Privacy Policy

The short version

Your entries are yours. We don't sell your information, and we don't use it for advertising.
Speech becomes text on your phone. Your voice recordings are not sent to us. Only the text of what you say or type is sent, securely, so it can be turned into entries.
We don't train AI on your data. Our AI provider processes your text only to return your entries and does not use it to train its models.
You control your data. Export it to CSV or JSON as often as you like, and delete your account and data at any time from Settings or on the web.
Not medical advice. Patterns and insights in the app are a starting point, not a diagnosis.

The rest of this policy explains these points in detail, including the rights you have depending on where you live.

1. Who we are and what this policy covers

Dayweave (the "App") is a personal daily health and wellness tracker. You talk or type about your day, and the App turns what you say into entries such as meals, workouts, mood, medications and symptoms.

The App is provided by BuiltForMe LLC, 971 US Highway 202N, Ste R, Branchburg, NJ 08876, USA ("we", "us", "our").

This policy applies to the App on Android (and later iOS), our website at dayweaveapp.com, and any support you receive from us (together, the "Service"). It does not apply to third-party services you choose to use, such as Google Play, which have their own privacy policies.

If you live in Washington, Nevada, Connecticut or another U.S. state with a consumer health data law, please also read Section 13, our Consumer Health Data Privacy Policy, which forms part of this policy.

2. Information we collect

2.1 Information you give us

Account information: Email address, name if you provide it, sign-in method (Google or email code). Why: To create and secure your account.
Health and wellness information you log: Mood ratings, symptoms and severity, meals and foods, medications you tag, sleep, water and caffeine, workouts and durations, notes, and any custom measures and categories you create. Why: This is the core of the App.
Text of what you say or type: The words you dictate or type when logging (e.g. "knee ache around a 3, two coffees"). Why: To turn your words into entries.
Saved source text (optional): The original words kept with each entry, only if "Keep what I said" is on. Why: So you can see where an entry came from.
Settings and preferences: Pinned measures, reminder time, toggles. Why: To run the App the way you set it.
Support messages: Emails or messages you send us. Why: To help you.

Health and wellness information is sensitive. Under some laws it is "sensitive personal information" (California and other U.S. states) or "consumer health data" (Washington, Nevada, Connecticut). We treat all of it with the same high level of care, wherever you live.

2.2 Information collected automatically

Device and technical information: device model, operating system version, App version, language, time zone, and IP address.
Diagnostics: crash reports and error logs [via a crash-reporting provider, if used], which we configure not to include the contents of your entries.
Usage counts needed to run the Service: for example, the number of AI-assisted logs you have used on a given day during your trial.

We do not collect your precise location, your contacts, your photos, or your device's advertising ID. We do not use third-party advertising or cross-app tracking tools. We do not use geofencing.

2.3 Your voice

When you tap the microphone, speech is converted to text using your device's built-in speech recognition. We ask the device to recognize speech on the device itself, so your audio is not sent to us or stored by us. On some devices or in some languages, on-device recognition may not be available, and your device's speech service (for example, Google's) may process the audio under that provider's own privacy terms. [Confirm final behavior during the build.] You can always type instead.

2.4 Information from third parties

Google Sign-In: if you sign in with Google, we receive your email address, name and profile identifier from Google.
App stores and our subscription provider: we receive your subscription status (for example, trial, active, renewed, cancelled) and a purchase identifier from Google Play through our subscription provider. We never receive your full payment card details.

3. How we use your information

To provide the Service: create your account, store and sync your entries across your devices, show your history, charts, "Not recorded yet" reminders and patterns.
To turn your words into entries: we send the text of what you say or type, together with a list of your existing measures (names, types, units and listen-for words), to our AI provider. It returns structured entries that you review on the Logged screen before they are kept.
To answer your questions in chat: we send your question, the recent messages in that chat, a list of your measures, and only the results of the lookups needed to answer it (for example a week of mood averages) to our AI provider. We keep your chats so you can come back to them; you can delete any chat, and Delete all data erases them all.
To calculate patterns and insights: the App compares days with and without things you log to show patterns. These calculations use only your own data.
To manage your trial and subscription: check whether you have AI logs available and whether your subscription is active.
To keep the Service secure: prevent abuse and fraud, enforce limits, and investigate problems.
To support you and communicate with you: answer questions and send important service notices (for example, changes to this policy or a security issue). We do not send marketing emails unless you opt in [if you add marketing later].
To improve the Service: using aggregated or de-identified information that cannot reasonably be linked back to you, such as how many people use a feature. We do not use the content of your entries to train AI models.
To comply with law: respond to lawful requests and meet our legal obligations.

