Privacy Policy

1. Overview and Architecture

DayUp ("we", "our", or "the App") is a personal journaling and reflection application for iOS developed by Shamil Rakhimov (Bundle Identifier: dev.rakhimov.Vizort). DayUp is designed to help you record daily wins, track life balance with the Life Wheel, and optionally receive AI-powered insights.

We believe in privacy by design. The vast majority of your data is stored exclusively on your device. Remote data processing occurs only for specific, user-initiated actions as clearly described below.

2. What We Do NOT Collect

To be completely transparent, DayUp does not collect or access the following:

• Geolocation: We do not request, collect, track, or access your device's physical or GPS location under any circumstances.
• Contacts & Address Book: We do not access your contacts list.
• Photos & Camera: We do not access your device's camera or photo library.
• Microphone & Audio: We do not record or access your microphone.
• Health & Fitness Data: We do not connect to Apple HealthKit or collect fitness sensor data.
• Advertising Identifiers & Trackers: We do not use the Identifier for Advertisers (IDFA), advertising frameworks, or cross-app tracking.
• Sale of Personal Data: We never sell, rent, lease, or monetize your personal information to third parties.

3. Local Data Storage (On-Device)

The core features of DayUp function offline. The following information is stored strictly on your local device within the secure iOS application sandbox:

• Efforts (Wins & Accomplishments): The text content, category tag, assigned date, and creation timestamp are saved locally using Apple SwiftData.
• Life Wheel: The assessment date, custom area/item names, and chosen satisfaction levels (1 to 5) are saved locally using Apple SwiftData.
• Latest AI Report: The response of your most recent successfully generated AI report is cached locally in your device's Application Support directory for offline viewing.
• Passcode & Biometrics Preference: Your optional 4-digit passcode, biometrics toggle, and reminder state are saved locally in UserDefaults.
• Daily Reminder Time: The selected time for local reminders is saved in UserDefaults.

This local data is not automatically uploaded to our servers or any cloud database.

4. Product Telemetry and Analytics

In release builds, DayUp transmits product telemetry and crash analytics through Firebase Analytics (Google) and AppMetrica (Yandex). This data helps us monitor app stability, fix crashes, and understand aggregate feature usage.

What analytics receives:

• App state: App launches, first-time launch indicator, passcode lock state, supported app version checks.
• Navigation: Selected tab in the navigation bar.
• Actions: Creation, editing (which field was edited, e.g., content, tag, or date), and deletion of efforts; creation of category tags; opening and saving Life Wheels; settings screen views; export button taps.
• Volume count buckets: Coarse numerical ranges for totals (e.g., 0, 1, 2_5, 6_20, 21_50, 51_plus) for efforts, active days, tags, and Life Wheels.
• Subscription & Paywall: Paywall views, paywall dismissals, purchase completion events, subscription status changes, paid feature lock prompts.
• Reminders & Security: Reminder enabled/disabled events, configured reminder time string, notification permission prompt results, PIN creation/deletion, biometrics enabled/disabled.
• Data deletion events: Initiation, cancellation, completion, or failure of the in-app data deletion action.

5. AI Report Processing (DayUp Plus)

DayUp Plus subscribers have access to the AI Report feature. This feature provides structured psychological and personal growth insights by analyzing your recorded efforts and Life Wheel assessments.

Key principles of AI Report:

• Triggered only by explicit action: The app transmits your data only when you explicitly tap the "Generate AI Report" button. There is no automatic background processing.
• Data transmitted to our backend: When you generate a report, the iOS app sends a request to our Firebase Cloud Function (located in the europe-west1 region) containing:
  • Client context: app version, platform (ios), locale, timezone, generation timestamp.
  • Subscription proof: Apple StoreKit 2 cryptographically signed transaction JWS to verify active DayUp Plus subscription.
  • All recorded efforts: text content, category tag, and date.
  • All recorded Life Wheels: date, area/item names, and levels (1–5).
• Backend validation: The Cloud Function verifies authentication (anonymous Firebase Auth), App Check token integrity, active DayUp Plus subscription, payload size limits (maximum 256 KB, max 500 efforts, max 50 wheels, max 10 items per wheel, character length limits), and a 7-day rate-limit interval.
• Third-party AI processing (OpenAI): The backend builds a structured prompt and user data summary and transmits it to OpenAI via the OpenAI Responses API with strict JSON schema formatting. OpenAI processes this text solely to return the report sections (Main insight, Strong directions, Areas to watch, Mismatches, Weekly focus).

