Privacy Policy

Notes on your computer

Unless you turn on cloud sync, your notes, meetings, tasks, projects, images and your Google Calendar connection are saved in a folder on your computer (~/Day & Note, or one you pick) and never sent to us. You don’t need an account or an email. The app doesn’t encrypt this folder itself; your computer’s disk encryption (FileVault on a Mac, BitLocker on Windows) and your login protect it.

So we can count how many people use the app and which versions are in use, it checks in with our server once a day with a random ID (or your email, if you added one), the app version and operating system, that your notes are on your computer, and the day it was last opened. Nothing you write is part of it. Random IDs unused for 180 days are deleted.

We don’t have a copy of these notes, so we can’t restore them. The app keeps a backup from each of the last 7 days in the folder; copy the folder somewhere else to be safe.

Cloud sync is end-to-end encrypted

When you turn on cloud sync, notes, meetings, tasks, projects, links, the project Kit, images and everything imported from Google Calendar are encrypted on your device with XChaCha20-Poly1305 before they’re saved. Your key is protected by your passphrase and a recovery code shown to you once. The unlocked key stays in the app’s storage on your device, so you don’t type your passphrase on every launch.

We can’t read your content. If you lose both your passphrase and your recovery code, nobody can recover it, including us.

What we can see, and why

With cloud sync on, our server stores some things unencrypted to make the app work:

• your email address and display name (your password is stored only as a secure hash);
• dates, times and durations, so days and the timeline work;
• which project something belongs to, project colours, and whether a task is done;
• how many items and images you have, and roughly how large each one is;
• whether Google Calendar is connected, and which meetings came from it (as a one-way hash);
• the app version and operating system you last used.

Images, links and emails

• Images are resized and stripped of metadata (like location) on your device, then encrypted. Images nothing uses any more are deleted after 30 days.
• Links: with cloud sync, when you add one to a project page, its address is sent once to our server to fetch the page title. It isn’t stored in readable form. With your notes on your computer, links are never sent.
• Emails: we only send verification and password-reset codes.
• Sign-up is protected by ALTCHA, a proof-of-work check on our own server. No third-party captcha.

This website

dayandnote.com (not the app) uses PostHog analytics to see which pages are visited and what’s clicked. PostHog receives your IP address (for an approximate location), browser and device type, and sets a cookie to recognise repeat visits. It also keeps a short note of each visit: your device type, the site you came from, how many times you’ve visited and whether you downloaded the app. The download buttons ask GitHub for the latest version, so GitHub sees your IP address too.

The feature requests board needs no account. To stop duplicate votes it keeps a random device ID in your browser and stores a salted hash of your IP address, never the address itself. Ideas you submit become public once we’ve approved them, so leave personal details out.

Who processes data

We use a few service providers, only to run Day & Note: a database host in the United States (which stores your encrypted content and the details above), an image storage provider (encrypted images only), an email provider (your email address), GitHub (app updates), and PostHog (website analytics). Google is involved only if you connect Google Calendar.

Google Calendar

Connecting Google Calendar is optional. You do it in Settings → Calendar.

What we access

Read-only access to the list of your calendars (calendar.calendarlist.readonly) and the events on them (calendar.events.readonly). We never create, change or delete anything in your Google account.

How we use it

Only to show your meetings (title, day, time and duration) on your Day & Note day pages, from the calendars you choose. Nothing else.

Where it goes

Your device talks to Google directly. With your notes on your computer, everything from Google stays in your folder. With cloud sync, these are encrypted on your device before anything is saved: event titles, calendar and event identifiers, your Google account address, the list of your calendars, and the access token. Our servers can’t read them or use the token. Meeting dates, times and durations are stored like the rest of your meetings (see What we can see).

Sharing

We don’t share, sell or transfer Google user data to anyone. We don’t use it for advertising, and we don’t use it to train AI or machine-learning models. No person at Day & Note can read it.

Limited Use

Day & Note’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stopping it

Settings → Calendar → Disconnect revokes our access at Google and deletes the stored connection. You can also remove access at myaccount.google.com/permissions. Meetings you already imported stay on your days (encrypted) until you delete them.

Your rights

You can edit or delete any of your content in the app at any time. To delete your account and all its data, email privacy@dayandnote.com from your account’s address and we’ll do it within 30 days.

Depending on where you live (for example the EU or UK, or California), you can also ask to access, correct or export your data, and complain to your data protection authority. An export from us contains your content in encrypted form. We process your data to provide the service you asked for and to keep it secure, and run website analytics to understand how the site is used.

Retention and security

We keep your data while your account exists. Deleted content is removed from the database right away, unused images after 30 days, and backups expire on a rolling schedule. Connections use HTTPS and passwords are stored only as secure hashes.

Children

Day & Note isn’t meant for children under 13 (or under 16 in the EU), and we don’t knowingly collect their data.

Changes and contact

If this policy changes, we’ll update the date at the top, and tell you in the app for significant changes. Questions: privacy@dayandnote.com.