Privacy Policy

Who is responsible

DailyProof is operated by Florent Le Pape. For privacy questions, access requests or deletion requests, contact contact@dailyproof.florent-tech.com.

This policy covers the DailyProof app, website and account services. Available features differ by version. You choose which routines to track and whether to share a report or photo. Teams is deferred from the upcoming routines interface; existing team information and the privacy protections described below remain relevant to earlier versions and retained records.

Information we process

• Account and profile: your account identifier, account creation date, email address, sign-in provider, display name, optional bio and optional profile photo. Apple sign-in can use a private relay email address. Password authentication is handled by Firebase Authentication; we cannot read your password.
• Habits and progress: habit names, categories, schedules, reminder preferences, completion dates, numeric results and the history used to calculate streaks, levels and reports. Habit entries can contain health or fitness information if you choose to enter it. DailyProof does not connect to Apple Health or Health Connect.
• App setup answers depend on the version: routine goal, motivation, previous experience, obstacles and available time. These are stored with your app account and help suggest habits. Earlier versions can also store a gender answer, including Prefer not to say; gender is not used to rank suggestions. The separate website quiz is described below.
• Teams: membership, roles, programme schedules, shared completion activity, optional team photos and notification preferences.
• Community safety: the version and date of your agreement to the team community rules; your private blocked-member list, including a member identifier and name saved when you block them; reports you send, including the team and reported content identifiers, reason, optional explanation and review status; and photo-review requests, the image version reviewed and its decision. We do not copy a reported photo into a report. A short-lived, pseudonymous daily counter limits abuse of reporting.
• Subscriptions: purchase history, transaction references and subscription access linked to your account through RevenueCat. To preserve existing-account access and verify paid access, the service can record the account creation date, access cohort, verification time and expiry. Clients cannot assign their own verified access. Stripe processes payment details for website purchases when available; Apple and Google process native purchases. DailyProof does not receive your full card details.
• Technical and support information: push tokens when notifications are enabled, device and authentication information processed by our service providers, and information you send when contacting support.

Why we use this information

We use account information and the content you provide to operate your account, save your habits, calculate your progress, provide team features and restore subscription access. We use technical information to secure the service, resolve faults and respond to support requests. Community safety information helps apply your blocks, review reports and protect the reporting service from abuse. RevenueCat also processes purchase information for subscription analytics.

Where applicable, processing needed to provide the service is based on our contract with you. Security and essential support rely on our legitimate interests in operating a reliable service. Optional notifications, photos and any processing that requires consent depend on your choices or consent. Legal obligations can require us or our providers to retain transaction records. You can contact us about a particular processing activity or exercise your rights below.

DailyProof does not sell your personal data. The updated app has no advertising SDK or cross-app advertising tracking and does not use Firebase Analytics or Sentry. App usage analytics differ by version and configuration, as described below. Infrastructure providers may still keep service and security logs.

Earlier DailyProof releases integrated Sentry for crash and performance diagnostics, technical device and connection information, and session replay. If you continue using an older release, its diagnostics may continue until you update. Sentry's privacy information is available at https://sentry.io/privacy/. Contact us about access or deletion of information associated with an older release.

App usage analytics by version

Earlier versions that offer optional usage analytics ask for a choice and provide a Profile setting; PostHog collection in those versions starts only after agreement. In the planned 2.1.0 release, usage analytics are enabled by default when the service is configured, after reading any existing account preference saved on that device. That release does not present an analytics prompt or setting. Previously recorded refusals remain respected for that account on that device. The currently published 2.0.0 build 34 does not include this later change.

When collection is enabled for the version and account, PostHog receives a pseudonymous account identifier, app and platform version, and limited events such as setup steps, confirmed habit completions, sharing outcomes, and subscription offer or purchase outcomes. Completion dates and broad event types help measure return visits. We do not send your email, display name, habit names, numeric habit results, setup answers, team names, photos or free-text error messages to this service.

This integration uses PostHog's EU Cloud region, disables geolocation enrichment and session recording, and does not automatically record touches or screen contents. Network providers still process connection information needed to deliver requests. PostHog explains its processing at https://posthog.com/privacy.

For versions where analytics depend on consent, withdrawing that consent stops future collection from that device. A refusal or account deletion does not automatically erase events already sent to PostHog. You can request access or deletion, object where applicable, or ask about retention at contact@dailyproof.florent-tech.com. These analytics are separate from store transaction records. Configuration, version and inherited preferences affect which accounts are observed; the data does not represent every user.

What other people can see

Your personal habits are associated with your account. In a team, other members can see the shared programme, member names and photos, and current-day shared results. Team admins can access collective historical results. Public starter-pack discovery shows the programme without exposing the member roster or individual activity.

You control whether your team completion events can generate notifications to other members. Turning that option off does not remove results needed to show the team's shared progress.