6. What the Backend Stores & Server Logging

Our serverless backend follows strict data minimization:

• Firestore Rate-Limit Metadata: In Cloud Firestore, the server stores only rate-limiting metadata in the collection ai_report_limits/{uid} with the following fields:
  • last_generated_at (timestamp)
  • next_available_at (timestamp)
  • generation_count (counter)
  • updated_at (timestamp)
• No Content Storage: The backend does not store your raw efforts, Life Wheels, compiled prompts, OpenAI AI-generated responses, or raw App Store JWS tokens in any database.
• Server Runtime Logs: Cloud Function execution logs record operational metadata only (anonymous Firebase UID, count of efforts and wheels, locale, schema version, platform, app version, subscription product ID, subscription expiration date, and a SHA-256 hash of the transaction ID). User text content and prompts are never written to logs.

7. Anonymous Firebase Authentication

To authorize requests to the AI Report backend without requiring personal credentials, DayUp uses Firebase Authentication's anonymous sign-in (signInAnonymously).

This generates a random, pseudonymous identifier (UID). It is not linked to your name, email address, phone number, social accounts, or Apple ID.

8. Subscriptions and Payments (StoreKit 2)

DayUp offers optional auto-renewable subscriptions under the DayUp Plus plan (monthly: dayup_plus_1m, quarterly: dayup_plus_3m, yearly: dayup_plus_1y; Subscription Group: 21868960).

All payments and subscriptions are processed exclusively by Apple through StoreKit 2. We do not collect, process, or store your credit card details, bank account numbers, or billing addresses.

9. Notifications and Reminders

If you enable the daily reminder, notifications are scheduled locally via the iOS UserNotifications framework (UNUserNotificationCenter). Your reminder schedule is configured and executed entirely on your device and is not sent to our servers.

10. Passcode and Biometrics

You can protect access to DayUp with an optional 4-digit passcode and biometrics (Face ID or Touch ID):

• Your passcode is stored locally in UserDefaults on your device.
• Biometric authentication is handled directly by the iOS operating system via Apple's LocalAuthentication framework and Secure Enclave. DayUp never has access to your biometric facial or fingerprint data.

11. Data Export

DayUp Plus users can export their efforts and Life Wheel assessments into JSON format. The JSON file is generated locally in your device's temporary folder and shared through the standard iOS Share Sheet. DayUp does not upload or copy exported files to any remote server; you decide where to save or send your file.

12. Deleting Your Data ("Delete All Data")

In the Settings screen, you can tap Delete all data to permanently erase your data:

• This action immediately and irreversibly deletes all local SwiftData efforts, all Life Wheel records, and the cached AI report from your device.
• Server rate-limit metadata disclosure: The in-app button clears local device data. The server-side rate-limit document (ai_report_limits/{uid} in Firestore, which contains rate-limit timestamps and no journal text) is not automatically removed by this in-app action. If you wish to delete your server-side rate-limit record, you may request deletion by emailing us at rakhimov.dev@gmail.com.

13. Third-Party Service Providers

We work with trusted third-party providers to deliver app functionality:

14. Free-Form Text and User Responsibility

DayUp provides open text fields for recording efforts and category tags. The app does not ask for sensitive categories (such as health, financial, political, or biometric records). However, because these fields are free-form, any information you write will be included in the AI Report payload if you choose to generate an AI Report.

We advise you to be mindful of the information you record if you plan to use the AI Report feature.

15. Children's Privacy

DayUp is not directed to children under 13 years of age (or under 16 in the European Economic Area). We do not knowingly collect or solicit personal information from children.

16. Your Rights and Data Control

Depending on your jurisdiction (such as under the GDPR or CCPA/CPRA), you have rights regarding your personal information, including:

• Access and Portability: You can export your data at any time in JSON format from the Settings screen.
• Erasure: You can erase your local data using the "Delete all data" feature in Settings, or request deletion of server-side rate-limit records via email.
• Withdrawal of Consent: You can stop using AI Report at any time; your data is never sent to AI providers unless you tap the generate button.

17. Contact Us

If you have any questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact: