DAYFACTOR
Download app

Legal · Privacy

Privacy Policy

DAYFACTOR is designed around a simple principle: your daily wellness information should remain under your control. This policy explains what the app handles, where information is stored and the limited cases in which other services are involved.

Last updated: October 2026 · DAYFACTOR 1.1

1. Who is responsible

The controller and operator is Ibrahim Khalaf, operating DAYFACTOR, Sweden. For privacy questions or requests, email support@dayfactor.app.

2. The short version

This policy describes DAYFACTOR 1.1. Optional accounts and wellness backup are features of version 1.1; version 1.0 does not include them.

  • You can use DAYFACTOR as a guest. An account is optional, with Apple, Google or passwordless email sign-in.
  • Wellness information has a local copy on your iPhone. Creating an account and enabling wellness backup are separate choices. First-time sign-in does not itself upload wellness data.
  • Supported wellness data is backed up to Supabase only while its backup consent is enabled. Previously enabled backup can resume when you sign back into the same account unless you paused it.
  • Apple Health access is read-only, with your permission. Health samples and derived Health metrics stay on-device and are not included in Supabase backup.
  • Authentication, subscription services and food requests can communicate with external services even when wellness backup is off.
  • DAYFACTOR does not sell wellness data or use it for advertising. It does not integrate advertising trackers, behavioral analytics or remote crash reporting.

3. Information handled by DAYFACTOR

Wellness information and local Profile Details

Depending on the features you use, DAYFACTOR handles habits, schedules and completion history; meals, foods, calories and nutrients; hydration entries and targets; Focus history, Calm sessions, reminders, goals and related settings. Local Profile Details may include your entered name, birth, body and lifestyle information and profile photo. These details are separate from the identity metadata used for sign-in.

Optional accounts and sign-in

Apple and Google sign-in use their native iPhone sign-in services. The resulting identity token is sent to Supabase to authenticate your DAYFACTOR account. Apple may supply a name and email address, including a private relay address if you choose Hide My Email. Provider-supplied names can be stored in authentication metadata.

Email sign-in is passwordless: you enter an email address and a six-digit verification code delivered by email. Supabase handles the authentication flow and sends or arranges delivery of the verification email. DAYFACTOR does not ask you to create an account password.

Supabase processes provider identity information, email where supplied, your account UUID, authentication and session information, and provider metadata. Session credentials are stored on your device to maintain and refresh your sign-in. Account and installation identifiers also support backup and account-deletion operations.

Apple Health

With your permission, DAYFACTOR can read step count, active energy burned and sleep analysis from Apple Health. It does not request HealthKit write permission or write Health records. Samples and derived step, energy and sleep metrics are processed on-device and are not included in DAYFACTOR Supabase backup.

You may decline access or change permissions in Apple Health or iOS settings. Disconnecting Apple Health inside DAYFACTOR changes the app’s connection setting; it does not delete Apple Health records or revoke permissions in iOS. DAYFACTOR does not sell Health data or use it for advertising.

Nutrition search, barcodes, images and label scanning

USDA FoodData Central receives the food search query text you enter. Open Food Facts may receive search terms, automatically generated synonym terms and barcode numbers used for product lookup. Displaying a provider-hosted product image requests that image from Open Food Facts. DAYFACTOR does not explicitly add your account ID to these food-provider requests or intentionally send your stored wellness history or Apple Health information to them.

Livsmedelsverket food data is bundled locally and is not queried through an online food-search API. Visiting an attribution link opens the provider’s website separately. Barcode recognition and nutrition-label text recognition run locally; iOS label recognition uses Apple Vision. Label captures are not sent to a remote OCR or image-upload service.

Providers can receive technical request information, such as IP address, timestamps, application or device information and the requested resource. They may keep operational or security logs under their own policies. Local barcode processing does not prevent an online lookup from sending the recognized number to Open Food Facts.

Subscriptions and RevenueCat

Apple processes App Store purchases. RevenueCat handles purchase, restoration and entitlement information needed for DAYFACTOR+ access. Guests use a RevenueCat anonymous identity. Signed-in users are associated with their Supabase account UUID in RevenueCat, even when wellness backup is disabled. Signing out switches this installation back to an anonymous RevenueCat identity.

DAYFACTOR does not send your name, email address or custom subscriber attributes to RevenueCat. Purchase services may still process operational or device metadata. DAYFACTOR does not receive your full payment-card details from Apple.

Reminders and support

Habit reminders are scheduled locally after you grant notification permission. DAYFACTOR does not register push tokens or use a remote push-notification backend. If you email support, your chosen email service sends the address, message and attachments you provide to DAYFACTOR support. Please avoid including sensitive wellness information unless needed for your request.

