DayToDay
DayToDay privacy policy
Last updated:
Your data stays on your phone. Here are the exceptions.
Who we are
DayToDay is made by Francisco Simão Perez, trading as BakudanLabs, in Portugal. For anything about this policy or your data, write to bakudanlabs@gmail.com.
In short
DayToDay has no account and works offline. What you log stays on your phone, and we can’t see it. Only three things ever leave it:
- the food you search for and the barcodes you scan, sent to Open Food Facts to look them up;
- crash reports, sent to Sentry so we can fix bugs (you can turn them off);
- your subscription, if you buy DayToDay Plus, handled by Google Play and RevenueCat.
The rest of this policy explains each of these in detail.
What stays on your phone
Everything you log in DayToDay is saved in the app’s private storage on your phone: workouts, routines and cardio, body measurements, progress photos, foods, meals and eating plans, water, sleep, steps, mood, energy and notes, your goals, and your settings. Progress photos aren’t added to your phone’s gallery.
We don’t have a copy of any of it, and we can’t see it. Nothing you log is sent to us or to anyone else.
Health Connect
If you connect Health Connect (it’s optional), DayToDay reads two things from it:
- your daily step totals;
- your sleep sessions: when each started and ended, its sleep stages, and the name of the app that recorded it.
The first time, it reads the last 30 days. After that, each time the app opens it reads the last few days again, to pick up anything recorded late. DayToDay only reads: it never writes to Health Connect.
What it reads is saved on your phone like the rest of your log, and is used only to show your steps and sleep in DayToDay. It is never sent anywhere, never used for advertising, and never sold or shared. Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements.
You can stop DayToDay’s access at any time in Health Connect’s settings, which DayToDay’s Settings → Health Connect opens for you.
Camera
DayToDay uses the camera only when you scan a food barcode or take a progress photo. The camera image is processed on your phone. DayToDay never uses the microphone.
Food search and barcodes (Open Food Facts)
When you search for a food or scan a barcode, DayToDay sends the words you typed, or the barcode, to Open Food Facts, a non-profit association in France that runs an open food database. The request also carries DayToDay’s name, its version, and the language the app is in (so the results come back in your language). Like any website, Open Food Facts can see your phone’s IP address.
Nothing else is sent: not your log, your health data, or anything that identifies you. A food you save is kept on your phone, so you can log it again without asking Open Food Facts. Open Food Facts’ own privacy policy is at world.openfoodfacts.org/privacy.
Crash reports (Sentry)
When DayToDay crashes or hits an error, it sends a report to Sentry (Functional Software, Inc.), a crash-reporting service, in its European data region. What a report contains depends on where the problem happened.
Most errors happen in DayToDay’s own code. Their reports contain:
- the error, and where in DayToDay’s code it happened;
- DayToDay’s version;
- your phone’s Android version and model.
Before one of these is sent, DayToDay removes everything else Sentry would normally collect: no user details, no record of what you did beforehand, no network requests, no screenshots, and nothing you logged.
A crash in the Android part of the app is rarer. Its report is put together by Sentry’s Android library, and DayToDay can’t remove anything from it. Besides the error, where it happened and the versions above, it contains:
- a random ID that Sentry’s library creates for this installation of DayToDay. It isn’t linked to your name, your Google account or your phone’s advertising ID, and it changes if you reinstall the app;
- technical details about your phone: its maker, model and processor type, its screen size and orientation, when it was last restarted, its time zone, its memory, storage and battery level, whether it’s online, and whether it’s a real phone or an emulator.
It doesn’t contain anything you logged, a record of what you did beforehand, or screenshots.
For every report, Sentry doesn’t store your IP address, but it works out an approximate location (a town) from the connection and adds it to the report.
Crash reports are on by default, and you can turn them off in Settings → Data → Send crash reports. From then on, nothing more is sent. Sentry keeps each report for up to 90 days, then deletes it.
Subscriptions (Google Play and RevenueCat)
DayToDay Plus is an optional subscription. If you buy it:
- Google Play handles the payment. DayToDay never sees your card or payment details.
- RevenueCat (RevenueCat, Inc., USA), a service that checks purchases for us, receives an anonymous ID that DayToDay creates for your phone, the details of your purchase (the product, its price, currency and country, when it was bought and when it renews or ends, and Google Play’s purchase token), and basic information about the app and your phone. It uses these only to confirm your purchase and unlock Plus.
No health data, food data or anything else you log is ever sent to RevenueCat.
RevenueCat stores this information in the USA. The transfer is covered by the European Commission’s standard contractual clauses, in RevenueCat’s data processing agreement with us. It’s kept for as long as DayToDay uses RevenueCat, unless you ask us to delete it sooner.
Notifications
The workout and rest notifications are created on your phone. Nothing about them is sent to a server.
Files you create
When you export a backup, share a plan or send a progress report, the file goes only where you choose to send or save it. Backups are encrypted with the password you choose. We never receive these files.
What we don’t do
DayToDay has no ads and no analytics. We don’t sell your data, share it for advertising, or build a profile of you. There’s no account to create.
The legal basis (GDPR)
- Food lookups and subscriptions: to provide what you ask for (looking up a food you searched for or scanned; the subscription you bought).
- Crash reports: our legitimate interest in finding and fixing bugs, with the switch to turn them off.
- Health Connect: your permission, given in Android’s Health Connect screen, which you can take back at any time.
How long it’s kept, and deleting it
- On your phone: until you delete it in the app, or uninstall DayToDay (Android then deletes the app’s data). Backup files you saved stay wherever you put them, until you delete them.
- Sentry: up to 90 days.
- RevenueCat: as described above.
To have anything held by Sentry or RevenueCat deleted, write to bakudanlabs@gmail.com.
Your rights
Under the GDPR, you can ask to see the personal data we hold about you, to correct it, to delete it, to limit how it’s used, to object to its use, or to receive a copy of it. Write to bakudanlabs@gmail.com. Because DayToDay keeps your log on your phone, most of what it knows about you is already in your hands.
You can also complain to Portugal’s data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt, or to the authority where you live.
Children
DayToDay is meant for adults (18 and over) and isn’t directed at children.
Changes to this policy
When this policy changes, the date at the top changes too. The version on this page is always the current one.
Contact
Francisco Simão Perez (BakudanLabs): bakudanlabs@gmail.com. More about BakudanLabs at bakudanlabs.com.