Daysli Privacy Policy
Version of 30 October 2026 (Ring messages; Ring in the browser toolbar). Replaces the policy of 28 October 2026.
1. Who we are
Daysli is provided by Portside Agency Pvt Ltd, a private company incorporated in the Republic of Maldives (registration number C00212023), H. Maadhoofiya, 10th Floor, Karankaa Magu, Malé 20082, Maldives. We decide how the personal data described here is used and are responsible for it (the "controller"). Contact: care@mail.daysli.com, about anything on this page, including your rights and complaints (for people in India, this is also our grievance contact).
We are not established in the European Union or the United Kingdom, and have not yet appointed a representative there under Article 27 of the GDPR or UK GDPR; when we do, we will name it here. Until then, people and authorities in the EU and UK can reach us directly at care@mail.daysli.com (authorities: team@daysli.com).
2. The short version
- We do not sell your data, advertise, or track you across other sites.
- Your journal is encrypted on your devices with keys we never hold: we cannot read it.
- Ring calls are end-to-end encrypted between the callers' devices (phones or browsers): we cannot listen to them and do not record them.
- Ring messages are not end-to-end encrypted: our service stores them (encrypted at rest) so they reach every device you use (section 4).
- Everything else you keep in Daysli (your day, People, photos, My Life) is protected in transit and at rest, but is stored in a form our service can read so it works on all your devices. Nobody at Daysli looks at it except to help you when you ask, to investigate abuse or security, or when the law requires.
- Your database and files are stored in the EU (Frankfurt, Amazon Web Services). Some providers process data elsewhere (section 9).
- You can see, export, correct and delete your data.
3. What we collect, why, and on what basis
The "basis" column applies where the GDPR or UK GDPR applies. "Contract" means we need it to provide Daysli to you. "Legitimate interests" means: providing the service you and others ask for, protecting accounts, preventing abuse and spam, keeping Daysli secure, fixing faults, and establishing or defending legal claims; you can object (section 11).
| What | Why | Basis |
|---|---|---|
| Account: email address, display name, page name, time zone, sign-in methods (passkeys, authenticator app, Google sign-in if you use it) | Signing you in, running your account | Contract |
| How you joined: recorded once when you set up your account: whether you set it up through Daysli or Ring, and, if your sign-up link carried a short campaign tag (plain lowercase letters, digits or hyphens, for example `lia-guides`), that tag. Not the site you came from, your network address or anything about your device | Understanding, in totals, which ways of finding Daysli work. The record is tied to your account; Daysli's owner and operations staff see it only as totals | Legitimate interests (understanding our own growth without tracking) |
| Your day: events, appointments, to-dos, reminders, notes | Showing and syncing your own day | Contract |
| Journal: encrypted entries and photos, sealed keys per device and recovery code | Keeping your journal, which only you can read | Contract |
| People: names, contact details, notes and history you keep about people; connections you make with other Daysli users | Your private record of the people in your life | Contract (for you); legitimate interests (for the people you record) |
| Photos you add to events, people, to-dos, memories; your own picture | Showing them to you | Contract |
| My Life: goals, steps, reviews, check-ins | Your planning and reviews | Contract |
| Personalised guidance (only if you turn it on in Settings › Account and data): what Daysli learns from your own My Life progress about which steps help you | Fitting suggestions to you, only for you | Legitimate interests; you can turn it off and reset what was learned at any time |
| Public page and card (if you turn them on): what you choose to show, and your free times (never what you are doing) | Letting others see it and ask for your time | Contract (your instruction) |
| Moments: what you share on someone's page and your replies (the words, when, hearts you give), shown with your display name and, if your page is on, its address; moments others share on your page; reports you make | Showing them as the page's owner allows, and to search engines only as you allow; letting page owners approve, hide, remove and block; reviewing reports | Contract (your instruction); legitimate interests (reports and safety) |
| Requests from others (section 5): the requester's name, contact details, message, proposed time; a one-way hash of their contact details and network address | Delivering requests to you; limits and blocking | Legitimate interests |
| Ring calls (in the Daysli app and at ring.daysli.com): your calling ID (page name), the public Ring key of each phone or browser that can receive your calls, who may ring you, blocks; for each call: the two accounts and devices, times, duration, outcome; abuse reports | Placing calls, protecting people from unwanted calls | Contract; legitimate interests (safety) |
| Ring messages (ring.daysli.com and Ring in the browser toolbar): the messages you send and receive, with when each was sent, delivered and read; each chat's settings (muted, cleared); the invitation links you make and who joined with them; people you block; reports you make, with the last 20 messages the reported person sent you | Delivering and syncing your messages; connecting people who accept an invitation; protecting people (blocks, reports, limits) | Contract; legitimate interests (safety) |
| Ring in the browser toolbar (the browser extension, if you add it): a sign-in session of its own, your display name and page name, a random installation number and its push subscription; and, while you use it, the Ring and Daysli information it shows or changes (chats, people, requests, your events and to-dos) | Showing your messages, people, today and notifications in the toolbar; sending messages, marking them read, adding and completing to-dos; keeping the extension signed in. It talks only to ring.daysli.com, has no analytics, runs no code from elsewhere, and does not read the pages you visit, your browsing history or any other site | Contract (your instruction) |
| Encounter (Pro): the code's fingerprint, the two accounts, both answers; when you met in person | Connecting two people who both said yes | Contract |
| Availability (Pro): the state you choose (e.g. free to talk), until when, who sees it | Showing it to the people you chose | Contract |
| Daysli Mail (Pro): your mail address; the messages you send and receive, with their senders and recipients, subjects, text and times, the files kept (within limits), which folder each is in and whether it was read; delivery records (delivered, bounced, reported as spam); senders you block and messages you report | Delivering, keeping and showing your mail; protecting you and others from spam and abuse; keeping email deliverable | Contract; legitimate interests (safety, abuse prevention) |
| Subscription (Pro): plan, state, renewal and expiry dates, Google's purchase token and order number, an anonymous account tag Google keeps, refund or revocation status, and an audit record | Knowing whether you have Pro; accounting | Contract; legal obligation (accounting records) |
| Invitations: your invitation code; who joined with it (counts are shown to you, never names); for an invitation email, a one-way code (keyed hash) of the address, kept 90 days, and opt-outs, kept for good as the code alone; a keyed hash of the network address a claim came from, which changes daily | Sending the invitations you ask for within their limits; honouring opt-outs; counting genuine new members for rewards | Your instruction (contract); our legitimate interest in preventing reward fraud and unwanted email |
| Notifications in a browser: the browser's push subscription (the push service's address for that browser, and its keys) | Showing the notifications you chose in that browser | Your instruction (contract) |
| Web payments: your plan, its status and dates, Paddle's customer and subscription references, refunds you asked for (when, which kind, the amount) and the billing emails we sent you (confirmation, renewal reminder) | Giving you the plan you paid for; plan changes, cancellation, refunds and the reminders the law requires | Contract; legal obligation (records) |
| Support and complaints (Daysli Care): what you send us (by the form at daysli.com/help, by email, or a report from the app), your name and email address, attachments within limits, the case's history and our replies | Answering you, handling complaints and reports, protecting people, legal claims and obligations | Legitimate interests; legal obligation; contract where it concerns your account (section 6) |
| Calendar connections (if you connect one): which account, calendar names, busy times; Google's access token, or your iCloud app-specific password, kept encrypted with a key held in a key service | Showing busy times; writing your events | Contract (your instruction) |
| Apple Calendar feed (if you turn it on): a secret link to a feed of your events and accepted appointments (never notes, to-dos or your journal) | Letting your calendar app subscribe to Daysli | Contract (your instruction). Anyone with the link can read the feed until you reset it or turn it off; we keep only a fingerprint of the link and when it was last read |
| Developer API and webhooks (if you use them): your tokens (stored as fingerprints), their scopes, webhook addresses, delivery records | Letting your own software use Daysli | Contract (your instruction). Webhooks send data to the address you set; that endpoint is yours |
| Devices and sessions: for each app or browser: device type, make and model, system version, Daysli version, language, region setting, time zone, connection type; sign-in sessions; push notification tokens | Security, sign-out, notifications, fixing faults | Legitimate interests; contract |
| Crash reports (Android): the type of fault and where in Daysli's code it happened, app and system version, device model, a random installation number — never the error text or your content | Fixing faults | Legitimate interests |
| Security records: network addresses (as one-way hashes for limits), an audit log of security-relevant actions (what, when, which record), sign-in challenges and failed verification attempts | Protecting accounts and the service | Legitimate interests; legal obligation |
We do not collect your precise location and do not track where you go. We do process network (IP) addresses, your region setting and time zone, which show roughly where you are, for security, delivery and showing times correctly. We do not read the contacts on your phone (only a contact you pick to add), or anything from other apps.
