Daily Privacy Policy

Privacy Policy

This Privacy Policy explains how Daily handles personal data when you use the free Daily service.

Last updated: 8 October 2026.

Who runs Daily

Daily is operated by Wojciech Makowiec, an individual in Poland. Daily is free to use. For privacy questions or requests, contact [email protected].

What Daily collects and why

Daily handles these data categories to provide its features:

  • Google account data: the account identifier, name, email address, email verification state, and optional profile image returned by Google Sign-In. Daily uses this data to create and operate your account. The email address is the Daily Summary recipient.
  • OAuth records: Google account identifiers, granted scopes, access tokens, refresh tokens, ID tokens, and token expiry values are stored in the Better Auth account tables. They support sign-in and, when you connect Calendar, live Calendar access.
  • Daily setup: summary time, time zone, delivery and section settings, Todo categories and tasks, weather location and saved cities, commute addresses and routes, route days, and selected calendars.
  • Google Calendar data: when you connect Calendar, Daily reads the calendar list and live event data for the calendars you select. Daily uses event titles, dates, times, and all-day information to show the Calendar Section and build a Daily Summary. Daily does not create, edit, or delete Calendar events, and the current code does not store event content in the Daily database.
  • Delivery and technical records: Daily stores summary delivery status, provider status metadata, provider message identifiers, timestamps, retry data, and privacy-safe technical logs. Delivery records do not store the full email content. Better Auth session records also include expiry, IP address when supplied, user agent when supplied, and the account identifier.
  • Optional browser analytics: only after you accept analytics, Daily sends page views, feature-use events, and browser errors to PostHog. Events can include the action name, time, browser and device information, network metadata such as the IP address, page address without query parameters or fragments, a browser identifier, and your Daily user identifier when signed in. Daily does not attach your name or email to browser analytics. Automatic interaction capture and session recordings are disabled; task text, Calendar content, and address search text are not collected as browser analytics.
  • Terms acceptance: Daily stores the accepted Terms version and the acceptance time when you create an account. Older accounts may retain historical access confirmations from the previous registration flow. Daily does not collect new age confirmations, dates of birth, or identity documents.

Legal bases

Daily processes personal data on the following legal bases. Google OAuth authorisation is not, by itself, a GDPR legal basis.

  • Account creation, sign-in, account settings, Calendar connection, and a requested Daily Summary: performance of the service agreement under Article 6(1)(b) GDPR.
  • Service security, abuse prevention, privacy-safe operational logs, troubleshooting, and account deletion controls: Daily's legitimate interests under Article 6(1)(f) GDPR.
  • Terms acceptance and historical access records: contract administration and Daily's legitimate interest in keeping a record of the access condition that you accepted.
  • Optional browser analytics and related analytics cookies and storage: your consent under Article 6(1)(a) GDPR. You can refuse or withdraw this consent without losing access to Daily.

Google Sign-In and Google Calendar

The Google sign-in request uses openid, email, and profile. These scopes support account sign-in and the account email address. Daily requests Calendar access in a separate connection flow using https://www.googleapis.com/auth/calendar.calendarlist.readonly to list calendars and https://www.googleapis.com/auth/calendar.events.readonly to read live events for the Calendar Section and Daily Summary.

Daily requests only the Google permissions used by these features. Daily uses Google user data only to provide visible Daily features, does not sell it, does not use it for advertising or credit decisions, and does not transfer it to data brokers. If a Calendar event is included in an email that you requested, the generated email is sent to the email delivery provider described below. Daily does not send Calendar data to the optional weather AI provider.

Google data is protected by the Google API Services User Data Policy and its Limited Use requirements. Daily must keep the published policy and OAuth configuration accurate and must use the minimum permissions needed.

Data protection and security

Daily uses the following safeguards to protect personal and sensitive data, including Google account information, Google Calendar data, and OAuth credentials:

  • Encryption in transit: the public Daily website uses HTTPS to encrypt data sent between your browser and the website. Daily communicates with Google's OAuth and Calendar API endpoints over HTTPS to protect credentials and Calendar data in transit.
  • Access controls: account features require an authenticated session, and Daily uses the signed-in user's identifier to access their saved settings and connected Calendar data. Administrative features are restricted to explicitly allowed administrator accounts.
  • Session protection: session cookies are HTTP-only to prevent browser scripts from reading them, use same-site restrictions, and use the Secure attribute on HTTPS. The Google sign-in flow checks temporary OAuth state to protect the sign-in process.
  • Limited permissions: Daily uses Google OAuth so you do not provide your Google password to Daily. Calendar access requires a separate authorisation and uses read-only permissions; Daily cannot create, change, or delete your Calendar events.
  • Data minimisation: Calendar events are fetched when needed and their content is not stored in Daily's database. Delivery records do not contain the generated email body. Daily's structured operational logs contain status and diagnostic metadata, rather than Calendar event content, email bodies, or OAuth tokens. A requested summary is shared with the email delivery provider as described below.
  • Deletion controls: deleting your account stops further Daily work, attempts to revoke Google tokens, and removes your account and linked OAuth records from the live database. Backup retention and the limits of token revocation are explained below.

Daily does not use data obtained through Google Workspace APIs, including Google Calendar data, to develop, improve, or train general-purpose or non-personalised AI or machine-learning models.

