Daily Privacy Policy

1. At a glance

• If you use Daily without signing in, your notes, events and alarms stay on your device and are not sent to us.
• If you sign in, we store your email address and the content you save on our server so it can sync across your devices.
• We don't use advertising or analytics tools. We don't track you, and we don't sell your personal information.
• Notifications and alarms, and widgets, are handled entirely on your device.
• You can delete your account and everything in it at any time under Settings › Delete Account.

2. Why we handle personal information

• To create your account, sign you in and confirm it's you
• To store your notes, events, alarms and settings and sync them across your devices
• To sync events with a Google Calendar you choose to connect
• To keep the service secure, for example by blocking excessive sign-in attempts
• To answer inquiries and handle disputes related to account deletion

3. What we collect

We store information on our server only for signed-in users. "Required" items are needed to sign in and sync. "Optional" items are handled only if you turn the feature on.

• [Required] Sign in with Google: your email address and the account identifier issued by Google. We don't receive your name or profile photo. (How: provided by Google when you approve the Google sign-in screen)
• [Required] Sign in with Apple (iPhone app): the account identifier issued by Apple and your email address (the private relay address created by Apple if you choose Hide My Email). We don't receive your name. (How: provided by Apple's sign-in screen)
• [Required] Content you save: notes (title, body, labels, pinned state, reminder settings), events (title, description, date and time, repeat rules, completion marks, linked notes, alert settings), alarms (name, time, days, sound choice) and settings (week start, default alerts, label list, display language). (How: entered by you) To sync your devices, we also keep a change history of this content on our server. (Generated automatically)
• [Required] Sign-in and device records: sign-in session records, a device registration ID created by the service, when the device was registered and last connected, and per-device records of whether alerts and alarms were applied (status and error code). We don't collect your device's name or model, or any advertising identifier. (How: generated automatically as you use the service)
• [Required] Sign-in attempt records: IP address and time, used only to block excessive sign-in attempts. (Generated automatically)
• [Optional] Google Calendar connection: the account identifier and access tokens issued by Google; the name, time zone and ID of the calendar you choose; that calendar's events (title, description, start and end time, repeat rules, link to the event in Google Calendar); and sync status. (How: provided by Google when you approve the Google consent screen)

We don't collect government ID numbers, payment details, location, contacts or photos. Whatever you write in notes and events is stored as written, so please use your own judgment about putting sensitive information there.

4. What stays on your device

The following is handled only on your device and is not sent to our server.

• Notes, events and alarms you save without signing in
• Scheduling of notifications and alarms (they are scheduled with iPhone's own notification and alarm features; we don't send push notifications from a server)
• Alarm sound files you add
• Unsaved drafts, display theme and language choice
• Event and alarm details shown in the Home Screen widget and on the Lock Screen
• Saving to Daily from the share sheet (iPhone app): text and links you share from another app are held in a temporary inbox on your iPhone, imported as a note the next time you open Daily, and then the temporary file is deleted. An imported note is handled exactly like a note you write yourself.

When the display language is set to Automatic and your device language is not Korean, English or Japanese, we check your country (a two-letter country code) once to choose a display language. We don't store it on the server.

5. How long we keep it and how we delete it

• We keep the information in section 3 for as long as you have an account.
• Deleting a note moves it to Trash, where you can restore it for 30 days. Notes in Trash and deleted events and alarms are permanently and automatically deleted from our server 30 days after our server receives the deletion (within an hour after the 30 days are up), and can't be recovered after that. If you delete something while your device is offline, the 30 days start when that device next syncs with our server.
• To keep your other devices in sync, we keep a deletion record with no content (the item's ID and the time it was deleted) for as long as you have an account. Titles, text and other content are not kept.
• To sync your devices, we keep a change history for each item on our server, and it may contain content from before you edited it. This history is deleted along with the item 30 days after the item is deleted, and promptly when you delete your account.
• Copies left on a device are deleted when you open the app after the 30 days have passed. On iPhone, this requires updating to the latest version of the app. If you use Daily without signing in, your content is stored only on your device, and deleted items are removed when you open the app once 30 days have passed since you deleted them on that device.
• A sign-in session expires after 180 days without use.
• Sign-in attempt records (IP address and time) are deleted 30 days after they are recorded.
• When you disconnect Google Calendar, we delete the Google access tokens and connection details and ask Google to revoke the tokens. Events already imported into Daily stay in Daily, and events you sent to Google Calendar stay in Google Calendar. If an event you delete in Daily can't be deleted from your connected Google Calendar, it may remain in your Google account, and you will need to delete it in Google Calendar yourself.
• Database backups made before maintenance and releases may still contain information from before it was deleted, including the content of deleted items. Backups are used only for disaster recovery. We keep each backup for 30 days after it is made and delete it at the first server maintenance or release after that. The most recent backup is kept until the next one is made.

6. Deleting your account and your data

1. You can delete your account at any time in the app under Settings › Delete Account.
2. When you delete your account, we promptly delete your notes, events, alarms and settings, sync history, registered devices and sign-in sessions, and your Google Calendar connection (including the access tokens issued by Google). Deleted data can't be recovered.
3. Events you exported to Google Calendar are stored in your Google account and remain there after you delete your Daily account. Delete them in Google Calendar if you no longer want them.
4. When you delete your account, we ask Google and Apple to revoke the sign-in and connection tokens we received.

