Privacy Policy
The short version. What you track stays on your device. We never receive your activities, times, categories or statistics. When you subscribe we keep only your email address and your billing status. If you turn on reminders, we also keep the times a reminder should be sent, but never what you are tracking. We do not run ads, analytics or trackers, and we do not sell your data.
1. Who we are
Your DayFlow is operated by William Francom (“we”, “us”). You can reach us at williamrfrancom@gmail.com.
2. What stays on your device
Everything you record in DayFlow (your activities and subcategories, start and end times, history, statistics, settings, and the free-trial start date) is stored in your browser's local storage on your own device. We do not collect it, and we cannot see or recover it. Backups you export are files you keep; we do not receive them.
3. What we collect and why
| When | What | Why |
|---|---|---|
| You sign in to subscribe | Your email address; an account ID we generate; your login sessions (stored only as a one-way hash, and expiring after 90 days without use); the dates the account was created and updated | To identify your account and let you sign in |
| You ask for an emailed sign-in code | A one-way hash of your email address and of the code, when the code expires, and counts of wrong attempts and recent requests. We do not keep the code or your address in readable form in these records. | To check the code you enter and to limit abuse |
| You subscribe | Your Stripe customer ID; your plan, subscription status, current period end date, and whether it is set to cancel | To know whether your subscription is active and to manage billing |
| You turn on reminders | A random device key (stored only as a one-way hash); the address your device's push service gave us for notifications and its encryption keys; your time zone; the time your long-running-timer or not-tracking reminder should be sent; your daily check-in time; your quiet hours; the result of our last delivery attempt | To send the notifications you asked for |
| You use the website or app | Standard technical information our hosting providers record for every request, such as IP address, browser type and request time. Our account service also keeps operational logs of warnings and errors (for example the address requested and the error that occurred). These logs never include your tracked activities, and we do not record request contents. | To deliver the site, keep it secure and diagnose problems |
Reminders never include what you are tracking. The server learns when a timer is running or stopped so it can send a reminder, but never the name of your activity. Notification text is generic, so it is safe to show on a locked screen.
Payments. When you subscribe, Stripe collects your payment card and billing address. We never see your full card number. We receive only the information described above.
4. Who else handles your information
We use these service providers, who process information only to provide their services to us:
- Stripe processes payments, subscriptions and tax. See Stripe's Privacy Policy.
- Microsoft hosts DayFlow on Azure (United States) and, through Azure Communication Services, delivers the sign-in code emails we send you. See Microsoft's Privacy Statement.
- Google, only if you choose “Continue with Google”: your browser goes to Google to sign in, and Google gives DayFlow your verified email address. See Google's Privacy Policy.
- Cloudflare provides our domain name (DNS) service.
- Push services (operated by Apple, Google, Mozilla or Microsoft, depending on your device) deliver reminder notifications to your device. They receive the notification and your device's notification address.
We do not sell your personal information, and we do not share it for advertising. We may disclose information if the law requires it or to protect our rights or the safety of others.
5. What we do not do
- No advertising, analytics or tracking scripts, and no third-party code in the app.
- No selling or renting personal information.
- No access to your time data, because it never leaves your device.
6. How long we keep information
- Account information is kept while your account exists. When you delete your account in the app, we delete our account records and your sessions, and we cancel your subscription.
- Sign-in code records contain only one-way hashes, never your email address or a code in readable form, and are not tied to your account. Deleting your account removes your email address from our account records.
- Payment records. Stripe keeps invoices and payment records as long as tax, accounting and legal rules require, even after you delete your account.
- Reminder settings are deleted when you turn reminders off. They are also deleted automatically if your device's push address stops working.
- Sessions expire after 90 days without use, and you can end them by signing out.
- Server logs. Our account service's operational logs are kept for 30 days. Logs kept by our other hosting providers follow those providers' own retention periods.
7. Your choices and rights
- Export your data any time: Settings → Export my data.
- Delete your account: Settings → Account & subscription → Delete account.
- Turn reminders off: Settings → Reminders, or block notifications in your device settings.
- Erase your on-device data by clearing the site's data in your browser or deleting the Home Screen app. We cannot do this for you.
- Other requests. To ask what we hold about you, to correct it, or to have it deleted, email williamrfrancom@gmail.com. Depending on where you live, you may have additional privacy rights, and we will honor the ones that apply to you.
8. Security
We use encrypted connections (HTTPS), store login sessions and device keys only as one-way hashes, keep payment details with Stripe, and give our systems only the access they need. No method of storage or transmission is perfectly secure, and because your time data lives on your device, keeping that device secure is also part of protecting it.
9. Children
Your DayFlow is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.
10. Where information is processed
We host in the United States. Subscriptions are currently limited to customers in the United States.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect.