Daydash Privacy Policy

Effective Date: September 4, 2025

Last Updated: October 23, 2026

Axil LLC (“we,” “our,” or “us”) values your privacy. This Privacy Policy explains how we collect, use, and protect information about you when you use DayDash, including its web, desktop, and mobile applications and hosted services (the “App”).

1. Information We Collect

We may collect the following types of information:

Personal Information: Information you provide directly, such as your name, email address, phone number, or account credentials when creating an account or contacting support.
Usage Data: Information about how you use the App, including log data, device type, operating system, app version, IP address, and browsing activity within the App.
Location Data (if applicable): Approximate or precise location data if you enable location services on your device.
Cookies & Similar Technologies: We use cookies and similar on-device storage to keep you signed in and for the analytics described in Section 3. That includes a first-party analytics cookie, set on daydash.io and on the App’s sign-in pages, that holds a random identifier so we can count visits and, if you go on to create an account, link that visit to it. We do not use advertising cookies or mobile advertising identifiers.
AI Assistant Conversations: If you use the AI assistant, the messages you send and the responses you receive. Conversations are stored encrypted, as described in Section 5.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the App.
Improve, personalize, and expand our services.
Communicate with you (including customer support, updates, and promotional messages if you opt in).
Monitor usage and analyze trends to improve performance and features.
Detect, prevent, and address technical or security issues.

We do not sell your personal information, and we do not track you across other companies’ apps or websites for advertising purposes. We may share your information only in the following circumstances:

Service Providers: With third-party vendors and partners who help us operate the App (e.g., hosting, analytics, customer support).
AI Tools You Connect: If you connect an AI tool or agent to DayDash through a remote MCP connection, it receives the data you choose to share with that connection, as described below and in Section 5.
Sharing and Publishing You Choose: People you share a dashboard or data source with, and anyone who can open a dashboard you publish, receive the information covered by that action, including YNAB data if it is included.
Legal Compliance: If required by law, regulation, or legal process.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred.

Third-Party Service Providers

We use the following third-party services to operate and improve DayDash:

Sentry (Crash Reporting & Performance Monitoring)

Provider: Functional Software, Inc. (Sentry)
Purpose: Captures crash reports, error logs, and performance data to help us identify and fix technical issues.
Data Collected: Error logs, stack traces, device metadata (OS version, app version, device model), session context, and session replays for debugging purposes.
Identifiers: Error reports are tagged with your DayDash account identifier so we can trace a crash back to the affected account. This is a stable account ID — not an anonymous or randomly generated value, and not a device advertising identifier.
Data NOT Collected: We do not send your name or email address to Sentry, and we do not enable Sentry’s optional automatic collection of personal information. Health data is not intentionally sent to Sentry.
Privacy Policy: https://sentry.io/privacy/

PostHog (Product Analytics)

Provider: PostHog, Inc. (hosted on PostHog’s US cloud)
Purpose: Helps us understand how the daydash.io website and the App are used (page and screen views, product events, and which campaign or referring site brought you to DayDash) so we can improve them.
Data Collected: On daydash.io and on the App’s sign-in pages, before you sign in: page views recorded under a random first-party cookie identifier; no profile is built for signed-out visitors. Once you sign in: your DayDash account identifier, screen and page views, and account-level product properties (your selected interests, whether account setup is complete, and account timestamps). When you create an account we also record, once, the campaign parameters, referring site, and landing page of the visit that led to sign-up, and the earlier anonymous visit is linked to your account.
Data NOT Collected: We do not send your name or email address to PostHog. Automatic capture of clicked-element text is deliberately disabled so that labels you write yourself (such as dashboard or widget names) never reach analytics, and your dashboard data itself is never sent to PostHog.
Privacy Policy: https://posthog.com/privacy

MailerLite (Email Communications)

Provider: MailerLite
Purpose: Sends account and marketing email (such as onboarding and product updates) and manages your email preferences.
Data Collected: Email address, name, DayDash account identifier, account status (such as whether setup is complete and when you were last active), and your selected interests.
Data NOT Collected: Your dashboard data, health data, and AI conversations are never sent to MailerLite. You can opt out of marketing email at any time via the unsubscribe link in those messages.
Privacy Policy: https://www.mailerlite.com/legal/privacy-policy

Clerk (Authentication & Web Billing)

Provider: Clerk, Inc.
Purpose: Provides secure user authentication, account management, session handling, and web subscription billing.
Data Collected: Email address, authentication tokens, account preferences, and subscription information.
Privacy Policy: https://clerk.com/privacy

RevenueCat (Mobile In-App Purchase Processing)

Provider: RevenueCat, Inc.
Purpose: Processes and manages subscriptions purchased as in-app purchases through the Apple App Store or Google Play, and keeps your subscription status in sync with your DayDash account.
Data Collected: Purchase and subscription status (product, renewal, and expiration information) and app user identifiers. Your payment details are handled by Apple or Google; neither RevenueCat nor DayDash receives your payment card information.
Privacy Policy: https://www.revenuecat.com/privacy

Amazon Web Services (Cloud Hosting & AI Processing)

Provider: Amazon Web Services, Inc. (AWS)
Purpose: Hosts our servers, databases, and file storage, and provides the managed AI service (Amazon Bedrock) behind the AI features described in Section 5.
Data Collected: DayDash data is stored on AWS infrastructure, encrypted as described in Section 4. When you use AI features, the content described in Section 5 is processed by Amazon Bedrock inside our AWS environment. Amazon Bedrock does not use your content to train models.
Privacy Policy: https://aws.amazon.com/privacy/

AI Tools You Connect (Remote MCP Connections)

Recipient: The MCP client or agent you choose to connect. Depending on that client’s configuration, it may send results to an AI provider (for example, Anthropic for Claude or OpenAI for ChatGPT) or other services. Those recipients handle what they receive under their own policies and your settings with them.
Data Received: The results of the client’s requests within the access you grant, including health or financial data if your selected scope includes it.
Infrastructure: Hosted connections will run on DayDash-managed servers on AWS.
More Information: See Section 5.

Shared and Published Dashboards

Sharing a dashboard gives people who accept your invitation read-only access to it and the whole data sections its charts use, including any YNAB data in those sections. Anyone with an invitation link who signs in to DayDash can accept it. Sharing a data source gives access to its sections.

You can remove a recipient or revoke an invitation link in the Share dialog. Revoking an invitation prevents new acceptances; remove existing recipients to end their access. These actions cannot erase information already received or copied.

Publishing a dashboard makes it and its referenced data sections available to anyone with the public link, without signing in. Choose Unpublish to disable the link. People may retain information they already viewed or copied.

4. Data from Connected Third-Party Services

When you choose to connect third-party services to DayDash (such as financial institutions, health providers, or productivity tools), we access your data via their respective APIs to provide the features you choose, as described in this policy.

Encryption & Key Management: Your synchronized data points (including financial transactions and health metrics) are encrypted before they are stored on our servers, using encryption keys that belong to you. During account setup you choose how account recovery works. The sharing, publishing, and AI features described in Sections 3 and 5 are exceptions to device-only access:
- You hold your recovery code (the default, recommended option): DayDash keeps no copy of your recovery code or personal private key for account recovery. Subject to the features you authorize in Sections 3 and 5, DayDash personnel and systems cannot decrypt your stored data points.
- DayDash-managed recovery (optional): If you instead choose to let DayDash hold your recovery code (so that new devices can set themselves up automatically, with no Emergency Kit to manage), we store an encrypted copy of your recovery code on our servers. In this mode our systems can technically recover your decryption keys. Access is restricted to automated device-setup processes, but because recovery is tied to your account, anyone who gains control of your DayDash account (for example, through a password reset) could decrypt your synchronized data. You can switch back to holding your own recovery code at any time in account settings.
Security & Limited Access: We use the permissions you grant to synchronize connected services. Your data points are stored encrypted, with access as described above and in the sharing and AI sections of this policy.
User Authorization: Your data points remain encrypted in storage. Before a feature sends their contents to an AI service or shares them with another recipient, you authorize that use through DayDash’s standard feature controls. This includes sharing, publishing, and upcoming hosted MCP connections. Authorization can cover ongoing access within the scope you approve.
Data Usage: Data synced from third-party integrations is used for your DayDash dashboards and, when you choose them, the sharing and publishing features in Section 3 and AI features in Section 5. We do not sell, share, or aggregate this data for any third-party advertising or market research.