Sharing a report or proof photo is optional and opens your device's sharing flow. The people or services you choose receive the exported image and any profile or progress information shown on it. Copies you send outside DailyProof remain under the recipient's control.

Community safety and reports

In versions with community safety controls, you review the team community rules before uploading a profile photo or contributing to Teams. Uploading a personal profile photo does not by itself join a team or publish your profile to one. You can report a team, member or shared commitment from its safety options. Reports are private to you and the DailyProof operator; they are not shown to the reported member or the team. The operator can inspect the relevant shared content to investigate and respond. Do not include passwords or unrelated sensitive information in a report.

Shared names, descriptions and commitment text pass a server-side publication filter. Photos must be reviewed by the DailyProof operator before appearing in Teams. The operator can inspect the submitted image version and approve or reject it. Other members see a placeholder while a new photo is pending or rejected; earlier unreviewed shared photos are also hidden in the updated app. Your personal profile photo and images you choose to export remain available separately. A photo replacement or removal invalidates its previous shared approval.

Blocking a member hides their name, photo and individual updates from your views and suppresses completion notifications between you. It does not remove either person from a team, erase shared results or stop a member with existing team access from seeing information available to that team. You can manage blocks in Profile or leave the team.

The daily anti-abuse counter is keyed by a hash derived from an account identifier and the UTC day. It is pseudonymous, not anonymous, contains no report text, and expires at the end of that daily window. Deletion after expiry runs in the background and is not instantaneous.

Photos, files and permissions

Profile and team photos you choose to upload are stored using Firebase Storage. Photos selected for a personal proof composition are processed on your device; that proof flow does not upload the original photo to DailyProof's account storage. Camera and photo-library access are requested when you use the relevant feature.

Report images and account exports can be written to temporary device storage for sharing. The app removes older temporary export files during later export operations. Your operating system and any receiving app can keep their own copies.

You can refuse or revoke camera, photo and notification access in device settings. Refusing an optional permission does not prevent basic habit tracking.

Notifications

With your permission, DailyProof can schedule local habit reminders and routine, comeback or sharing prompts. These use your schedules and activity on that device. Team notifications use a push token to route messages through Expo and Apple or Google's notification services.

You can change reminder and team-notification settings in the app and disable notifications in device settings. Notification text may appear on your lock screen, depending on your device settings.

Service providers and international processing

Firebase provides authentication, database, file storage and backend services: https://firebase.google.com/support/privacy. RevenueCat manages subscriptions and purchase analytics: https://www.revenuecat.com/privacy. Expo routes push notifications: https://expo.dev/privacy. Apple and Google provide the relevant sign-in, app-store, payment and notification services. Stripe processes website payments and subscription management when available: https://stripe.com/privacy. We link those purchases to the same DailyProof account using its account identifier, email and provider transaction references.

Google sign-in on iOS can process account and device identifiers, connection information and technical usage data linked to you for sign-in functionality and SDK analytics. Your IP address may be used to estimate your general location for fraud prevention. This is separate from the version-dependent PostHog app usage analytics described above. Google's SDK disclosure is available at https://developers.google.com/identity/sign-in/ios/app-privacy.

Providers process information needed to deliver these services and may process it outside your country. Their applicable data-processing terms and transfer safeguards govern those transfers. Firebase's processing terms are available at https://firebase.google.com/terms/data-processing-terms. Contact us for information about a specific provider or transfer.

Database access is restricted by account and team permissions, and service connections use encrypted transport. This is not end-to-end encryption. The operator may access account information when needed for support, security, maintenance or a legal obligation.

Retention and deletion

Account content is kept while needed to provide your account and the features you use. You can delete personal habits, remove profile content or request account deletion. In the app, open Me (Profile in earlier versions) and choose Delete account. If you created an active team, archive it before deleting your account. You can also request deletion without the app at https://dailyproof.florent-tech.com/delete-account/.

Account deletion removes your personal profile, habits, personal completion history and authentication account. Shared team facts may remain to preserve the remaining team's historical totals: the displayed member name becomes Deleted member and the profile photo is removed. Those records can still contain a technical user identifier; they are not irreversibly anonymous. Contact us if your request also concerns retained shared records.

Account deletion also removes your saved community agreement, blocked-member list, reports, photo-review requests and approved image copies associated with your account. Reset all data keeps those safety settings, reports and photo-review information; it resets your personal tracker. A daily anti-abuse counter can remain after account deletion until its expiry and background cleanup, so resetting or deleting an account cannot immediately bypass reporting limits. Any separate support correspondence or records needed for an outstanding security or legal matter follow the retention criteria below.