Sensitive information. Daysli never asks for information about your health, religion, beliefs, sex life or similar. If you choose to write such things in Daysli, for example in a note or a check-in, we process them only to store them and show them back to you, with the same protections as everything else, and never use them for anything else. Please do not record such information about other people unless you have a lawful reason to. You can delete it at any time. Some laws also treat the content of private messages and mail, your journal and your sign-in details as sensitive: we use them only to provide and protect Daysli, never for advertising, sale, sharing for cross-site advertising, or profiling.
4. What we can and cannot read
- Journal: we hold only encrypted data and sealed copies of your journal key, each needing one of your devices or your recovery code to open. We can see its shape (which days have entries, sizes, when changed), not its content. If you lose every device and your recovery code, nobody can recover it.
- Ring calls: audio travels encrypted between the callers' devices (directly, or through a relay that cannot decrypt it). We never receive call audio. The call's setup data, which includes network addresses, is erased when the call ends.
- Ring messages: not end-to-end encrypted. They are stored encrypted at rest, and our service reads them to deliver them, keep them in step on your devices and show them to you. No AI reads them, including those in a report. Our staff do not read them, except the messages included in a report (the last 20 the reported person sent the person reporting), or as this section otherwise allows for security incidents or the law. A notification of a new message shows the sender's name and "New message", and the message text only if you turn that on.
- Daysli Mail: mail is not end-to-end encrypted. It is stored encrypted at rest and our service reads it to deliver it, sort it, show it to you and protect you from spam and malware (Amazon Web Services scans received mail for both). No AI reads your mail. Our staff do not read it, except a message you report (and only that message), or as this section otherwise allows for security incidents or the law. A notification of new mail carries no content: your phone fetches it from Daysli.
- Everything else is stored encrypted at rest and sent only over encrypted connections, but our service can read it so it can show it on all your devices. Our staff access it only to help you at your request, to investigate abuse or security incidents, or when the law requires; support tools show personal details masked unless an owner-level administrator needs them, and every administrative action is logged.
- Notifications: to be useful, a notification can contain short text such as a requester's name or an event title. On Android it travels through Google's notification service; on your lock screen, Daysli shows only that there is something new, unless you change that in your phone's settings.
5. If you are not a Daysli user
If you send a request through someone's public page, we process your name, contact details, message and proposed time, a one-way hash of your contact details and network address, and the bot-protection check (Cloudflare Turnstile), to deliver your request to the page owner, let them answer you, prevent abuse, and enforce blocks. The page owner sees what you sent. Your details are removed within 90 days after the request is settled (or after the appointment); if the page owner has blocked you, your request is deleted after 7 days.
If a Daysli user keeps your details in their People (a private address book), we hold them for that user and show them to no one else. You can write to us to access, correct or delete them; we weigh your request against that user's own privacy and rights, and tell you what we did.
If you write to, or receive mail from, a Daysli Mail address, we process your address, your message and its files to deliver it and keep it for the Daysli user, and the delivery records email systems produce, on the basis of our legitimate interests in providing the service the user asked for. The Daysli user decides what to keep; ask them, or us at care@mail.daysli.com, about it.
6. When you contact Daysli Care
When you write to Daysli Care, by the help form at daysli.com/help, by email, or by reporting a call or a chat in Daysli or Ring, we open a case with a number, send you an automatic confirmation that it is waiting for review, and keep what you sent, our replies and the case's history (who did what, and when). A report of a Ring chat includes the last 20 messages the reported person sent you.
How a reply is prepared. Daysli first compares your message with a library of approved procedures, inside Daysli's own service. If none applies, we may use an AI service, OpenAI, to help a person at Daysli understand the case and prepare a draft reply. OpenAI then receives only the words of your message and its subject, with email addresses, phone numbers, card-like numbers, codes and similar details removed. We add nothing else from Daysli: not your account, your day, your journal, your People, your calls, or the Ring messages in a report. If you quote personal details or a Ring message in what you write to us, those words may be included after this redaction. We ask OpenAI not to keep the request (under its API terms it may keep it for up to 30 days to detect abuse), and OpenAI does not use API data to train its models. A person at Daysli reviews and approves every reply before it is sent; the AI cannot send anything, and it makes no decision about you: refunds, account restrictions and any other decision are made by a person.
Support records are kept apart from the rest of Daysli: they are never used for personalised guidance or to build a picture of you. Reports about another person are reviewed fairly, and a report alone is never treated as proof.
7. What we do not do
We do not sell or rent personal data, or share it for advertising. We do not advertise, profile you for advertising, or use tracking cookies or cross-site analytics. We do not use your data to train third-party or general-purpose AI models, and no AI service outside Daysli receives your data, except the redacted text of messages you send to Daysli Care, as section 6 describes. We do not analyse your photos (no face or object recognition). We make no automated decisions with legal or similarly significant effects.