Health Data from Apple Health (HealthKit) and Android Health Connect

When you choose to connect Apple Health or Android Health Connect, DayDash requests read-only access to health data categories that you explicitly select. DayDash does not write or modify any data in Apple Health or Health Connect. The specific categories of health data we may access include:

Activity & Fitness: Steps, active and basal calories burned, distance (walking, running, cycling, swimming), flights climbed, workouts, exercise time, move time, stand time, VO2 max, running speed, cycling cadence
Body Measurements: Weight, height, BMI, body fat percentage, lean body mass, waist circumference
Vitals: Heart rate, resting heart rate, heart rate variability (HRV), blood pressure (systolic and diastolic), blood glucose, oxygen saturation, body temperature, skin temperature, respiratory rate
Nutrition: Dietary calories, protein, carbohydrates, fat, fiber, water/hydration, sugar, sodium, caffeine
Sleep: Sleep analysis, sleep stages, time in bed
Reproductive Health: Menstrual flow, basal body temperature, ovulation tests, cervical mucus, intermenstrual bleeding
Hearing: Environmental and headphone audio exposure levels
Mobility: Walking and running metrics, wheelchair pushes

How Health Data Is Used:

Health data is used for your DayDash dashboards and health and wellness visualizations, and for the optional features you choose described in Sections 3 and 5.
Health data is never sold or provided to advertisers, data brokers, or analytics providers. When you choose the AI assistant, external-tool access, sharing, or publishing involving health data, it is processed or disclosed as described in Sections 3 and 5. Amazon Bedrock does not use that data to train models; an external AI tool you connect handles what you share under its own privacy policy.
Health data is never used for advertising, marketing, or to build user profiles for non-health purposes.
Health data points are encrypted at rest with your own encryption keys, with key custody and the exceptions you authorize as described in “Encryption & Key Management” above.
DayDash requests only the specific health categories you select — we do not request access to categories you have not chosen to sync.

Background Sync: With your permission, DayDash may sync health data in the background to keep your dashboard up to date. Background sync accesses only the health categories you have previously authorized.

Revoking Access: You may revoke DayDash’s access to your health data at any time:

iOS: Go to Settings > Privacy & Security > Health > DayDash
Android: Go to Settings > Health Connect > App permissions > DayDash
You may also disconnect the health data source within the DayDash App.

Specific Disclosure: You Need A Budget (YNAB)

To comply with YNAB’s API Terms of Service, we explicitly disclose the following regarding data accessed via the YNAB integration:

Data Accessed: We access your Budget/Plan names, account balances, category balances, and transaction history (payees, amounts, dates, and memos).
Storage & Retention: YNAB data points are encrypted at rest with your encryption keys, with key custody and the exceptions you authorize as described in “Encryption & Key Management” above. We retain this data only until you explicitly delete the YNAB data source or your DayDash account.
No Sale; Processing and Transfers You Choose: We do not sell your YNAB data or provide it to advertisers or data brokers. AWS hosts the service and Amazon Bedrock processes relevant YNAB information when you choose to use our AI features involving it. External AI tools you connect, people you share with, and viewers of dashboards you publish receive the information covered by your choices, as described in Sections 3 and 5. We do not distribute your YNAB data for unrelated purposes.
Deletion: You may delete your YNAB data from our systems at any time by removing your YNAB data source within the DayDash App or deleting your DayDash account.

5. AI Assistant and AI Features

DayDash includes optional AI features: an AI assistant you can chat with about your data, and small AI-powered configuration helpers (for example, suggesting column types when you import a spreadsheet). These features are powered by large language models running on Amazon Bedrock, an AWS service, inside our own AWS environment.

The AI assistant is one of the parts of DayDash where our usual “your stored data is unreadable to us” model does not fully apply (remote MCP connections, described below, are another), and we want to be clear about it. Here is exactly what happens when you use the assistant:

Your messages go to the model. When you ask the assistant a question, your message and the conversation history are sent from your device through our servers to Amazon Bedrock to generate a response.
Data lookups run on your device. If the assistant needs your data to answer, it reads that data locally on your device, where it is decrypted with your key. The AI data flow never transmits your encryption key: neither our servers nor Amazon Bedrock receive it. (How your key itself is managed, including the optional DayDash-managed recovery mode, is described in Section 4.)
The relevant results are sent to the model. The results of those lookups (the data relevant to your question, not a bulk copy of your data) are sent through our servers to Amazon Bedrock so the model can generate the answer. During this step your decrypted data is processed in the cloud. Our servers relay it in memory without storing it, and the processing happens under our Business Associate Agreement with AWS.
Conversations are stored encrypted. Finished messages are encrypted with your account’s keys before storage.

What this means in practice:

If you ask the assistant about your data, including health or financial data, that data is decrypted and processed in the cloud to generate the response. If you do not want specific data processed this way, do not ask the assistant about it. Outside of the AI features described in this section, DayDash never sends your decrypted stored data to an AI model.
For the assistant, AI processing happens inside our AWS environment via Amazon Bedrock, not on a third-party consumer AI service. Amazon Bedrock does not use your data or conversations to train models, and the companies that make the underlying models do not receive access to them. Amazon may retain AI inputs and outputs for a limited period to detect abuse, in accordance with AWS policies.
We never use your conversations or other AI inputs for advertising, and we never sell them.
To enforce monthly usage allowances, we record usage measurements for AI assistant requests (such as token counts, request size, computed cost, and which conversation they belong to). These records do not contain the content of your messages or your data.
Before you first use the assistant, the App asks you to approve a disclosure explaining this data flow. You can review it again at any time from the assistant screen.

AI configuration helpers: Some setup features send small samples of data to Amazon Bedrock to make configuration easier. For example, importing a spreadsheet may send the sheet name, column headers, and a sample of rows to suggest column types, and creating a data source may send its name and field labels to suggest a color scheme or default settings. The same protections apply: no model training, no advertising, no sale of your data.

Remote MCP connections (upcoming feature): We are developing connections that let an MCP client or agent access the DayDash information you choose. You approve each connection and its scope before it receives access. That scope determines what it can read, modify, or delete, and can cover later additions when you share a whole data source or all shareable data.

A DayDash-managed server on AWS will use the connection’s own key to decrypt shared data in memory and answer requests. The connected client receives the results and, depending on its configuration, may send them to an AI provider or other services. This flow is separate from our Amazon Bedrock assistant; external recipients handle results under their own policies and your settings.

You will be able to revoke a connection in the App to stop future access through DayDash. Revocation cannot erase information already received or copied.

Deleting AI conversations: You can delete any conversation in the App at any time. Deleting your account deletes all of your conversations. See Section 8 for retention details.

For a plain-language walkthrough of DayDash encryption and the AI data flow, see How DayDash Protects Your Data.