Earlier launch-list submissions

The website no longer displays a launch-list form. If you previously joined the list, DAYFACTOR received your email address and signup information for launch and availability updates. You can unsubscribe or request deletion through the contact address below.

4. Local storage, offline use and backups

Local-first use and separate datasets

Guest and account-local datasets are separate. When signing in, choosing to keep current guest data copies it into the account dataset while preserving the guest copy; starting fresh creates a separate clean account dataset. Local Profile Details and settings do not become Supabase authentication metadata merely because you sign in.

With wellness backup disabled, wellness records remain local-first. Authentication, RevenueCat, purchases, support and user-triggered food searches, barcode lookups or product-image requests can still use external services. Core local features can work offline where technically possible.

What optional account backup includes

Creating or signing into an account is separate from enabling wellness backup. First-time sign-in, choosing “Not now” or dismissing the backup prompt does not enable wellness backup. When you enable it, supported records are uploaded to Supabase and linked to your account UUID. The backup includes:

  • Habit records, revisions and completion history, including habit schedule and reminder definitions.
  • Focus history for completed, manually ended, cancelled and abandoned sessions, including timing, duration, outcome and associated event/installation identifiers. Running sessions are excluded.
  • Nutrition meals and dated history, food/nutrient snapshots, saved meals and favorites.
  • Custom foods and saved or favorited provider foods, with favorite identifiers. The full downloaded food catalog is not backed up; food snapshot images, image URLs, provider metadata and credential fields are excluded.
  • Hydration entries and the hydration target, as part of Nutrition backup.

Account backup does not separately include local Profile Details or photo; Daily Goals other than the hydration target; units, language or general preferences/settings; device notification permissions; or scheduled notification instances. Serving units recorded within meal and food entries can be part of those entries. Habit reminder definitions are included even though device notification instances are not. Apple Health samples and derived Health metrics are excluded.

Private foods and meal logs are not publicly shared. DAYFACTOR does not offer a public Community food database.

Pause, sign-out and restoration

Enabling or resuming backup saves consent for that account on this installation and starts synchronization. Once a pause completes successfully, it stops subsequent synchronization. It does not delete local records or existing cloud copies and cannot recall requests already sent.

Signing out stops account synchronization, clears the authenticated session on this installation and returns you to the independent guest dataset. Account-local records and cloud backups remain. Signing back into the same account reuses its local dataset, and previously enabled backup can resume automatically unless it was paused.

If reinstallation removes local storage and consent, sign into the same account and explicitly enable backup to restore supported cloud records. Excluded local settings and Profile Details do not restore through DAYFACTOR backup. Only successfully backed-up records can be restored; enabling backup alone does not guarantee that an upload succeeded.

Restore and conflict handling depend on the data category. Focus history merges identified events and deletion markers; Habits and Nutrition use revisions and change detection, and competing local/cloud changes can require conflict resolution. Food restoration can also encounter identity conflicts. Backup is not guaranteed cross-device synchronization or a lossless automatic merge.

Removing the app or losing, resetting or damaging your iPhone can cause loss of data that has not been successfully backed up. Apple-controlled device backups, where applicable, follow Apple’s systems and your device settings.

5. How information is used and legal bases

DAYFACTOR uses information to provide the features you request, calculate progress and supported insights, maintain your account/session, perform consented backup and restore, verify purchase entitlements, schedule local reminders, return requested food information, respond to support or rights requests, and protect the service. It does not provide medical diagnosis, treatment or medical advice.

Legal bases for processing

Where the GDPR applies, account authentication, requested app/account services and purchase-entitlement management are processed as necessary to provide the service under our contract with you. Optional wellness backup is based on your consent, which is separate from account creation or acceptance of the Terms.

Wellness information can reveal health information and may be special-category personal data. Processing that information requires an additional condition under the GDPR; for optional wellness backup, we rely on explicit consent. A contract or legitimate interest alone does not authorize that special-category processing.

You can withdraw backup consent by pausing backup. This stops subsequent synchronization once the pause completes, but does not itself erase earlier backups or affect the lawfulness of prior processing. To request deletion, use account deletion or contact us. Apple Health access is controlled by your permissions, which you can change in Apple Health or iOS settings.

We process information when necessary to meet applicable legal obligations, including responding to valid rights requests. Limited security, fraud-prevention, deletion-recovery and support processing may rely on legitimate interests where appropriate and balanced against your rights. Those interests do not replace an additional legal condition required for health-related special-category data. Earlier launch emails are based on your request to receive them, and you can unsubscribe.

6. Service providers and international processing

Supabase provides authentication and optional account backup. Apple and Google provide their native sign-in services; Supabase’s authentication services also arrange passwordless email delivery. Apple provides iOS, Apple Health and App Store purchase infrastructure. RevenueCat manages purchase entitlements. USDA FoodData Central and Open Food Facts return requested food information; Open Food Facts also hosts product images.

