Privacy policy

Overview

This policy explains what personal information Dayleaf (“we”) collects, how it is used, where it is kept, who it is shared with, how long it is kept, and what your rights are. We collect only what the service needs, never sell personal information, and have no ads or third-party analytics on the site.

What we collect

• Your account: the email you log in with; if you signed up with an email and a password, a salted hash of the password (never the password itself); if you log in with Google or Apple, the user identifier they give us and the email and name they share.
• Your journal: the pages you save to your account, with their words, title, date, place, layout, ink colour and photos. Photos are scaled down in your browser before upload, which also removes details stored in the file such as where it was taken.
• Membership and credits: your plan, subscription status and renewal date, the customer number Stripe assigned you, and the record of credits given and used.
• Community: the journals you share and the reports you make (the reason and any note).
• Security records: to stop password guessing and abuse, we briefly record the IP address and account behind logins and code requests; server logs also record the IP address and time of each visit.

What we do not collect

• Anything you have not saved. While you try it out on the home page, or before you press Save in the editor, your words and photos are kept only as a draft in your own browser’s storage and are not uploaded.
• Card details. The payment page is hosted by Stripe; card numbers never pass through our servers.

How we use it

• To provide the service: logging you in, saving and showing your journal, handling the AI requests you make, giving and taking credits, handling subscriptions.
• To send the emails the service needs: login codes, email confirmation, password resets. We do not send marketing email.
• For safety and moderation: preventing abuse, reviewing community shares, handling reports and infringement claims.
• We do not use your journal to train AI models.

Who we share it with

• Stripe, to process payments and subscriptions; it receives your email and payment details.
• Resend, to send login codes and account emails; it receives your email address and the email.
• Google and Apple, only when you choose to log in with them, exchanging what their consent screens show.
• AI providers, only when you use an AI feature: they receive the description you wrote and the words of the page; scaled-down copies of photos are sent only when you choose to let the AI see them.
• Infrastructure: our servers are run by Tencent Cloud (Singapore), art and backups are kept in Volcengine object storage (Hong Kong), and the site is delivered through Cloudflare’s network.
• Journals you share to the community are public. Beyond that, we give information to authorities only when the law requires it.

Where it is kept

Your account and journal are kept on servers in Singapore, and database backups in Hong Kong. If you use the service from mainland China or elsewhere, your information is transferred to these places to be processed. Connections are encrypted (HTTPS); your photos can be seen only by you (and by visitors, if you share a journal with its photos), and our storage is not open to the public.

How long it is kept

• Your account and journal: until you delete them or your account.
• Your login lasts 30 days; codes are valid for 5 minutes; anti-abuse records are normally cleared after a day; server access logs are kept for 14 days.
• Backups: one a day, kept for 14 days. What you delete is gone from the backups within 14 days, as old backups are cleared.
• Payment records are kept by Stripe as the law and accounting rules require; deleting your account does not affect them.

Cookies and local storage

We use only the cookies the service needs: your login (readable only by the server), the interface language you chose, and a short-lived value that protects the sign-in with another provider from forged requests. Drafts you have not saved are kept in your browser’s storage. We use no advertising or tracking cookies.

Your rights

• See and export: you can see what you saved under “My journal” at any time and export it as images.
• Correct and delete: you can change or delete any page (its photos go with it) and stop sharing to the community.
• Delete your account: on the “Membership and credits” page. It deletes at once the account, all its journals and photos, community shares, credits and membership, and cancels the subscription at Stripe.
• Anything else (a copy of your information, withdrawing consent, a complaint): email [email protected], and we will answer within 15 working days.

Children

If you are under 14 (or the higher age set where you live), use the service only with a parent’s or guardian’s consent. If we learn that we collected a child’s personal information without that consent, we delete it as soon as we can.

Changes to this policy

This policy may be updated. Important changes will be posted on this page and announced on the site or by email before they take effect.

Contact

For any question about your personal information, email [email protected].