No automated decisions with legal effect. The App uses automated processing to read your words and suggest entries and patterns, but it does not make decisions that produce legal or similarly significant effects about you.

We process your health and wellness information, including AI parsing and patterns, only with your consent, which you give separately during sign-up. You can withdraw it at any time by deleting your data or account; withdrawal stops future processing but does not affect processing before it.

We do not sell your personal information, and we do not share it for targeted or cross-context behavioral advertising. We share it only as described below.

5.1 Service providers (processors)

We use a small number of trusted providers who process information on our behalf, under contracts that limit their use to providing services to us and require appropriate security.

Supabase [Inc.]: Hosting, database, sign-in and server functions. Information involved: Account information, your entries and settings. Stored in the United States.
Anthropic, PBC: AI processing that turns your words into entries. Information involved: The text of what you say or type and your list of measure names. Under Anthropic's commercial terms, this data is not used to train its models by default and is automatically deleted within 30 days, except where it is flagged for a usage-policy review (kept up to 2 years) or must be retained by law. [Confirm current terms, or a zero-data-retention agreement, before launch.]
RevenueCat [Inc.]: Subscription management. Information involved: Purchase identifiers and subscription status; an anonymous App user ID.
Google (Play Billing, Sign-In): Payments and optional sign-in. Information involved: Handled under Google's own terms; we receive status, not card details.
[Crash reporting provider, if used]: Diagnosing crashes. Information involved: Technical data only; no entry contents.
Resend: Sending sign-in codes and service emails. Information involved: Email address.

5.2 Other disclosures

At your direction: when you export your data or share a file, it goes where you choose.
Legal reasons: if we believe in good faith that disclosure is required by law, court order or a valid government request, or to protect the rights, safety or property of you, us or others. Where allowed, we will tell you about requests for your data.
Business transfers: if we are involved in a merger, acquisition or sale of assets, your information may transfer to the new owner, who must continue to protect it as described in this policy. We will notify you before your information becomes subject to a different policy.

6. How long we keep your information

Account, entries, measures and settings: While your account is active. When you delete your account, we delete it from our active systems within 30 days and from backups within [90] days.
Text sent for AI processing: Not stored by us beyond returning your entries, unless "Keep what I said" is on (then kept with the entry until you delete it). Our AI provider deletes it within 30 days, subject to the exceptions in Section 5.1.
Subscription and billing records: As long as required by tax and accounting laws, typically up to [7] years.
Diagnostics and server logs: Up to [30–90] days.
Support messages: Up to [2] years after the conversation ends.

7. How we protect your information

Encryption in transit (HTTPS/TLS) and at rest.
Row-level access controls so each account can access only its own data.
The AI provider's key is kept on our servers, never in the App.
Limited staff access on a need-to-know basis, with audit logging [confirm].
A local copy on your phone so the App works offline. It is protected by your phone's own security; we recommend a screen lock.

No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authorities as required by law, including the U.S. Federal Trade Commission's Health Breach Notification Rule and applicable state laws.

8. Where your information is stored

We are based in the United States and offer the Service only there. Our service providers store and process your information in the United States. [Confirm for each provider.]

9. Your rights and choices

Depending on where you live, you may have the right to:

Access the personal information we hold about you and get a copy.
Export (portability): download your data as CSV or JSON from Settings → Export data, at any time.
Correct inaccurate information. You can edit any entry in the App.
Delete your information. Use Settings → Delete account and data, or dayweaveapp.com/delete-account. Deleting your account does not cancel a Google Play subscription; cancel that in Google Play.
Withdraw consent to processing of your health information at any time. Because the App cannot work without it, withdrawing means deleting your data or account.
Object to or restrict certain processing, such as de-identified analytics.
Opt out of sale, sharing for targeted advertising, or profiling. We don't do these, so there is nothing to opt out of, but you may still ask.
Appeal a decision we make about your request (U.S. states that provide this right).

