Privacy Policy
The short version. Daylish keeps your diary on your phone and backs it up to your account so it survives a lost phone. The account holds an email address and that backup, and nothing else. There is no advertising, no analytics, no crash reporting and no tracking of any kind. We do not sell personal data and we never will.
1. Who we are
Daylish is operated by Alexandru Mario Ionescu, an individual developer, acting as the data controller for the information described here. Contact for any privacy question or request: alexionescu870@gmail.com.
2. What we collect
Your account
An email address and a password, which are required to use the app. Passwords are handled by our authentication provider and are stored only as a salted hash — we never see or store your password in plain text.
Your diary
Everything you log is written to a database on your phone. It is also copied to your account so it can be restored if you lose or replace the device. The following is what is copied:
| What | Contains |
|---|---|
| Profile | Height, date of birth, sex, activity level, dietary preferences, allergens, and the kitchen equipment you told us you own |
| Goals and targets | Your goal, and the calorie and macronutrient targets derived from it |
| Journal | The foods and portions you logged, with dates and meal slots |
| Weight | Weigh-ins and their dates |
| Water | Water logged, and when |
| Fasting | Fasting sessions, their protocol, start and end |
| Mood | Any mood entries you record alongside a day |
| Saved meals | Meal combinations you saved to re-log later |
| Recipe activity | Which recipes you saved, cooked or put on a shopping list, stored as a recipe reference rather than a copy of the recipe |
| Shopping list | The recipes on your list and which items you have ticked off |
This is health-related information — what you eat, what you weigh, when you fast — and it is linked to your account. We treat it accordingly and we do not use it for anything except giving it back to you.
One preference deserves naming. The diet filter includes halal and kosher alongside options like keto and vegan. You may choose either for reasons that have nothing to do with religion, but a choice like that can reveal a religious observance — which UK and EU law treats as a special category of personal data. It is stored and backed up exactly like the rest of your profile, used only to filter recipes, never inferred from, and never shared. If you would rather it did not leave your phone, choose a different filter and use the allergen and disliked-ingredient lists instead, which achieve much the same exclusions without the inference.
Notification token
If, and only if, you turn on reminders or complete a purchase, your device's push notification token is stored against your account. It is used for one purpose: telling you if a payment problem is about to end your subscription. It is not used for marketing, and Daylish sends no promotional notifications at all.
Every other reminder — meal nudges, the evening "what is left" summary, the weigh-in prompt and the fasting window alarm — is scheduled by your phone from data already on your phone. Those never reach a server, and we cannot see them.
Subscriptions
If you buy Premium, the purchase is made through Apple. We never see your payment details. Our subscription provider records that your account has an active entitlement, along with the purchase and renewal events Apple reports.
What we deliberately do not collect
- No advertising identifiers, and no advertising.
- No usage analytics. There is no analytics SDK in the app, and nothing records which screens you open, what you tap or how long you stay. One exception, stated plainly: our subscription provider reports on purchases and renewals in aggregate — how many people subscribed, how many cancelled. That is analysis of billing events, not of your behaviour in the app, and it is why the App Store privacy card lists "Analytics" against Purchases and against nothing else.
- No crash reporting SDK.
- No location data.
- No contacts, no photo library access, and no microphone access.
- No tracking of you across other companies' apps or websites, which is why Daylish never shows the App Tracking Transparency prompt.
The camera is used only to read a barcode, in the moment you open the scanner. Camera frames are processed on the device and are never uploaded, stored or transmitted.
3. Why we hold it
| Purpose | Data | Legal basis (UK/EU GDPR) |
|---|---|---|
| Signing you in and keeping your account | Email address, password hash | Performance of a contract |
| Backing up and restoring your diary | Your diary, as listed above | Performance of a contract, and your explicit consent under Article 9 for the special-category parts, given by creating an account and using the app to record them |
| Telling you about a billing problem | Push token, subscription status | Performance of a contract |
| Providing Premium features you paid for | Subscription status | Performance of a contract |
| Looking up a food you asked for | A barcode or a search term | Legitimate interests, in providing the feature you invoked |
You can withdraw consent at any time by deleting your account, which removes the data rather than merely stopping its use.
4. Who else touches it
We use a small number of providers, each doing one job. None of them are permitted to use your data for their own purposes.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Authentication, database and hosting for your account backup | Your email address and your diary backup |
| RevenueCat | Subscription and purchase management | Your account identifier and your purchase events |
| Apple | App Store payments and push notification delivery | Payment details, which we never see, and the notification itself |
| Expo | Relays our push notifications to Apple | Your push token and the message text |
| Open Food Facts | Barcode and packaged food lookups | The barcode or search term only. No account, no identifier and no diary content is attached. |
| USDA FoodData Central | Whole food nutrition lookups | The search term only, sent via our own server so your device is not exposed to them. No account or identifier is attached. |
| Railway | Hosts this website | Ordinary web server logs for these pages. The app does not talk to it. |
We may also disclose information if we are legally required to. We will not do so voluntarily.
5. Where it is held
Our providers operate internationally, so your data may be processed outside your country, including in the United States. Where transfers from the UK or EEA occur, they rely on the providers' standard contractual clauses.
6. How long we keep it
- Your account and diary backup: for as long as your account exists. Deleting your account removes them.
- Your push token: until you turn reminders off, delete your account, or uninstall the app and the token expires.
- Purchase records: retained by Apple and our subscription provider for as long as required by tax and accounting law, which is outside our control.
- The copy on your phone: stays on your phone until you delete the app, reset your data in the app, or delete your account. Signing out does not delete it — your diary is still there when you sign back in.
7. Your rights
Depending on where you live, you have the right to access, correct, export, restrict, object to, or delete the information we hold about you. Two of these are built into the app and need no request:
- Export. You → Export writes your entire diary to a JSON file. It is free on every tier.
- Deletion. You → Delete my account removes your account and your data immediately. See deleting your account.
For anything else, email alexionescu870@gmail.com. We aim to acknowledge within two business days and to respond fully within one month. If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.
8. Children
Daylish is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
9. Security
Data is encrypted in transit. Access to your rows in our database is enforced at the database level, so one account cannot read another's data even if the app were to ask for it. Passwords are stored as hashes. No system is perfect, and we will tell you promptly if a breach affects you.
10. Changes
If this policy changes materially, we will update the effective date at the top and, where the change affects how your data is used, tell you in the app before it takes effect.