Deleting a DailyProof account does not automatically cancel an Apple or Google subscription. Manage those cancellations with the store where you subscribed. When account deletion is processed, web subscriptions linked to that account are cancelled immediately without an automatic refund. Store, Stripe and RevenueCat transaction records may remain subject to provider retention requirements. Minimal technical billing-closure records can remain to prevent renewed purchase imports after deletion. We can assist with requests concerning provider-held information, subject to those requirements.

Retention of support correspondence, security logs, shared records and provider backups depends on their purpose, outstanding requests, security needs and applicable legal obligations. Contact us for the retention criteria for information associated with your account. We do not promise a single deletion deadline for every provider backup or transaction record.

Your choices and rights

You can edit your profile and habits, choose whether to add photos or share progress, and change notification permissions. Account export is available under Me (Profile in earlier versions), Data & privacy. It includes your own account data, not other members' private information or sign-in credentials.

Depending on the law that applies to you, you may request access, correction, deletion, portability, restriction or objection, and withdraw consent where consent is the basis for processing. Email contact@dailyproof.florent-tech.com. We may ask for information needed to verify that the account belongs to you; never send a password. We respond within applicable legal time limits and explain any permitted extension or retention requirement.

You can complain to your local data-protection authority. In France, information about these rights and complaints is available at https://www.cnil.fr/en. California residents can contact us to ask about access, correction or deletion rights that apply to them. DailyProof does not sell personal information.

Website routine quiz and saved draft

The website questionnaire stores its answers, selected phone platform and current step in your browser to create a routine draft and resume your progress. These answers are not submitted to the beta registration endpoint, payment provider or website analytics. The quiz itself does not create an app account or subscription. A local marker can remember that you sent a beta request; it does not grant app access.

Saved quiz data remains in that browser until you use Clear answers & start again or clear the website storage in your browser. It is not synchronized between devices. Anyone with access to the same browser profile may be able to see the saved draft. The website cannot restore it after you clear it.

If you choose to copy your draft, it is written to your clipboard. A compact plan code contains only your chosen goal, motivation, experience and obstacle. When a compatible app is available, you can choose to import those four preferences; the code does not contain your name, email or all 26 answers. Installing the app from a store does not automatically transfer your draft.

Selecting a goal card can put its goal identifier in the page URL. Hosting and website analytics may process normal page-visit information as described below. This is separate from submitting the quiz answers or linking them to an app account.

Android beta registration and web accounts

If you request Android beta notifications, we collect your email address, request dates and registration source. When you activate the open beta in the app, access is linked to your signed-in account identifier. This contact information is stored in a private Firebase collection. Your email is not added to the questionnaire URL, browser draft or analytics events. We use it to handle beta access and availability updates, not to register you automatically in Google Play testing.

Short-lived request counters use keyed identifiers derived from an email address or network address to limit abuse. A notification signup does not prove email ownership and does not grant app access. Open beta access belongs to the authenticated DailyProof account without requiring an email verification step; it does not prove membership in a Google Play test. An unverified email cannot claim another account’s notification registration.

The beta contact record is kept while needed to administer the beta and notify you about availability. You can request its removal at contact@dailyproof.florent-tech.com, including without creating an app account. Account deletion removes a claimed beta record associated with that account; an unclaimed request can be removed through support. Security counters and provider backups follow the retention criteria above.

Where web subscriptions are available, account creation and sign-in use Firebase Authentication. There is no separate email verification step before reviewing or purchasing a website subscription. Web sign-in credentials are sent to Firebase; we do not store your password in the website draft. Firebase can retain the sign-in session in this browser tab for the visit, including across a reload and the checkout return. Signing out clears that session. Payment uses Stripe Checkout, with payment details handled by Stripe, and RevenueCat links confirmed subscription access to your DailyProof account identifier. The checkout does not receive your questionnaire answers. Payment availability and terms are shown before confirmation.

When a time-limited website offer is available, the server associates the offer start time, expiry, quoted plan amounts and any checkout reservation with your account identifier. This keeps the same deadline after a reload and checks the price before checkout. These operational records do not include your questionnaire answers and are not advertising analytics. Account and transaction records follow the retention and deletion criteria described above.

Website analytics

The DailyProof website is hosted by Vercel and uses Vercel Web Analytics to understand visits. Aggregated traffic information can include pages viewed, referring sites, browser and device information, and country.

The website does not send your app habit content or DailyProof account identifier to this analytics service. It is separate from app analytics and is not used for cross-site advertising tracking. Vercel explains its processing at https://vercel.com/docs/analytics/privacy-policy.

Age and policy updates

DailyProof's Terms of Service require users to be at least 16. The app does not verify a date of birth or offer parental controls. Contact us if you believe a child has provided account information so we can investigate and handle deletion.

The date above identifies this policy version. We will publish changes here and provide additional notice where applicable law requires it. Contact contact@dailyproof.florent-tech.com with questions.