8. Google user data
Daysli's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to show your busy times, keep the calendars you choose in step with Daysli, and write Daysli events where you ask. If you sign in with Google, we use your name and email address only to sign you in. We never use Google data for advertising, sell it, or use it to train AI models, and people at Daysli read it only with your permission, for security or abuse investigations, or where the law requires.
9. Who else processes data for us, and where
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting the Daysli service and database, file storage, backups, the key service protecting calendar connections, email (Amazon SES), receiving and sending Daysli Mail, and its spam and virus scanning | Frankfurt, EU. Email is delivered to recipients wherever their email provider is |
| Cloudflare | Serving daysli.com and the app; the network in front of the service; Turnstile (bot protection on public forms); the relay for Ring calls (carries encrypted audio only) | Cloudflare's global network, at the location nearest you |
| Google (Firebase Cloud Messaging) | Delivering notifications to the Android app | United States |
| Google Play | Selling and managing Daysli Pro subscriptions: payment, tax and fraud prevention under Google's own terms and privacy notice (Google receives your payment details directly) | Google's locations |
| Paddle (the Paddle company named in the checkout and on your receipt, for example Paddle.com Market Limited) | Merchant of record and reseller for plans bought on the web: payment, tax, fraud and compliance checks, receipts, invoices and refunds, as an independent controller under Paddle's own privacy notice (Paddle receives your payment details directly) | United Kingdom and Paddle's locations |
| Browser push services (Google Firebase Cloud Messaging, Mozilla, Apple, Microsoft) | Carrying notifications to browsers where you turned them on; each message is encrypted for your browser, and the push service cannot read it | Their locations |
| Google, Apple | Only if you connect their calendar, or sign in with Google | Their locations |
| OpenAI | Helping prepare drafts of replies to messages sent to Daysli Care (only the message's redacted words; not kept, not used for training) | United States |
| Supabase | Holds an archived copy of data from our earlier system (before October 2026); not used to run Daysli | Frankfurt, EU |
International transfers. Your database and files stay in the EU. Data leaves the EU where a provider above needs it: notification tokens and short notification text to Google's notification service in the US, and encrypted notifications through the browser push services (section 9); requests through Cloudflare's nearest location; calendar data to the provider you connected; email to recipients' providers; and any access by a provider's own staff outside the EU. For these transfers we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK extension) where it has one, and otherwise on the European Commission's Standard Contractual Clauses (with the UK addendum) in its data processing terms. Daysli is run from the Maldives: our staff there can access the service as section 4 describes. Encrypted recovery copies of our database are also kept by us offline, readable only with our own key (section 10). You can ask us for a copy of the relevant safeguards at care@mail.daysli.com.
Archive from our earlier system. The Supabase archive is kept, unused and access-restricted, only as a backup of that period. We will set and publish a date for its deletion. If you ask us to delete your data, we also delete it from the archive.
10. How long we keep it
| Data | Kept |
|---|---|
| Your content (day, journal, People, photos, My Life, page) | Until you delete it or your account |
| Deleted items (events, to-dos, journal entries and similar) | 30 days (to allow undo and recovery), then deleted |
| Deleted photos | 7 days, then deleted; storage keeps a previous version up to 7 more days |
| Requesters' details on a settled request | Removed within 90 days after the request is settled (or after the appointment) |
| Requests from someone you blocked | 7 days |
| Notifications | Delivery records 30 days after sending; in-app notifications 90 days |
| Ring call records | 90 days |
| Ring abuse reports (the report record) | 1 year; the Daysli Care case made from a report, with the messages it includes, is kept as support cases are |
| Ring messages | Until the sender deletes them for everyone or either person's account is deleted. Clearing a chat removes the messages for you only; the other person keeps their copy until it is removed for them |
| Ring sync records (which changes each device has fetched) | 30 days |
| Ring invitation links | Until you turn them off or they are used up (each link connects at most 10 people); who joined stays as your connection until removed |
| Invitation records | 90 days |
| Invitation opt-outs | For good, as a one-way code only |
| Browser push subscription | Until you turn notifications off there, sign out there, or the browser ends it |
| Encounters | 90 days (the connection itself, and the in-person meeting on your People record, stay until you remove them) |
| Availability you set | Until it ends, plus 1 day |
| Moments | Until their author deletes them, the page's owner removes them, or either account is deleted. Reports: until the moment is deleted |
| What personalised guidance learned | Until you reset it or delete your account (turning it off stops further learning) |