6. Data Security

We use reasonable administrative, technical, and physical safeguards to protect your information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have specific rights regarding your personal information under laws such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Your rights include:

Right to Access: You have the right to request copies of your personal data.
Right to Rectification: You have the right to request that we correct inaccurate information or complete incomplete information.
Right to Erasure (Right to be Forgotten): You have the right to request that we erase your personal data under certain conditions.
Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data.
Right to Object to Processing: You have the right to object to our processing of your personal data.
Right to Data Portability: You have the right to request that we transfer your data to another organization or directly to you.

California Residents (CCPA/CPRA):

Health data collected through Apple Health and Health Connect is classified as sensitive personal information under the California Consumer Privacy Act.
Do Not Sell or Share: We do not sell or share your personal information, including health data, with third parties for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of sensitive personal information to only what is necessary to provide the DayDash service.
To exercise any CCPA rights, contact us at support@daydash.io or use the account management features within the App.

Managing Your Choices:

Access & Update: You can update or delete your account information directly within the App settings or through the account management portal.
Opt-Out: You may opt out of receiving promotional communications by following the unsubscribe instructions in those messages.
Health Data Permissions: You can manage or revoke health data permissions through your device settings (iOS: Settings > Privacy & Security > Health; Android: Settings > Health Connect > App permissions).
Other Permissions: You can manage or revoke other app permissions (such as notifications) through your device settings.

To exercise any of these rights, please contact us at support@daydash.io. We will respond to your request within the timeframes required by applicable law.

8. Data Retention Policy

We retain your personal information and synchronized third-party data only for as long as is necessary for the purposes set out in this Privacy Policy.

Account Data: We retain your account information (such as email and preferences) for as long as your account is active.
Synchronized Data: Data synced from third-party integrations (such as YNAB, Apple Health, or Health Connect) is retained until you explicitly delete the specific data source or delete your account. Disabling an integration stops new data synchronization but preserves your existing historical data for analysis until you choose to delete it.
AI Assistant Conversations: Conversations are retained, encrypted, until you delete the individual conversation or your account. AI usage records (such as token counts and computed cost, with no message or data content) are retained to enforce usage allowances and prevent abuse, and may be retained as aggregate, contentless records after account deletion.
Legal Obligations: We may retain certain information for longer periods if required to do so for legal compliance or dispute resolution.

Account Deletion: Our account-deletion process removes the following data from our active systems, subject to the retention exceptions below:

All health data synced from Apple Health and Health Connect
All financial data synced from connected services
All AI assistant conversations
All dashboards, data sources, and configuration
All access credentials and device registrations
All stored files and encryption keys

Account deletion begins immediately once the following subscription requirement is met. If you have a subscription purchased through the Apple App Store or Google Play that is still set to auto-renew, you must cancel its auto-renewal (through your Apple or Google account) before account deletion can proceed — this prevents you from continuing to be billed for a deleted account. Deleted data may persist in routine encrypted backups of our systems for a limited period before those backups expire; we do not use backups to restore deleted user data except as required for disaster recovery or legal compliance. To delete your account, use the account management portal accessible from within the App, or contact us at support@daydash.io.

9. International Data Transfers

DayDash is operated in the United States. Your information may be processed in the United States and other countries where the service providers and external tools described in this policy operate.

To ensure your data is protected during these transfers, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (or equivalent mechanisms for the UK/Swiss jurisdictions). These legal safeguards ensure that your data receives an equivalent level of protection to that provided by local data protection laws.

10. Children’s Privacy

The App is not directed to children under 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we learn we have done so, we will delete such information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by updating the “Last Updated” date and, if material, by providing additional notice (such as through the App or email).

Before accessing a type of YNAB data not previously disclosed, or using YNAB data in a new way outside what you previously authorized, we will update this policy and ask for your consent before that access or use. This can happen when you choose or approve the feature that introduces the new use; a policy-update notice alone does not replace consent.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Axil LLC

11801 Domain Blvd 3rd Fl Austin, TX 78758

support@daydash.io