Privacy policy

TODO (owner): Review with a lawyer; fill in the legal entity, address, contact and (if serving EU/UK users) the EU/UK representative. Bump the policy version in the API (app/core/policies.py) whenever this text changes — users are asked to agree again.

Who we are

DayWise is operated by Strixoralabs (legal entity and address — TODO). Contact: daywise@strixoralabs.com.

What we collect

• Account: your email address and a password hash (or your Google account id).
• Health and wellbeing data you log: food, water, weight, body measurements, sleep, activity, mood and energy, notes, and the goals and profile (sex for energy calculations, birth date, height, activity level) used to compute your targets.
• Settings such as units, timezone and reminders.
• Security records (sign-in sessions with a keyed hash of your IP address).

Why, and on what basis

We use your account data to provide the service (contract). We store health data only with your explicit consent, which you give during sign-up and can withdraw at any time (GDPR Art. 9(2)(a)). AI features, research use and marketing email each need their own optional consent.

AI logging (optional)

If you turn on AI features, what you type, say or photograph to log a meal is sent to third-party AI providers — Groq, Google (Gemini) and Cloudflare (Workers AI) — so they can suggest the foods. We never send your name, email or account details. On their free tiers these providers may keep what they receive or use it to improve their models. Speech may first be turned into text by your device's or browser's own speech service. Photos are resized and stripped of location and device details, and we never store them. The text is kept for 90 days to fix mistakes, then deleted unless you allow research use. You can turn AI off at any time in Settings; it stops at once.

Reminders (optional)

On the phone app, reminders are scheduled on your phone and nothing is sent anywhere. On the web, reminders reach an installed app through your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser). The message is encrypted so only your browser can read it, and it contains no health information — just which reminder it is. Turning reminders off or signing out stops them on that device.

How it is protected

• Encryption in transit everywhere, and at rest; notes and other free text are additionally encrypted by the app with keys kept separate from the database.
• No advertising, analytics or tracking tools — none, on the web or in the apps.
• We never sell or share your health data. Processors we rely on: Supabase (database), Amazon Web Services (servers), Cloudflare (network), Resend (email), Google (sign-in, if you choose it), Open Food Facts (barcodes only, no personal data), and — only if you turn on AI features — Groq, Google Gemini and Cloudflare Workers AI; and, only for web reminders, your browser's push service.

Your rights

• Download all your data at any time (Settings → Download your data).
• Delete your account at any time (Settings → Delete account). It is closed immediately and erased completely within 30 days.
• Correct anything you logged, withdraw a consent, or contact us with any request.

Retention

Your data is kept until you delete it or your account. Raw inputs to AI features are deleted after 90 days unless you allow their use for research. Data exports are deleted after 7 days.

On this device

The web app keeps a copy of recent days and changes waiting to sync in your browser so it works offline. Signing out removes them.

TODO (owner): Add the complaint route (supervisory authority) and international transfer details for the chosen Supabase region.