How to make a request: email privacy@dayweaveapp.com from the address on your account, or use the in-app options above. We may need to verify your identity before acting. You may use an authorized agent where the law allows; we may ask for proof of authorization. We will respond within the time the law requires (for example, 45 days under California law). We will not discriminate against you for exercising your rights.

10. State-specific information

10.1 California

This section supplements the policy for California residents under the California Consumer Privacy Act as amended (CCPA). [Confirm whether CCPA thresholds apply; it is good practice to honor these rights regardless.]

Identifiers (email, account ID, IP address): Collected: Yes. Disclosed for business purposes to: Hosting, sign-in, email and subscription providers.
Sensitive personal information: health information: Collected: Yes. Disclosed for business purposes to: Hosting and AI processing providers.
Commercial information (subscription status): Collected: Yes. Disclosed for business purposes to: Subscription provider, Google Play.
Internet or device activity (diagnostics): Collected: Yes. Disclosed for business purposes to: Hosting [and crash reporting] providers.
Precise geolocation, biometrics, contacts, audio recordings: Collected: No.
We do not sell or share personal information, and we have not done so in the past 12 months.
We use sensitive personal information only to provide the Service you request and for other purposes permitted under the CCPA regulations, so the "right to limit" is already met.
Sources, purposes and retention are described in Sections 2, 3 and 6.
California's "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing.

10.2 Other U.S. states

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have rights to access, correct, delete, port and opt out, and to appeal our decision. Email privacy@dayweaveapp.com with "Appeal" in the subject line to appeal; if we deny your appeal, you may contact your state Attorney General. Consumer health data rights for Washington, Nevada and Connecticut are in Section 13.

11. Children

The Service is intended for adults. You must be at least 18 years old, or the age of majority in your state if that is higher, to use it. We do not knowingly collect information from anyone under that age. If you believe a minor has created an account, contact privacy@dayweaveapp.com and we will delete it.

12. Health information and medical disclaimers

BuiltForMe LLC is not a healthcare provider, and the App is not a medical device. In most cases we are not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), so HIPAA does not apply. We protect your health information as described in this policy and under applicable consumer health and privacy laws.
Patterns and insights show associations in your own entries. They are not proof that one thing causes another and are not medical advice.

13. Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut and similar laws)

This section is our consumer health data privacy policy under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data provisions, and similar laws. [Publish this section also as its own page, linked from your website's home page as required by Washington law.]

Consumer health data we collect: the health and wellness information described in Section 2.1 (for example, symptoms and severity, mood, medications, meals, sleep, activity, and notes), plus inferences the App derives from it, such as patterns.
Sources: directly from you, when you talk, type or tap in the App.
Purposes: to provide the Service you requested (logging, history, reminders, patterns), to manage your account and subscription, and to keep the Service secure (Section 3).
Consent: we collect consumer health data only with your consent, which you give separately during sign-up and is not bundled into our Terms. We do not share it with third parties other than processors acting on our behalf without your separate consent, and we never sell it.
Categories of recipients: our processors (hosting, AI processing, subscription management), listed in Section 5.1. We do not share consumer health data with affiliates or other third parties.
Your rights: to confirm whether we collect, share or sell your consumer health data; to access it, including a list of third parties and affiliates with which it was shared; to withdraw consent; and to have it deleted (including from processors). Use the options in Section 9 or email privacy@dayweaveapp.com. You can appeal a refusal by replying with "Appeal"; if we deny your appeal you may contact your state Attorney General.
No geofencing: we do not use geofencing around healthcare facilities.

14. Changes to this policy

We may update this policy as the Service or the law changes. If we make material changes, we will notify you in the App or by email before they take effect and, where required by law (for example, for new uses of health data), ask for your consent again. The "Last updated" date at the top shows when it last changed.

15. Contact us

BuiltForMe LLC, 971 US Highway 202N, Ste R, Branchburg, NJ 08876, USA, privacy@dayweaveapp.com.