These services process information for the functions described above and may process it outside Sweden or the European Economic Area. Their own privacy notices describe their wider practices, including technical logs. Local Profile Details, excluded settings and Apple Health samples/derived metrics are not uploaded as DAYFACTOR account backup. For information about transfers and safeguards relevant to your data, contact us at the address below.

Where service providers process personal data on DAYFACTOR’s behalf, they are expected, and required where applicable, to protect it consistently with applicable privacy law and the protections described in this policy. Third-party services acting independently remain subject to their own privacy terms and legal obligations.

Read Supabase’s Privacy Policy, Apple’s Privacy Policy, Apple’s App Store privacy information, Google’s Privacy Policy and RevenueCat’s Privacy Policy.

Food providers: USDA FoodData Central and USDA Privacy Policy; Open Food Facts and Open Food Facts Privacy. Livsmedelsverket data used in food search is bundled locally.

7. Retention and deletion

Local data and cloud backups

Local records remain on your device until you delete them using available controls or the relevant storage is removed. Cloud backups remain when backup is paused or you sign out. There is no general age-based automatic purge of wellness backups. Deleting individual Focus history can leave a deletion marker and corresponding cloud record until account deletion so that deleted entries are not restored.

Deleting your account

You can request account deletion inside the app. The flow requires recent sign-in verification and deletes your Supabase Auth user and account-linked Supabase wellness backup records. For Sign in with Apple accounts, the flow also revokes the applicable Apple authorization/token before deletion.

You choose whether to delete or keep this iPhone’s account-local dataset. Deleting it removes that dataset and account avatar. Keeping it archives the account dataset and switches you to the separate guest dataset; it does not merge the archive into active guest data. Independent guest data is preserved.

Account deletion does not remotely wipe local or offline copies on other devices. It also does not automatically delete RevenueCat customer records or records independently held by Apple, Google or other providers. Their records and controls are governed separately. Limited deletion, security and recovery records may be retained as needed to complete, verify or recover deletion operations.

Deleting your DAYFACTOR account, signing out or removing the app does not cancel an App Store subscription. Manage or cancel it through Apple’s subscription settings. Pausing backup and signing out are not account-deletion requests.

Other records

Support messages are kept as reasonably necessary to respond, maintain a support record, resolve disputes and meet legal obligations. Earlier launch-list emails are kept until you unsubscribe, request deletion or the list is no longer needed; a minimal suppression record may be kept to respect an unsubscribe request. Provider purchase records, technical logs and infrastructure backups follow their applicable policies and legal requirements. Contact us about access or deletion requests.

8. Your rights

Depending on where you live, including under the GDPR where applicable, you may have rights to access, correct, erase, restrict or object to processing of personal data, receive portable data, withdraw consent and lodge a complaint with a supervisory authority. For information stored only on your device and unavailable to DAYFACTOR, we cannot remotely retrieve or change it; available local app controls let you manage that data.

Send a request to support@dayfactor.app. We may need limited information to verify and respond to the request. You may also contact the Swedish Authority for Privacy Protection (IMY) or the authority in your country of residence.

9. Security

DAYFACTOR uses reasonable technical and organizational measures appropriate to the app's local-first design. No device, transmission or storage method is completely secure. Protect your iPhone with an up-to-date operating system, device passcode and any backup settings you choose.

10. Children's privacy

DAYFACTOR is not directed to children under 13. If applicable law requires a higher minimum age to use the service or consent to relevant processing, that higher age applies. Contact us if you believe a child has sent personal information through support without appropriate authorization.

11. Website privacy and cookies

The website is separate from the iPhone app. It displays direct email contact links and no contact or launch-list form. It does not include advertising trackers, behavioral analytics, social tracking embeds or website user accounts, and does not intentionally set nonessential cookies. Visiting an external link subjects that visit to the destination’s own practices.

If you previously submitted an email through the launch-list service, the website can hold your email address, signup source, identifier and signup time for availability updates. A legacy signup endpoint remains, even though no form is displayed. Retention and deletion of any such records are described above.

Hosting and network services may process technical request information needed to deliver and protect the website, including IP address, browser information, timestamps and security logs. Contact emails include information you choose to send through your email provider. Requested correspondence, website security and legal requests are processed on the applicable service, legitimate-interest or legal-obligation bases described above; optional launch messages rely on your consent.

12. Changes and contact

This policy may change as DAYFACTOR develops or legal requirements change. Material updates will be reflected by a revised last-updated date and, where appropriate, an in-app or website notice. Questions or requests can be sent to support@dayfactor.app.