Privacy Policy

Last updated: 5 July 2026 · Effective on install.

This Privacy Policy explains what information the Days app (“the app”, “we”, “us”) collects, why we collect it, how we handle it, and the choices you have. We designed Days to work offline by default and to keep as little of your data off your phone as possible — this document explains the details in plain language.

1. Who we are (data controller)

Days is built by an independent developer publishing under the name Stewpeed Dev, based in Bangladesh. For any question about this policy, your data, or a specific request, email stewpeed.dev@gmail.com. We aim to respond within 7 business days.

2. Guest mode vs. signed-in mode

Days can be used entirely as a guest — you never have to create an account. In guest mode, everything you make lives on your phone, and nothing is sent to any server we control. Signing in with Google (via the Sign in with Google button) is optional and only unlocks Cloud Sync + day sharing. This policy calls that out per section — “guest-only”, “signed-in only”, or “both”.

3. What we collect and why

3.1 Content you create — stored on your device (both)

Each day you add — its title, date, count direction (since / until), colour, gradient, icon or emoji, optional photo, optional location, notes, and per-day reminder settings — is stored locally on your device using an on-device database (Isar). Guest days never leave your device. Signed-in users’ days only leave the device if Cloud Sync is on (see §4).

3.2 Profile settings — stored on your device (both)

Your display name, date of birth (if you set one for the Home countdown), and app preferences (counter style, grid layout, first day of week, notification toggles, vibe/medium picks, unlocked backgrounds) live on your device. For signed-in users, a copy is UPSERTed to your cloud profile row (§4).

3.3 Account identifiers — signed-in only

When you sign in with Google we receive your Google email address, display name, profile picture URL, and a stable Google account id, via the standard Sign in with Google ID-token flow. These are stored in your Supabase profiles row (§4). We do not receive your Google password.

3.4 Location — guest and signed-in, only when you ask

Location is only read when you tap Use current location or a related action in the location picker. We use the device’s location service (GPS or network) to get a coordinate, then run one reverse-geocoding lookup against the OpenStreetMap Nominatim API (see §5) to turn the coordinate into a readable address. The coordinate + address are attached to the day you were editing and stored on your device. They only leave your device if Cloud Sync is on or you share that specific day. We never track your location in the background; the app does not run background location.

3.5 Photos — guest and signed-in, only ones you pick

When you attach a photo to a day, the OS-provided photo picker returns a single image; we do not scan your gallery. The image is re-encoded (WebP q65 on Android, HEIC q65 on iOS, capped at 720 px on the long edge) before we save it, so what we store is a small preview, not the original. Photos stay on your device unless Cloud Sync is on, in which case a copy is uploaded to Supabase Storage under your user id and referenced by the day’s cloud row.

3.6 Purchase entitlements — signed-in only

If you buy a Pro subscription or the Lifetime Pass, your purchase is processed by Google Play (not by us). RevenueCat, our subscription management provider, receives the purchase event via Google Play’s server-to-server notification and flags your profiles row as premium via a webhook to Supabase. We store a boolean flag (is_premium), the effective tier, and a renewal or expiry date — never your payment card, billing address, or other financial identifiers.

3.7 Diagnostic and usage data

Days does not include any third-party analytics SDK, advertising SDK, or crash-reporting SDK. We do not measure retention, session length, feature usage, or user behaviour. The only server-side signal we ever see is whether a signed-in user’s app has successfully hit Supabase in the last day (from Supabase’s standard access logs, retained by Supabase — see §5).

3.8 Reminders and notifications

All reminders are scheduled locally on your device by Android’s notification system. Nothing runs on a push server. Turning a reminder on stores a local record; turning it off removes it. Your reminder times never leave the device (until Cloud Sync backs them up as part of the day, §4).

4. Cloud Sync and day sharing — the parts that leave your device

These features are opt-in and only apply to signed-in users. If you never turn them on, nothing in this section applies to you.

4.1 Cloud Sync (Pro)

With Cloud Sync on, your days + your profile row are pushed to a Supabase project we operate. The push is batched (typically once when you leave the settings or day screen, and on app pause) and change-gated (unchanged data is not re-uploaded). Row-Level Security (RLS) restricts every row so only your signed-in user id can read or write it. You can sign out or delete the account at any time (§8).

