How long we keep it

• Waitlist email: until you unsubscribe or we stop sending launch and product news, whichever comes first.
• Support emails: as long as needed to answer you, and no longer than 12 months after the conversation ends.
• Server logs: according to Cloudflare's standard retention, which is short and used for security only.

14. International transfers

App account data is stored with Supabase in Singapore (section 6), and our providers (Supabase, RevenueCat, Apple, Google, and our website providers) may process data in countries other than your own, including the United States. Where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

Part C: Your rights and other information

15. Your rights under GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. If you do not sign in, the app holds no personal data about you on our side. If you sign in, we process your account data to provide the account, sync, and subscription you asked for (performance of a contract). You can export it (portability and access) and delete it (erasure) yourself in the app, as described in section 9. To exercise any other right, email [email protected]. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).

16. Your rights under US state privacy laws (including California's CCPA/CPRA)

• App: if you signed in, we may have collected identifiers (your email address, your Apple or Google account ID, and your Dayline user ID), commercial information (your Dayline Plus subscription status), and the goals, steps, and settings you created, for the purposes described in Part A. If you did not sign in, we collected nothing through the app.
• Website: in the last 12 months we may have collected identifiers (your email address, if you joined the waitlist or wrote to us) and internet activity information (server logs), for the purposes described in Part B.
• We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not collect sensitive personal information.
• You have the right to know what we collect, to request deletion or correction, and to not be discriminated against for using these rights. Email [email protected]. An authorised agent may make a request for you. We will verify requests by confirming control of the email address involved.

17. Children's privacy

Dayline is a general-audience productivity app. It is not designed for or directed at children under 13, or under 16 in the EEA and UK. The app collects no personal data from anyone who does not sign in, and we do not knowingly let children create an account. The website does not knowingly collect personal data from children. If you believe a child has given us an email address or created an account, contact [email protected] and we will delete it.

18. Changes to this policy

If we change how Dayline handles data, for example if we change what the signed-in features send off your device, we will update this policy before the change takes effect, change the effective date above, and explain the change in the app's release notes. If a change needs your consent, we will ask first.

19. Contact

Dayline
Privacy questions and requests: [email protected]
General support: [email protected] · https://dayline.club/support