| Sign-in codes | 7 days |
| Sign-in challenges | 1 day after they expire |
| Failed verification attempts | 30 days |
| How you joined | Until your account is deleted |
| Sign-in sessions (including the Ring browser extension's) | Until signed out, or 90 days after their last use; ended sessions 30 days more |
| Limit counters | 24 hours |
| Support cases (Daysli Care), with their emails and attachments | 2 years after the case is closed; spam 30 days |
| Daysli Mail messages and files | Until you delete them or your account; Trash and Spam 30 days. If Daysli Pro ends: kept 90 days (still receiving), then the mailbox closes, and they are deleted 30 days later unless you subscribe again |
| Daysli Mail delivery records | 90 days |
| Messages received for a mail address that does not exist | Discarded within minutes without being delivered; at most 7 days in a delivery queue |
| Crash reports | 90 days |
| Service logs | 7 days (other technical logs up to 30 days) |
| Database backups | Automated: 7 days. Copies taken before a release: up to 30 days. Encrypted offline recovery copies: up to 15 days |
| Subscription records | As long as your account exists, and as long as tax and accounting law requires |
| Your account after you delete it | Recoverable for 30 days if you ask; then deleted. Your page name is held for 90 days so nobody can impersonate you; a page name made permanent by Daysli Ring or Daysli Mail is never released: only the name itself is kept, as a hold no one else can take, to prevent impersonation and misdirected calls and mail (legitimate interests) |
11. Your rights
You can: get a copy of your data (in the app: Settings › Account and data › Export; the journal has its own encrypted export), correct it, delete your account and data (in the app, at daysli.com/delete-account, or by email), object to a use based on legitimate interests (for example personalised guidance, which you can also turn off yourself), restrict a use, withdraw any consent you gave, and receive your data in a portable format. Write to care@mail.daysli.com; we reply within 30 days and may need to confirm it is you. Export your data includes your Daysli Mail, every folder, as standard .mbox files with the files kept.
If you are in the EU or UK you may complain to your data protection authority. If you are in a US state with a privacy law, you have the rights it gives you; we do not sell or share personal information as those laws define it, and we will not treat you differently for using your rights. If you are in India, you can raise a grievance with us at care@mail.daysli.com and, if unresolved, with the Data Protection Board of India.
12. Cookies and storage on your device
Daysli uses only what it needs to work: a sign-in cookie, and storage in your browser or app for your settings and an offline copy of your own data, so Daysli opens quickly and works without a connection. Public forms use Cloudflare Turnstile, which checks technical signals from your browser and your network address to tell people from bots. We use no advertising or analytics cookies, so we do not ask for cookie consent. A campaign tag in a sign-up link (above) is held only in the open page's memory until you finish setting up, never stored on your device.
Ring in the browser toolbar keeps its sign-in key (a refresh token), your display name and page name, and a random installation number in the extension's storage in your browser, and a short-lived access token only in the browser's memory. On ring.daysli.com it tells the page that it is installed; it is signed in only when you press Connect on that page, which then gives it a new sign-in session of its own. Removing the extension removes them from that browser; its session on our side then ends 90 days after its last use, or at once if you sign it out in the extension or under Where you are signed in (Settings in Ring or Daysli). It asks the browser only for storage, notifications and access to ring.daysli.com (in Firefox also a timer, to look for new messages every few minutes, because Firefox does not deliver push notifications to extensions), and it calls only ring.daysli.com. Where the browser gives extensions push notifications, they reach it through the browser's push service (section 9), encrypted for that browser; in Firefox, the extension instead checks ring.daysli.com every few minutes and shows notifications itself. It sends nothing about the pages you visit, your browsing history or any other site.
13. Security
Encryption in transit everywhere; encryption at rest for databases, files and backups; access rules enforced inside the database; the journal and Ring calls end-to-end encrypted. Ring's encryption has been reviewed internally by our engineering; it has not been independently audited yet. No service can promise it will never suffer an incident, and we do not. If a personal data breach occurs where the GDPR or UK GDPR applies, we notify the supervisory authority without undue delay and, where feasible, within 72 hours, and we tell you without undue delay if it is likely to put you at high risk; elsewhere we notify as the law requires.
14. Children
Daysli is not for children under 16 (under 18 in India), and we do not knowingly collect their data. If we learn that an account belongs to someone below that age, we delete it. If you believe a child has an account, write to care@mail.daysli.com.
15. Changes
We will update this page and the date at the top. If a change materially affects you, we will tell you in the app or by email before it takes effect.
Questions: care@mail.daysli.com.