Privacy policy

1. What we collect

We collect what you give us, what your use of the product creates, and a small amount of technical information needed to run it.

Account details

Your name, email address and password. Passwords are stored only as a salted hash by our authentication provider; we cannot read them. A phone number if you choose to add one. If you sign in with Google, we receive your name, email address and profile picture from Google.

Profile

What you choose to put on your profile: a handle, photo, cover image, headline, bio, location, job title and links.

Your work log

The tasks, routines and deadlines on your day, the time you record against them, notes you write when finishing work, work assigned to you or by you, requests and the decisions on them, and the scores and figures calculated from all of this.

What you publish and write

Posts, published records, comments, endorsements, who you follow, what you save or mute, and reports you file about content.

Messages

Direct messages and messages in rooms, including any pictures or attachments you send. Messages are stored so they can be delivered and shown to the people in the conversation. They are not end-to-end encrypted.

Workspace information

The workspaces you belong to, your role in each, and invitations. If you invite somebody, we receive the email address you enter for them.

Pictures and video you upload

Images and video you attach to a profile, post or message. The mobile app opens your photo library only when you choose to attach something, and receives only the items you pick.

Device and notification details (mobile app)

If you allow notifications, a push token that identifies the app on your device, the platform (Android or iOS) and the device model name, so that notifications can be delivered to it.

Preferences

Your theme, time zone, and which notifications and emails you have switched on or off.

Technical information

IP address, the date and time of requests, and basic information about the browser or app making them. This is used to keep the service secure, to limit abuse and to diagnose faults.

Cookies and local storage

The website uses cookies that keep you signed in and remember your settings, and Google Analytics cookies to count visits to pages (see below). The mobile app stores your sign-in session and a few preferences on the device.

The mobile app does not collect your location, your contacts, your microphone, or advertising identifiers, and it contains no advertising or third-party analytics software.

2. How we use it

To run the product

Showing your day, calculating your figures, delivering messages, publishing what you choose to publish, and keeping your workspaces working.

To tell you things

Notifications in the app, push notifications if you allow them, and emails about your account and activity - verifying your address, resetting a password, an invitation, and the activity emails you have left switched on.

To keep it safe

Detecting and preventing abuse, spam and unauthorised access, reviewing content that has been reported, and enforcing our rules.

To improve it

Understanding in aggregate which parts of the website are used, and finding and fixing faults.

To meet legal obligations

Where the law requires us to keep or disclose information.

We do not sell your personal information. We do not use it for advertising, and we do not share it with advertisers or data brokers.

Where the law asks for a legal basis, ours are: performing our agreement with you (running the product you signed up for), your consent (push notifications, optional profile details, analytics cookies where consent is required), our legitimate interests (security, preventing abuse, improving the product), and legal obligation.

3. Who can see what

Daily Tracker is a product about work that is shared, so some of what you enter is seen by other people by design. This is what is visible, and to whom.

People in your workspace

Your colleagues in a workspace can see your name, your role there, and the work logged in that workspace - tasks, time, completion and the figures drawn from them. Owners and admins of a workspace can see and manage the work of its members.

Anyone

Posts and records you publish are public: they have a public address, can be opened by people who are not signed in, and can be found by search engines. Your public profile - name, handle, photo, headline and whatever else you add - is public.

Your work record

Whether the figures from your work log appear on your public profile is your choice. You can switch this off at any time under Settings, Privacy and your record.

Businesses on the Index

A workspace may appear on the public Index with figures calculated from its work log. Those are figures about the business, not about named individuals.

Messages

Only the people in a conversation or room. Our staff do not read messages, except where a message has been reported or where the law requires it.

4. Companies that process information for us

We use a small number of service providers to run Daily Tracker. They process information on our behalf and only to provide their service to us.

Supabase

Database, sign-in and live updates.

Railway

Hosting of our application servers.

Vercel

Hosting of the website.

Cloudinary

Storage and delivery of the pictures and video you upload.

Resend

Sending email.

Google Firebase Cloud Messaging

Delivering push notifications to the mobile app. Google receives the push token and the content of the notification in order to deliver it.

Google Analytics

Counting visits to pages of the website. It is not used in the mobile app.

Google Sign-In

Only if you choose to sign in with Google.

We may also disclose information if we are required to by law, to protect the rights or safety of our users or the public, or as part of a merger or sale of the business - in which case this policy continues to apply to your information and you will be told.

These providers may store and process information in countries other than the one you live in, including the United States. Where the law requires safeguards for such transfers, we rely on the contractual protections those providers offer.

5. How long we keep it

We keep your information for as long as your account exists. When you delete your account, or ask us to, we delete or anonymise your personal information within 30 days, except where we must keep something longer to meet a legal obligation, resolve a dispute or prevent abuse.

Work that you logged inside a workspace is part of that workspace’s record. When your account is deleted it is no longer linked to your profile, but the workspace may keep the record of the work itself. Messages you sent remain visible to the people you sent them to unless you delete them.

Backups are overwritten on a rolling schedule, so deleted information may persist in backups for a short period before it is removed.

6. Your choices and rights

See and correct

You can view and change your account and profile details in Settings at any time.

Control visibility

You choose whether your work record is shown on your public profile, who may name you in a published record, and which businesses you mute.

Control notifications

Each kind of notification and email can be switched on or off in Settings. Push notifications can also be switched off in your device’s settings, and signing out of the app stops them for that device.

Delete your account

Write to help@dailytracker.lol from the email address on your account and ask for it to be deleted. We will confirm and complete the deletion within 30 days. You can also ask for specific information to be deleted without closing your account.

Get a copy

You can ask us for a copy of the personal information we hold about you.

Object or restrict

You can ask us to stop or limit particular uses of your information.

Depending on where you live, the law may give you these and further rights - for example under the GDPR in Europe and the United Kingdom, the Digital Personal Data Protection Act in India, or the CCPA in California - including the right to withdraw consent and to complain to your data protection authority. We respond to every request, wherever you live.

7. Security

Information travels between your device and our servers over encrypted connections. Access to the database is restricted by row-level rules, so a signed-in person can read only what they are entitled to. Access by our own staff is limited to what is needed to run and support the service.

No system is perfectly secure. If we become aware of a breach that affects your personal information, we will tell you and the relevant authorities as the law requires.

8. Children

Daily Tracker is a tool for people at work. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, write to us and we will delete it.

9. Changes to this policy

When we change this policy we will update the date at the top. If a change is significant - a new kind of information collected, or a new use of it - we will tell you in the product or by email before it takes effect.

10. Contact

Questions, requests and complaints about privacy go to help@dailytracker.lol. Daily Tracker is the controller of the personal information described in this policy.