Your Privacy is Our Priority

1. Information We Collect

Personal Information

When you create an account, we collect:

• • Email address (required for account creation and login)
• • Name (optional, for personalization)
• • Password, if you set one, stored only as a one-way hash, so nobody can read it
• • Timezone and email preferences (for delivering insights at optimal times)
• • If you choose to sign in with Google or Apple where it is offered: the name, email address and account identifier they share with us. We never receive your Google or Apple password, and we send nothing you write to either of them. If you use Apple's "Hide My Email", we only see the private relay address Apple gives us.

Journal Data

Your journal entries and related data:

• • Written journal entries
• • Voice recordings, including audio from Call Dayora. When a voice note is saved as a recording, or you talk on a call, we keep the audio itself, not only the transcript, so we can check the quality of what Dayora heard and said. When your speech is only turned into text for you to edit before saving, the recording is not kept. It is never sold. Where a voice note can be played back, it plays on the entry it came from; call audio has no playback screen in the app yet, so in practice only our own team can reach it. Deleting your account deletes it, and for a call you can also delete the recording yourself by choosing "let it go" when the call ends or by deleting the call's conversation.
• • Mood tags, and an energy level where you set one
• • Mood tracking data
• • AI-generated insights and summaries

Usage Data

We automatically collect certain information about how you use Dayora:

• • App usage patterns and feature interactions
• • Device information (browser type, operating system)
• • IP address and general location (for security and service optimization)
• • Error logs and performance data, including anonymous page-speed measurements (how long a page took to load and become usable), sent with no account or device identifier

2. How We Use Your Information

2.1. AI Training and Model Improvement

This is the section to read carefully, because it is the one people assume they can skip.

Your journal entries are used to train AI models. Not by us, but by OpenAI, and with our agreement. Here is exactly how that works.

• • What is sent, and where: when you save an entry, write in Reflect, record a voice note, or call Dayora, that content goes to OpenAI's API so your reflection, reply, or transcript can be generated. If you choose to upload a selfie, that photo goes to Google or OpenAI to draw your illustrated avatar, and to OpenAI to check that it is a real photo of a person and to write a short compliment about it. Google's Gemini receives only the selfie, and only as a backup when OpenAI cannot draw the avatar. Your season card portrait is painted by OpenAI from your selfie and a few words about the season drawn from your entries. The selfie is optional and you can skip it.
• • What OpenAI may do with it: we take part in OpenAI's data-sharing programme, which means OpenAI may use the content we send, your entries included, to train and improve its models.
• • What we get for it: a daily allowance of free usage from OpenAI. That allowance is part of how the free core stays free. We think you should know what the free version is paid for with.
• • Quality testing with a second company: to check how accurately Dayora sorts and tags what you write, we may also send the text of entries and Reflect messages, and Dayora's replies to them, to TypeSafe AI through Vercel's AI Gateway. TypeSafe AI's model does not write anything. It answers fixed questions about the text, for example whether an entry is about work or family, and we compare its answers with OpenAI's. Nothing it answers changes what you see. TypeSafe AI does not use this content to train models, though it may keep it for a period under its own terms. Voice recordings and photos are never sent to it.
• • What we do not do: we do not build or train a model of our own on your writing, we do not sell your entries to advertisers or data brokers, and we do not share them with anyone besides OpenAI and, for the quality testing above, TypeSafe AI, apart from the selfie exception above.
• • Memory is per account: the facts Dayora remembers about you are stored against your account and used only to answer you. They never cross between accounts, and you can view, edit, and delete them.

What this means in practice. Your journal is not a sealed room. It is read by a third party who may learn from it. That is a real trade and we would rather you make it with your eyes open than find out later: if it is not a trade you want, you can export everything in JSON, PDF, or Word and delete your account from Profile, then Account & data. We ask why you are leaving before the account goes, and the reasons you give are sent to our team. The plain-words version of this policy lists exactly what deleting removes.

Our own access. Separately from the above, our team can read entries, voice notes, and call recordings for support, safety, and quality checks: answering a question you email us, investigating a bug, and reviewing what Dayora heard and said on a call. Section 3 covers how that access is limited, and the security page describes the audio side in full, including how long it is kept.

3. Data Storage and Security

How we protect your data:

• • Connections to Dayora use HTTPS
• • Access to your data is restricted to authorized personnel for development, safety monitoring, and support
• • Admin access to a member's journal is recorded each time it is used

4. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information. We may share data only in these limited circumstances:

• • Service Providers: With trusted third-party services that help us operate Dayora, including hosting and file storage (Vercel), the database (Prisma), quality testing of how entries are sorted and tagged (TypeSafe AI, through Vercel's AI Gateway, as described in section 2.1), analytics (Google Analytics on our marketing pages, and OpenPanel for how the app itself is used, including a record that a subscription or top-up was purchased), advertising (Google Ads), payment processing (Stripe, or Apple for a subscription bought in the Dayora iPhone app, used only if you subscribe to Dayora Plus), email delivery (Resend), error tracking (Sentry, which may record a replay of part of a visit, with on-screen text hidden), sign-in with Google or Apple if you choose it, and the weather for your city (Open-Meteo)
• • Legal Requirements: When required by law or to protect our rights
• • Business Transfers: In the event of a merger or acquisition (with notice to users)
• • Consent: When you explicitly consent to sharing (e.g., accepting cookies for analytics and advertising)

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our marketing website (www.dayora.ai) to enhance your experience, analyze site usage, and for advertising purposes.

Essential Cookies

These cookies are necessary for the website to function and cannot be switched off:

• • Authentication cookies (keep you logged in)
• • Security cookies (prevent fraud and attacks)
• • Cookie consent preferences (remember your cookie choices)

Analytics Cookies

We use Google Analytics to understand how visitors use our website. These cookies help us:

• • Track page views and user interactions
• • Analyze traffic patterns and popular content
• • Improve website performance and user experience

Analytics cookies are only used on our marketing website, not in the journaling app itself. You can opt out of analytics cookies by clicking "Decline" in the cookie banner.

If you arrive from one of our ads, we record which ad and search term brought you, including the click identifier Google adds to the link. We do this unless you decline, and when you decline we delete it. Closing the notice without choosing is not a decline, so what was recorded stays. If you later create an account we report that a signup happened, and if you subscribe to Dayora Plus we report the purchase and its amount, so we can tell which ads are worth running. We never send your journal entries, your email address, or anything you write to Google.

Advertising Cookies

We use Google Ads to show you relevant advertisements. These cookies allow us to:

• • Measure the effectiveness of our advertising campaigns
• • Show you relevant ads based on your interests
• • Track conversions and ad performance

Advertising cookies are only used on our marketing website and require your consent. You can opt out at any time by clicking "Decline" in the cookie banner or adjusting your preferences.

6. Email from Dayora

An account comes with the emails that are part of how Dayora works, and occasionally news about the product itself:

• • Journaling emails: your daily reflection, weekly patterns, letters to your future self, and follow-up questions
• • Account emails: sign-in links, receipts, and changes to your plan
• • Occasional product news, such as a new feature announcement

Every non-essential email can be turned off individually in Settings, and every one carries an unsubscribe link. We do not send third-party offers, and we never share your address.

7. Your Rights and Choices

You also have the right to:

• • Access your personal data
• • Correct inaccurate information
• • Restrict processing of your data
• • Object to certain uses of your data
• • Turn off any email category in Settings, at any time

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• • Journal entries: Until you delete them or close your account
• • Account information: Until you delete your account
• • Usage data: kept for analytics; when you delete your account it is kept without your words
• • Marketing data: Until you unsubscribe or delete your account

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for any international transfers.

10. Children's Privacy

Dayora is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by email or through the app. Your continued use of Dayora after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us: