Privacy Policy

1. Who we are

Day Rhythms is operated by Andever Collective LLC, an Arizona limited liability company doing business as Day Rhythms ("Day Rhythms", "we", "us"), which provides a calendar and task planning application at dayrhythms.com. Andever Collective LLC (d/b/a Day Rhythms) is the data controller for the personal data described in this policy. You can reach us for any privacy matter at support@dayrhythms.com.

This policy explains what we collect, why we collect it, the legal bases we rely on, who else processes it, how long we keep it and the rights you have over it. It applies to the Day Rhythms web and installable (PWA) app and to our marketing site.

2. What we collect

• Account data: your email address, display name and, if you sign in with Google, the basic profile that provider returns.
• Planner data: your lists, tasks, subtasks, deadlines, estimates, time blocks, work sessions and preferences.
• Calendar data: events read from calendars you connect, and blocks we write back when you turn on push sync.
• OAuth tokens: access and refresh tokens for Google, Notion, Todoist and Asana (and Microsoft when available), plus CalDAV usernames and app-specific passwords for Apple/iCloud.
• Attachments: files and images you upload to a task, held in private per-user storage.
• Billing data: your plan, subscription status and document-reading count. Card details go to our payment provider, never to us.
• Marketing attribution: if you arrived from a link carrying campaign tags (utm_source, utm_medium, utm_campaign), we save those tags on your account when you sign up so we know which campaigns bring people in.
• Diagnostics: error reports (including your user id) used to fix crashes.

3. How we use it

To run the planner: store and display your schedule, sync with the services you connect, auto-schedule work against your deadlines, deliver end-of-block alerts, run "Plan my day" when you ask for it, meter plan usage, take payment, keep the service secure, and fix bugs. We also use your email address to send service messages such as billing receipts, security notices and material changes to this policy.

On our public website and the sign-up and checkout steps (never inside the planner), and only if you accept cookies, we use Google Analytics 4 and the Meta Pixel to measure visits and the results of our own ads, for example whether someone who clicked an ad went on to create an account or buy a plan. We do not serve third-party advertising, we never send your planner, calendar or attachment content to advertising partners, and we do not use that content to train AI models.

Inside the app we keep simple first-party usage records in our own database, such as which view you opened, that a task was added or that Plan my day ran, with your device type. They never include the content of your tasks, lists, notes or calendar events, are not shared with anyone, do not use cookies, and are deleted after 180 days.

If you forward an email to your personal Day Rhythms address, we receive it through our email provider, Postmark, and keep only the sender, subject and plain text so you can turn it into a task. Attachments are not kept. The email is deleted when you add or discard it, or after 14 days if you do neither.

If you turn on the optional morning plan, Postmark sends one email at your chosen local time with your planned blocks and unfinished work. Every message has a one-click unsubscribe. Hard bounces and spam complaints turn this email off automatically.

4. Legal bases for processing (EEA/UK)

• Contract: creating your account, storing and displaying your planner data, running integrations you connect, and billing.
• Legitimate interests: keeping the service secure and available, preventing abuse, diagnosing errors, and understanding aggregate product usage.
• Consent: connecting a third-party calendar or task account, and any optional communications. You can withdraw consent at any time by disconnecting the integration or unsubscribing.
• Legal obligation: retaining invoices and tax records.

5. How it is protected

Data is stored in our managed Postgres database with row-level security, so rows are readable only by the account that owns them. OAuth tokens, CalDAV passwords and your AI API keys are additionally encrypted at rest with AES-256-GCM before being written, and are decrypted only inside server-side code that acts on your behalf. Attachments live in a private bucket reachable only through short-lived signed URLs.

6. Third parties who process your data

We use these subprocessors to run Day Rhythms. Each receives only what it needs for the purpose listed.

