Privacy Policy

1. Introduction

DayByDay ("we", "our", "us") is a personal health tracking application. We are committed to protecting your privacy and handling your data responsibly. This policy explains what information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

Account information

When you create an account, we collect your email address and a password (stored securely hashed). During onboarding, you may optionally provide:

• Display name
• Gender, height, birth year/month
• Starting weight and goal weight
• GLP‑1 medication information (medication name, start date, dosage cadence)

Health & tracking data

Data you voluntarily enter into the app, including:

• Daily weight and body fat percentage
• GLP‑1 medication doses, injection sites, side effects
• Sleep data (SpO2, sleep stages, heart rate, HRV, respiratory rate)
• Body measurements (waist, chest, neck, hip)
• Lab results (A1c, glucose, cholesterol panels)
• Exercise logs (minutes, steps, type)
• Blood glucose, mood, hunger, energy, GI, water, protein
• Progress photos (encrypted, optional cloud sync)

Device settings

Your device's time zone (for example, America/Los_Angeles). We use this only to record your entries against the correct calendar day — so a late-night meal counts toward the right day, and your daily and weekly figures stay accurate when you travel. This is not GPS: we do not collect your coordinates, track your movements, or keep any location history. Like the rest of your profile, only you can read it, and it is deleted when you delete your account.

Information we do NOT collect

• The DayByDay app does not collect device identifiers or advertising IDs
• We do not collect GPS or precise location data
• We do not collect financial or payment information

Our website

The DayByDay app has no third-party analytics or ad tracking. Our website uses Meta's advertising pixel to measure how our ads perform; it never receives anything you log or enter in the app. Meta may use that visit data under its own privacy policy. The pixel runs only on our public marketing and sign-up pages, never inside the signed-in app or the Help Center. If your browser sends a Global Privacy Control signal, the pixel does not load.

3. How We Use Your Data

Your data is used solely to:

• Display your tracking information back to you within the app
• Calculate trends, predictions, and insights based on your entries
• Authenticate you and maintain your session
• Power the optional Dayo AI Coach insights (per-source opt-out available)

We do not use your account and health data for advertising, marketing to third parties, or any purpose other than providing the app's functionality to you.

4. Data Storage & Security

Your data is stored on Supabase Cloud (hosted on AWS in the US West region). All data is:

• Encrypted in transit (TLS/HTTPS)
• Encrypted at rest (AES-256)
• Protected by Row Level Security (RLS) policies ensuring you can only access your own data

5. Data Sharing

Your account and health data are never sold, rented, or shared with advertisers, data brokers or other companies for their own use. Our service providers (section 9) process it only on our behalf.

The only exception would be if required by law (e.g., a valid legal subpoena).

6. Data Retention & Deletion

Your data is retained for as long as you maintain an active account or subscription. You may:

• Export your data at any time using the CSV export feature in the app
• Delete your account from the Settings page or the paywall screen

Deleting your account removes your profile and everything you logged (weight, medication, sleep, food and water, measurements, labs, mood, symptoms and more), your photos, and your sign-in account. It starts the moment you confirm and finishes within minutes. It can't be undone. Your App Store subscription is separate: cancel it in iPhone Settings, under your name, then Subscriptions. Anything DayByDay saved into Apple Health stays in Apple Health. Copies in automatic backups are replaced as they expire (about 7 days). We keep three things after deletion: a short record that the account was deleted (its random id and dates, no name or email) for two years; our payment service's purchase record (billing history, no health information); and the staff action log, which is a security record. Emails you sent to support, and files you exported yourself, are not covered by the button.

Free plan & your data

DayByDay includes a free plan with no time limit. Optional Core and Plus subscriptions add further features. You can export your data at any time, and you can delete your account whenever you choose from the Settings page in the App (see section 6 for what is removed).

7. Cookies & Local Storage

The app uses local storage on your device solely for:

• Authentication session tokens
• Theme preference (light / dark / system)
• Milestone configuration and UI preferences

The DayByDay app does not use tracking or third-party cookies. Our website's advertising pixel (see 'Our website' above) may set its own cookies in your browser; you can block them in your browser settings or in Meta's ad settings.

8. Children's Privacy & Age Requirements

DayByDay is not intended for children. In the United States, you must be at least 13 years old to use the app. In the European Economic Area, you must be at least 16 years old (or the minimum age of digital consent in your country, if lower). We do not knowingly collect personal information from anyone below these age thresholds. If you believe someone below the applicable minimum age has provided us with personal data, please contact us so we can delete it.

9. Third-Party Service Providers

We use a limited number of third-party service providers to operate DayByDay. These providers process data solely on our behalf and under our instructions:

Supabase (database & authentication)

• Stores your account information and all health tracking data
• Hosted on Amazon Web Services (AWS) in the US West (Oregon) region
• Provides authentication services (email login, Google Sign-In, Apple Sign-In)
• Subject to Supabase's privacy policy and AWS's data processing terms

Anthropic (AI Coach)

• Powers the optional Dayo AI Coach insights via the Claude API
• Receives anonymized fact summaries derived from your data — no personal identifiers, no raw account email
• Per-source opt-out available in Settings to exclude any data category from being sent to the model
• Subject to Anthropic's commercial terms and data usage policies; data is not used to train models

RevenueCat (subscription management)

• Manages subscription status verification between app stores and our servers
• Receives your anonymous user ID and subscription status from Apple/Google
• Does NOT receive any of your health data, personal information, or tracking data

Apple App Store / Google Play Store (payments)

• Process all subscription payments directly
• We never receive or store your payment card details
• Subject to Apple's and Google's respective privacy policies

Apple HealthKit / Google Health Connect (optional)

• Health data synced from these platforms is stored only in your DayByDay account on Supabase
• This data is never shared with third parties, used for advertising, or transferred to any service other than Supabase
• You control exactly which data types are synced via your device's health permissions settings

Our website

Our website also uses Meta's advertising pixel on its public marketing and sign-up pages; see 'Our website' above.

10. Health Data Handling

DayByDay processes sensitive health-related information. We apply special care to this data:

• Collection: All health data is provided voluntarily by you or synced from Apple HealthKit / Google Health Connect with your explicit permission
• Storage: Health data is stored on Supabase Cloud (AWS US-West), encrypted at rest and in transit, and isolated by Row Level Security so that only your authenticated account can access your data
• Use: Health data is used solely to display your tracking information, calculate trends, and generate insights within the app for your personal use
• Sharing: Health data is never sold, rented, shared with third parties, used for advertising, or used for any purpose other than providing app functionality to you
• Export: You may export all your health data at any time via CSV export or PDF health report from Settings in the app
• Deletion: You may delete your account from Settings in the app at any time (see section 6 for what is removed)

11. Your Rights Under GDPR (EU/EEA/UK Users)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent UK legislation.

Legal basis for processing

We process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)): Processing your account information and health tracking data is necessary to provide the DayByDay service that you have signed up for
• Consent (Article 6(1)(a) and Article 9(2)(a)): For optional health data syncing from Apple HealthKit or Google Health Connect, we rely on your explicit consent, which you grant through your device's health permissions settings and which you may withdraw at any time
• Legitimate interest (Article 6(1)(f)): For maintaining security of the service and preventing fraud

Your data subject rights

You have the following rights, most of which you can exercise directly through the app:

• Right of Access (Article 15): You can view all your data within the app at any time. You can also export a complete copy of all your data using the CSV export feature in You > Reports & Export
• Right to Rectification (Article 16): You can correct your personal information at any time via Settings > Edit Profile, and you can edit or delete individual data entries directly within each tracking tab
• Right to Erasure (Article 17): You can delete your account via Settings > Account > Delete Account & All Data (see section 6 for what is removed). It starts immediately, finishes within minutes, and is irreversible
• Right to Data Portability (Article 20): You can export all your data in CSV format (a standard, machine-readable format) via You > Reports & Export. You can also generate a comprehensive PDF health report
• Right to Restriction of Processing (Article 18): Contact us at the email below if you wish to restrict processing of your data while a dispute is resolved
• Right to Object (Article 21): Since we process your data solely to provide the service you requested and do not engage in direct marketing or profiling, there is no separate processing to object to. If you no longer wish for your data to be processed, you may delete your account
• Right to Withdraw Consent (Article 7(3)): You may withdraw consent for optional health data syncing at any time by disabling health permissions in your device settings. You may withdraw consent for the service entirely by deleting your account