7. Information we keep after account deletion

To prevent abuse through repeated sign-ups and to handle disputes related to account deletion, we keep the following information about deleted accounts separately.

• What we keep: email address, sign-in provider (Google or Apple), the account identifier issued by that provider, sign-up date, and deletion date
• How long: 90 days from the deletion date
• How we keep it: encrypted and stored separately from other account data, and used only for the purposes above.
• Deletion: after the retention period, we delete it without delay in a way that can't be recovered.
• Signing up again: if you sign up again with the same Google or Apple account during this period, a new account is created. Data you saved before deletion is not restored.

8. Sharing, service providers and transfers abroad

We don't sell your personal information or provide it to third parties, except where the law requires it. We use the following providers to run the service.

• Amazon Web Services, Inc.: hosts our server and database (Amazon Lightsail). The data is in the AWS Seoul Region, so it is stored in the Republic of Korea.
• Vercel Inc. (United States): hosts and delivers the web app and forwards requests from the web app to our server. When you use Daily on the web, the content you send and receive and your connection details (IP address, browser type, time of request) pass through Vercel's network, which includes locations outside Korea. Sync requests from the iPhone app go directly to our server.

Depending on the features you choose, information is exchanged with the following companies.

• Google LLC (United States): verifies your sign-in when you sign in with Google. If you connect Google Calendar, we send event titles, descriptions, start and end times, all-day status, time zones and repeat rules to the calendar you choose. This stops when you disconnect.
• Apple Inc. (United States): verifies your sign-in when you sign in with Apple. The app is distributed through the App Store and TestFlight.

9. How we use Google user data

Connecting Google Calendar is optional. We use only the access you grant on the Google consent screen (seeing your calendar list, and viewing and editing events).

• Purpose: only to show events from the one calendar you choose in Daily, and to apply events you create or edit in Daily to that calendar.
• What we read: your calendar list, and events in the calendar you choose (title, description, start and end time, repeat rules, link).
• What we write: event title, description, start and end time, all-day status, time zone and repeat rules. We don't send notes, alarms or alert settings to Google, and we don't change attendees, locations or video meeting details.
• We don't use Google user data for advertising, we don't sell it or provide it to third parties, and we don't use it to develop or train artificial intelligence models.
• Our staff don't read your Google Calendar data, except with your consent when you ask us for help, to investigate a security incident, or to comply with the law.
• Google access tokens and calendar IDs are stored encrypted on our server and deleted when you disconnect or delete your account.

Daily's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Cookies and browser storage

• On the web we use only the cookies needed to keep you signed in: daily_access (15 minutes), daily_refresh (180 days), and daily_google_login_flow (10 minutes, while you sign in). None of them can be read by JavaScript, and they are sent only over HTTPS. There are no advertising or analytics cookies.
• Browser storage (IndexedDB and localStorage) holds your device's copy of your notes, events and alarms, unsaved drafts, theme and language choice. Clearing the site's data in your browser removes it. If you block cookies, you won't be able to sign in.
• The iPhone app keeps your sign-in credentials in the iOS Keychain.

11. Your rights and choices

• Access and correction: you can view and edit your notes, events, alarms and settings in the app and on the web at any time.
• Deletion: delete your account and everything in it under Settings › Delete Account. If you can't sign in, email contact@egoist.kr from the address you signed up with.
• Disconnecting: in Settings you can disconnect Google Calendar or sign out of all devices. You can also remove Daily's access in your Google Account security settings.
• For any other request to access, correct, delete or stop the processing of your information, or to withdraw consent, email contact@egoist.kr. We will act on it without delay. A legal representative or someone you authorise may make the request for you.

12. Children

Daily is not intended for children under 14, and we don't knowingly collect their personal information. If we learn that a child under that age has created an account, we will delete the account and its information without delay.

13. How we protect it

• Encryption in transit: the app and the web app talk to our server only over HTTPS.
• Encryption at rest for sensitive items: tokens issued by Google and Apple, calendar IDs and the identifying information of deleted accounts are stored encrypted. For sign-in session tokens, the server stores only a hash.
• Access control: the database sits on an internal network that is not exposed to the internet, and server access is limited to the people who operate the service.
• Web sign-in cookies can't be read by JavaScript, and requests are checked against cross-site request forgery.

14. Privacy officer

Chanseop Shin, CEO · contact@egoist.kr

15. Getting help

If you need help with a privacy concern, you can also contact:

• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

16. Company details and changes

Egoist · CEO Chanseop Shin · Business registration No. 136-10-85966 · SW Startup Room 3, Knowledge Bunker, B1, Engineering Building 5, 55 Hanyangdaehak-ro, Sangnok-gu, Ansan-si, Gyeonggi-do, Republic of Korea · contact@egoist.kr

This policy takes effect on October 14, 2026. If we change it, we will post the new version on this page with its effective date. For important changes, such as collecting more information or using it for new purposes, we will give notice at least 7 days before the change takes effect.