• Supabase (United States), database, sign-in and private file storage for your account, tasks, lists, settings and attachments.
• Lovable and Cloudflare (United States, global edge network), hosting and serving the website and app.
• Lovable (United States): sending transactional email such as sign-up confirmations, password resets and student codes.
• Paddle (United Kingdom), our reseller and Merchant of Record: checkout, payments, subscriptions, invoices, tax and refunds.
• OpenAI, via the Lovable AI Gateway (United States), reads only the files or text you choose to upload in schedule import, to pull out tasks and dates. Plan my day and automatic scheduling run inside Day Rhythms and do not send your data to an AI provider.
• Sentry (United States), error monitoring, only when enabled. Receives technical error details, not your task content.
• Google, Apple/iCloud, Notion, Todoist, Asana, and Microsoft Outlook when available: only the accounts you explicitly connect, for reading events and tasks and optionally writing blocks back.
• Google (Google Analytics 4) and Meta (Meta Pixel) (United States): website analytics and ad measurement, only for visitors who accept cookies. They receive page visits on our public pages, device and browser information, campaign tags from the link you arrived by, and these events: account created (and whether by email or Google), checkout opened (plan chosen), and purchase completed (plan, amount, currency and payment reference). We never send your name, email address, or any planner, task, calendar or attachment content. They may combine this with what they already know about you under their own privacy policies.

7. Google user data (Limited Use)

When you connect a Google account, Day Rhythms requests only the calendar scopes needed to read the events on the calendars you select and, if you enable push sync, to write back the blocks you schedule here. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to others except as needed to provide or improve the features you use, for security, or to comply with law, and we never use it for advertising or to train generalised AI models. You can revoke access at any time in Settings → Calendars & sync or from your Google account permissions page.

8. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in, remember your view and planner preferences, remember your cookie choice, and keep a copy of your planner on your device so changes made during a brief connection drop can save once you're back online. Day Rhythms needs a connection to load your planner and save changes. These are always on; blocking them will prevent sign-in from working.

With your permission we also use two optional tools: Google Analytics 4 (measurement ID G-0WTGH21QQW) and the Meta Pixel. They are active only after you choose "Accept" on our cookie banner. If you choose "Reject", make no choice, or your browser sends a Global Privacy Control signal, neither loads. They run only on our public website (home page, pricing, sign-in and sign-up, password reset, and our legal pages) and when you open checkout. They never run on your planner and never receive planner, task, calendar or attachment content, your name or your email address.

You can change your mind at any time with the "Cookie settings" link in the website footer; choosing "Reject" there stops both tools straight away and they will not load again. You can also opt out through Google's ad settings, the Google Analytics opt-out add-on and Meta's ad preferences, and by blocking cookies in your browser.

9. International transfers

We and our processors operate in the United States and the European Union. Where personal data is transferred out of the EEA or UK, that transfer is covered by the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or another lawful transfer mechanism, together with appropriate technical safeguards such as encryption in transit and at rest.

10. Retention

Planner data is kept for as long as your account exists. Disconnecting an integration deletes its stored tokens immediately. Deleting your account removes your tasks, lists, sessions, settings, attachments and integration credentials right away; backups containing deleted data roll off within 30 days. Error diagnostics are kept for up to 90 days, and invoices and tax records for as long as the law requires (typically 7 years).

11. Your rights

You can access and correct your data directly in the app, export tasks and lists as CSV and your calendar as ICS, and delete your account and its contents, from Settings → Data & account.

Depending on where you live you may also have the right to request a copy of your data in a portable format, to have it corrected or erased, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with your local data protection authority (in the EEA) or the Information Commissioner's Office (in the UK). California residents have the rights to know, delete, correct and limit use of sensitive personal information, and the right not to be discriminated against for exercising them, note that we do not sell personal information. If you accept advertising cookies, the resulting sharing with Google and Meta for ad measurement may count as "sharing" under the CCPA/CPRA; you can opt out at any time with "Cookie settings" (Reject), and we honour Global Privacy Control signals as a refusal.

To exercise a right, contact us at support@dayrhythms.com. We verify requests against the email on your account and respond within 30 days (or 45 days for CCPA requests, where an extension may apply).

12. Children

Day Rhythms is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16; if you believe a child has given us data, contact us and we will delete it.

13. Security incidents

No service can guarantee absolute security. If a breach affecting your personal data occurs, we will notify the relevant supervisory authority and, where the law requires it, affected users without undue delay.

14. Changes to this policy

We may update this policy as the product changes. The "last updated" date above always reflects the current version, and we will notify you by email or in-app before any change that materially reduces your rights takes effect. Continued use after that date means you accept the updated policy.

15. Contact

For privacy questions, requests or complaints, email support@dayrhythms.com. We respond to verified requests within 30 days.