Exercising your rights

Most rights can be exercised directly through the app's self-service features:

• Access & portability: You > Reports & Export (CSV or PDF)
• Rectification: Settings > Edit Profile, or edit entries in each tracking tab
• Erasure: Settings > Account > Delete Account & All Data
• Withdraw consent for health sync: Device Settings > Health permissions

For rights that cannot be exercised through self-service (restriction, objection, or any questions), contact us at support@mydaybyday.app. We will respond within 30 days.

International data transfers

Your data is stored on servers in the United States (AWS US-West region via Supabase Cloud). If you are located in the EU/EEA/UK, this constitutes an international transfer of your personal data. These transfers are protected by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) as adopted by the European Commission, incorporated into our agreements with service providers.

Automated decision-making

DayByDay does not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you. The app calculates trends, predictions, and health insights based on the data you enter, but these are informational tools for your personal use only and do not result in any automated decisions about you.

Right to lodge a complaint

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU data protection authorities can be found at edpb.europa.eu.

12. Your Rights Under US State Privacy Laws

Several US states have enacted privacy laws that grant residents specific rights regarding their personal information.

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: You have the right to know what personal information we collect, use, and disclose. This privacy policy provides that information. You can also export a complete copy of your data at any time via You > Reports & Export
• Right to Delete: You can delete your account via Settings > Account > Delete Account & All Data (see section 6 for what is removed)
• Right to Correct: You can correct inaccurate personal information via Settings > Edit Profile
• Right to Opt-Out of Sale or Sharing: In the DayByDay app and your account, we do NOT sell your personal information and we do NOT share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of. Website visitors can limit the advertising pixel in their browser's privacy settings or in Meta's ad settings, and the pixel does not load when their browser sends a Global Privacy Control signal
• Right to Limit Use of Sensitive Personal Information: We use your sensitive personal information (health data) solely to provide the DayByDay service. We do not use it for any other purpose
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights

Washington My Health My Data Act

If you are a Washington state resident, the My Health My Data Act provides specific protections for consumer health data:

• Consent: We collect health data only after you have accepted our Terms of Use and Privacy Policy. Additional health data syncing from Apple HealthKit or Google Health Connect requires separate device-level permission
• Right to Know: This privacy policy describes all health data we collect, how it is used, and who it is shared with (no one)
• Right to Delete: You may delete your account via Settings > Account > Delete Account & All Data (see section 6 for what is removed)
• Right to Withdraw Consent: You may withdraw consent at any time by deleting your account
• No Sale of Health Data: We do not sell, rent, or trade consumer health data

Other state privacy laws

If you reside in a state with a consumer privacy law (including but not limited to Connecticut, Colorado, Virginia, Oregon, Texas, Montana, Indiana, Iowa, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, and Maryland), you generally have rights of Access, Deletion, Correction, Data Portability, Opt-Out of Sale, Opt-Out of Targeted Advertising, and Opt-Out of Profiling. In the DayByDay app and your account, we do not sell personal data, share data for cross-context behavioral advertising, or engage in targeted advertising. Website visitors can limit the advertising pixel in their browser's privacy settings or in Meta's ad settings, and the pixel does not load when their browser sends a Global Privacy Control signal.

13. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by requiring re-acceptance of the updated policy within the app before you can continue using it. The "Last updated" date at the top of this page will be updated accordingly. We recommend reviewing this policy periodically.

14. Contact

If you have questions about this privacy policy, your data, or wish to exercise any of your privacy rights, please contact us at:

support@mydaybyday.app

We will respond to all privacy-related inquiries within 30 days.