1. Who is responsible for your data
Dayweave is the controller of personal information processed to provide the Dayweave service. For privacy questions or requests, contact privacy@dayweave.xyz.
2. Information we collect
Account and profile information
We may collect your name, email address, authentication records, timezone, working hours, notification preferences and settings you choose.
Information you create
This includes tasks, projects, reminders, lists, routines, conversations, approved memories and household information you add or share.
Connected-service information
When you connect a service such as Google Calendar, we access only the information covered by the permissions you grant. Calendar information can include calendar names, event titles, descriptions, attendees, locations, availability, recurrence and timezone information. Gmail access, if introduced during the beta, will require separate consent and this policy will be updated before that feature is enabled.
Technical and usage information
We may process device and application identifiers, push-notification tokens, approximate location derived from IP address, diagnostic events, feature usage, security logs and AI usage measurements. We do not intentionally place access tokens, email bodies or private calendar content in analytics logs.
3. How we use information
We use information to provide and secure Dayweave; synchronise authorised accounts; answer questions; prepare briefings; identify conflicts and possible commitments; propose tasks, drafts or calendar actions; deliver notifications; provide support; prevent abuse; and understand operating cost and reliability.
Instructions contained inside connected emails, calendar descriptions or documents are treated as untrusted content—not as authorisation to act.
4. Google user data
Dayweave's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.
- We use Google Calendar data to display schedules, identify availability and conflicts, generate user-facing briefings, and perform calendar changes the user has approved.
- We do not sell Google user data or use it for advertising.
- We do not allow humans to read Google user data except with the user's affirmative agreement for support or security, where required by law, or where aggregated and anonymised for internal operations.
- We do not use Google Workspace data to train general-purpose AI models.
- Connected-account tokens are encrypted at rest and are never embedded in the mobile application.
5. AI processing
Dayweave sends the minimum relevant context to contracted AI service providers to interpret requests, generate summaries and prepare suggestions. AI output is not treated as proof that an external action succeeded. Calendar writes, email sends and other sensitive actions require appropriate authorisation and are performed through provider APIs.
6. Our lawful bases
Where UK GDPR applies, we process information as necessary to provide the service you request, based on your consent for optional connected services, and for legitimate interests such as securing, debugging and improving Dayweave. We may also process information to comply with legal obligations.
7. Sharing and processors
We may use carefully selected providers for hosting, database infrastructure, AI processing, email delivery, notifications, error monitoring and customer support. They process information under contract on our behalf. We may disclose information when legally required or during a business reorganisation subject to appropriate safeguards. Household members receive only information deliberately placed in shared household areas; connecting a household does not expose private work data, email, calendar details or AI memory.
8. Storage, international transfers and retention
Our providers may process information outside the United Kingdom. Where required, we rely on recognised transfer safeguards. We retain account information while your account is active and only as long afterwards as needed for security, legal obligations and backup expiry. Connected content is minimised: full provider records should be fetched on demand where practical, while identifiers, summaries and evidence references may be retained to deliver requested features.
9. Security
We use encryption in transit, encrypted connected-account credentials, access controls, audit records and least-privilege provider permissions. No service can guarantee absolute security. Please contact security@dayweave.xyz if you believe your account or information is at risk.
10. Your choices and rights
You can disconnect connected accounts, change which calendars contribute to planning, manage memories and notification preferences, and request access, correction, deletion, restriction, portability or objection where applicable. You may withdraw consent without affecting earlier lawful processing. Contact privacy@dayweave.xyz. You may also complain to the UK Information Commissioner's Office.
11. Deleting data and disconnecting Google
You may disconnect Google from Dayweave. We will revoke access where supported and delete locally held credentials. You can also revoke access through your Google Account security settings. Account-deletion requests can be sent to privacy@dayweave.xyz.
12. Children
Dayweave is not directed to children under 16. Limited-access household membership must be created and managed by an authorised adult.
13. Changes
We will post revisions here and change the effective date. We will provide additional notice when a change materially affects your rights or how connected-service information is used.