External providers

Daily's code can send the following data to external services:

  • Google: identity data for sign-in, OAuth token exchanges, Calendar lists, and Calendar events. Google Maps Places receives address search text and selected place identifiers. Google Routes receives saved route coordinates to estimate travel time.
  • Resend: the recipient address and the generated HTML and plain-text Daily Summary when email delivery is configured and enabled. The email may contain the weather, commute, Todo, and selected Calendar sections.
  • Open-Meteo: weather search text for geocoding and the selected latitude, longitude, time zone, and forecast request values for weather data.
  • Optional weather AI: only normalised weather values are sent to the configured OpenAI Responses endpoint to produce a short weather sentence. The current implementation does not send the user's name, email, Calendar events, Todo tasks, or commute route to that endpoint, and requests that the response is not stored.
  • PostHog: optional browser analytics as described above. Separately, Daily uses PostHog for server diagnostics: scheduled-delivery totals, duration and failure classifications, and, when weather AI is enabled, generation traces containing normalised weather input, the generated weather sentence, model and token usage, timing, status, and the Daily user identifier. These server diagnostics support troubleshooting under the legitimate-interest basis described above, use no browser analytics cookies, and are not controlled by the browser analytics choice. They do not include Calendar events, Todo text, email bodies, or OAuth credentials. See PostHog's Privacy Policy.
  • Cloudflare: the application code has no Cloudflare API integration. A production deployment may place Cloudflare or cloudflared in front of Daily. Any proxy logs or provider retention depend on the final production configuration and are not determined by this application code.

Provider processing locations, contracts, retention, and international transfer safeguards are not fully determined by this repository. Daily does not state a specific provider data location or transfer mechanism until the operator verifies the production settings and legal documents.

Cookies and browser storage

Daily uses the Better Auth session cookie to keep a signed-in session. In the current configuration the cookie is normally named better-auth.session_token, with the secure prefix used by Better Auth on HTTPS. It is an HTTP-only, same-site session cookie. During the Google OAuth redirect, Better Auth also uses a short-lived signed state cookie, normally named better-auth.state with the secure prefix on HTTPS. The current database-backed Better Auth setup stores the matching temporary OAuth state in its verification table and removes it after the callback. The OAuth confirmation step also uses a short-lived, signed HTTP-only cookie containing only the confirmation values needed to complete the account creation flow.

Before sign-in, Daily stores the visitor's local setup in browser local storage under daily.visitorLocalSetup.v3. This can include the local setup listed above. The application does not use the visitor setup cookie, session storage, IndexedDB, or a browser database for this purpose. Daily also stores whether you have seen the introduction under daily.onboarding.v1.

These cookies and storage support sign-in, security, your saved local setup, and your preferences. They are separate from optional analytics. Daily stores your analytics choice and its timestamp in local storage under daily.cookieConsent.v1 for 180 days, after which you are asked again when you revisit. Clearing this storage also resets your choice. If browser storage is blocked, your choice applies only to the current visit.

Before you accept analytics, Daily does not initialise PostHog browser tracking or send browser analytics events. After acceptance, PostHog uses a first-party cookie normally named ph_<project-token>_posthog, along with PostHog local and session storage, to recognise a browser and its analytics session. The analytics cookie has a 180-day lifetime that can be renewed during use. Daily does not enable session recordings or cookieless tracking as an alternative when you refuse analytics.

Select Cookie settings in the footer of Daily or below to change your choice. Rejecting analytics stops further browser analytics collection and disables PostHog analytics persistence. Withdrawing consent does not affect the lawfulness of earlier processing or automatically delete events already received by PostHog; contact Daily to request deletion of that data.

Retention

  • The Daily account, setup, OAuth records, connection metadata, and legal confirmation are kept while the account exists and are deleted from the live database during account deletion.
  • The interface and health queries use a 30-day window for delivery records. The current code does not contain a separate live-database purge for old delivery records.
  • Technical logs and scheduled worker run records use a configurable operational retention period with a 30-day default.
  • Verified SQLite backups use a configurable retention period with a 30-day default. A backup can still contain deleted account data until that backup expires.
  • PostHog analytics, replay, error, log, and AI diagnostic retention is controlled by the PostHog project settings and provider rules. Daily's account deletion does not automatically delete records already stored in PostHog. Contact [email protected] for a request concerning those records.
  • An email accepted by Resend or delivered to a recipient cannot be recalled by Daily. The provider's retention and deletion rules must be checked separately.

Disconnecting Calendar and deleting an account

Disconnecting Google Calendar removes the Daily Calendar connection metadata and selected calendar settings. The current disconnect action does not revoke or delete the separate Better Auth Google account record. Account deletion is the removal path for the local account and its linked data. It marks the account as deleting, stops further Daily work, attempts to revoke unique Google tokens, and then deletes the live Daily and Better Auth records.

Google token revocation is best effort. If Google or the network does not accept a revocation request, Daily still removes the local records during account deletion. Historical backups are not rewritten after deletion and remain restricted recovery artifacts until normal backup retention expires.

Your rights and complaints

Subject to the conditions in applicable data protection law, you may ask for access to, correction of, deletion of, restriction of, or portability of your personal data. You may also object to processing based on legitimate interests. Contact Daily first at [email protected].

You may withdraw consent to browser analytics at any time through Cookie settings. Acceptance of the Terms of Service and Google authorisation do not give consent to analytics.

You have the right to complain to the President of the Polish Personal Data Protection Office (UODO). See the official UODO information at uodo.gov.pl/en/680/1402.

Account registration

Creating a Daily account requires acceptance of the Terms of Service. Returning users do not need to repeat this step when signing in. Daily does not require an age declaration.

Contact

Contact Wojciech Makowiec at [email protected] about this Privacy Policy, a privacy request, or a complaint about Daily.