Your day is personal.

DayOS website privacy policy · Effective 16 October 2026

DayOS is operated by Amanpal Singh. This policy covers the website at dayos.amanpalsingh.in and its shared cloud API. Contact amanpalsingh878@gmail.com for privacy questions, access requests or help deleting your account. The mobile app is not part of this website launch.

Signing in saves your Google account identity and DayOS records on our server so they can follow you between browsers. Login and sync are free. The demo keeps its sample records in your browser.

What we collect and why

• Google sign-in: your Google account identifier, name and verified email address identify your DayOS account and keep its records separate from other accounts. Google sends a signed identity token, which the server verifies. We do not receive your Google password or request access to Gmail, Drive, contacts or Calendar.
• Your saved records: trackers, entries, notes and reflections, skipped days, supported preferences, and any projects, tasks or work sessions you save or import. Depending on what you enter, these can include moods, health-related information, spending amounts and other people's names. Only enter information you are comfortable storing in DayOS and have permission to provide. The website does not read Health Connect or your phone's sensors.
• Service and security information: session identifiers, sync revisions and mutation history support login, offline retries and conflict resolution. Server logs can contain IP addresses, request paths, browser information, timestamps and response codes for operation and abuse investigation. Application error logs use error types and request identifiers; they do not intentionally record journal bodies or authentication tokens.

Service usage dashboard

Our private owner dashboard shows registered account names and email addresses, signup dates, and recent sign-in or successful sync activity. We keep one activity timestamp per account per day, along with aggregate daily counts of sign-ins, sync requests, conflicts and server errors, for up to 90 days. Account deletion removes identifiable activity from the active database; anonymous totals remain until expiry. Dashboard data does not include journal text, tracker values or other saved record contents.

We also count anonymous landing-page, demo and workspace opens to understand website usage. These counters do not store visitor identifiers, IP addresses, referrers or browsing histories, and cannot identify unique visitors. We do not send these counts when your browser sends Do Not Track. Aggregate usage data may remain in encrypted recovery backups under the backup retention policy below.

Cookies and browser storage

Essential cookies keep you signed in and protect Google sign-in. DayOS sessions expire after 30 days unless revoked sooner; the sign-in nonce expires after five minutes. Browser storage keeps per-account cached records and pending edits for offline recovery. A service worker caches the app's static files, not authenticated API responses. We do not use advertising cookies or third-party analytics in this website.

Signing out revokes that session. It does not delete the cloud account. Synced browser caches are cleared on sign-out; pending unsynced edits remain tied to their account. Use a trusted device, and clear site storage when you want to remove all local copies.

How data is used and shared

We use your information to provide DayOS, synchronize your saved data, answer support requests, recover the service and protect it against abuse. We do not sell your personal data, use it for advertising or use your journal content to train AI models.

Google provides sign-in. The DayOS database runs on our hosted server in Bangalore, India. Encrypted recovery copies are stored with Backblaze B2 in its EU Central region and on the server; recovery credentials are also protected on the operator's secured recovery device. These providers process information to supply those services; their infrastructure may be outside your country. Backup storage receives encrypted files rather than readable journal records. We may also disclose information when required by law or necessary to investigate abuse or protect the service.

DayOS's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google identity is used for account authentication and operation, not unrelated profiling.

Security and access

Connections use HTTPS. The API authenticates requests and scopes records to the signed-in account; the database is not directly accessible from the public internet. Recovery backups are encrypted before storage. Cloud records are not end-to-end encrypted: the operator has technical access to the server. Access is limited to service operation, support you request, security investigation or legal requirements. No service can guarantee complete security.

Retention and deletion

We keep your account and saved data until you delete the cloud account. Removing an individual item hides it and sends a deletion marker to other clients. Record content and earlier mutation responses may remain in the sync history for reliable offline synchronization; use cloud-account deletion to remove all of that account's data from the active database.

Settings → Delete cloud data removes your identity, records, mutation history, sessions and any stored purchase-verification records from the active database. Export anything you want to keep first. Signing in again creates a new cloud account. Offline copies can upload data again, so remove those copies before signing back in. See the full deletion instructions.

Encrypted recovery snapshots follow a rolling 30-day retention schedule, keeping the latest successful snapshot if backups fail. They are not used as an archive or for ordinary account access. Deletions reach older recovery copies as scheduled expiration and pruning run; a backup failure can delay expiry. Recovery procedures require reapplying known deletion requests before reopening restored data. Web access logs rotate daily, retaining up to 14 rotated files; application diagnostics are retained according to the server log limits. Copies you export or retain on your own devices are under your control.

Your choices

You can explore the local demo without a DayOS account, edit records, export your data in Settings, sign out or delete the cloud account. You can also remove DayOS from your Google account's connected services; that does not by itself delete DayOS records. Contact us for access, correction or deletion assistance. We may need to verify account ownership and will not ask for your Google password or verification codes.

Changes and availability

The effective date above identifies this policy version. We will update this page when our practices change and provide an in-product notice for material changes. Premium purchases are not offered during the website-only launch. Mobile-specific permissions and purchase handling will be disclosed before those features launch.