4.2 Day sharing

When you tap Share on a day, its payload (title, date, count direction, colour, icon, image if any, and any location you attached) is UPSERTed to a Supabase table indexed by a random 7-character code. Anyone with the code (or the deep link that carries it) can render that day in the read-only web viewer at basically-days.pages.dev/s/<code>. Sharing is stopped by tapping Stop sharing in the day’s edit screen — the row is deleted and the code becomes invalid. Codes are not guessable and are single-use per day.

4.3 Data location and processors

Supabase currently hosts our project in a specific AWS region; the exact region can be checked at supabase.com. This is our sole primary data processor for user content. Standard Contractual Clauses cover any cross-border transfer of your data under GDPR.

5. Third parties we rely on

Days uses the following third-party services to work. We only send the information listed; we never share user identifiers with advertisers or data brokers.

Google (Sign in with Google) — you authenticate directly with Google; we receive only the fields listed in §3.3. Governed by Google’s Privacy Policy.
Supabase, Inc. — cloud database, authentication proxy, storage, and Edge Functions. Only used when you are signed in and Cloud Sync or sharing is on. Governed by Supabase’s Privacy Policy.
Google Play Billing — processes all purchases. We never see your payment method. Governed by Google Play’s policies.
RevenueCat, Inc. — receives purchase events from Google Play and issues a webhook to Supabase so we can flip your premium flag. Sees a hashed user id and product id. Governed by RevenueCat’s Privacy Policy.
OpenStreetMap Foundation (Nominatim) — reverse-geocoding lookups when you tap Use current location or search a place. Nominatim receives the coordinate or query, nothing else. Governed by the OSMF Privacy Policy.
CARTO — serves the raster map tiles you see on maps. Your browser/device fetches tiles directly from CARTO’s CDN. Governed by CARTO’s Privacy Policy.
Cloudflare, Inc. — hosts the basically-days.pages.dev site (this page + the shared-day web viewer). Cloudflare sees IP addresses of visitors as standard CDN log data. Governed by Cloudflare’s Privacy Policy.

6. Legal basis for processing (GDPR)

If GDPR applies to you, our legal bases are:

Contract — providing the app and (if you are signed in) the account, sync, and sharing features you requested.
Consent — using your location, attaching a photo, turning on Cloud Sync, creating a share link. Withdrawn by turning the setting off or deleting the data.
Legitimate interest — keeping the app secure, preventing abuse of the share feature, and processing purchase entitlements. You can object; write to us.

7. How long we keep things

Guest data lives on your device until you delete it or uninstall the app.
Signed-in cloud data (profile + days) lives until you delete your account, or until you stop syncing that day.
Shared-day payloads live until you tap Stop sharing on that day, or until you delete your account.
Basic access logs at Supabase and Cloudflare follow those providers’ standard retention periods (typically 30 days).
Support emails you send us are kept for the time needed to resolve your request and up to 12 months after, then deleted.

8. Your choices and rights

Access + export — export every day as an .ics calendar file (Settings → Export events) or ask us for a JSON copy of your cloud profile.
Rectification — edit anything in the app; changes push on next flush.
Erasure — Settings → Danger zone → Erase days wipes every day locally and, for signed-in users, in the cloud. Settings → Danger zone → Delete account wipes your days AND your profile row AND signs you out. If you no longer have the app installed, use the Delete your account page.
Withdraw consent — turn off Cloud Sync, stop sharing a day, revoke location, or sign out at any time.
Portability — the exported .ics is the standard portable format for date data.
Complaint — if you are in the EU/EEA/UK you can lodge a complaint with your national Data Protection Authority. Users elsewhere can contact us or their local regulator.

9. Children

Days is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.

10. Security

Cloud data is transmitted over TLS. Supabase authentication is enforced by Row-Level Security. On device, the premium entitlement flag is stored inside Android’s Keystore-backed encrypted preferences. No system is unbreakable — please do not upload anything to a shared day that you would not want to be publicly readable while the share code is live.

11. Changes to this policy

We will update the “Last updated” line at the top of this page whenever this policy changes. Substantial changes (new categories of data, new third parties) will be announced in-app on the next update after the change ships. Continued use of the app after a change means you accept the new version.

12. Contact

Questions, requests, or data-protection concerns: stewpeed.dev@gmail.com. Please include the phrase Privacy in your subject so we route it correctly.

← Back to Days