Privacy Policy

Who operates Daybond

Daybond is a product developed by Atomsoft SRL. Questions about the service or this draft can be sent to office@atomsoft.io. Atomsoft's registered address, applicable legal bases, privacy contact and the effective date of this notice still require approval before these terms become operative.

Sign-in and account information

Daybond uses Sign in with Apple or Google. We store an internal account ID, the sign-in provider's user identifier and any email address supplied by that provider. The service also stores your chosen handle, optional display name or avatar, time zone, companion selection, private motto and account timestamps.

Daybond records device and session identifiers and token hashes to manage access. Its iPhone app stores credentials in the iOS Keychain. Provider identities are linked by provider and user identifier, not merely by matching email addresses.

Goals, activities and workout records

When you use Daybond, we store the goals, commitments, action titles and descriptions, schedules, targets, reminders, cues, links, notes, completions, amounts, durations and history that you enter. These records power progress, streaks, rewards, XP and personal statistics.

For workouts, the service records exercise plans, rounds, sets, repetitions, weights or loads, skips and session timing. The Apple Watch companion exchanges workout state through the iPhone. The code reviewed on 12 October 2026 did not collect heart rate, GPS location or Apple HealthKit records; workout entries can still reveal personal fitness information.

Photos, videos and external content

You may upload an avatar, action and workout covers, or exercise photos and videos. Daybond stores ownership and storage identifiers, file types and sizes, and sometimes filenames. Avatars and covers have public URLs, while private exercise media uses owner-authorized, time-limited signed viewing links (normally up to one hour).

Daybond does not systematically strip uploaded video audio or metadata. Reference images and videos loaded from other hosts may cause your device to contact those external providers. Public media and copies held by someone else cannot be made private merely by deleting your account.

Friends, buddies and challenges

Daybond stores friendships and requests, invitations, challenge membership, progress, rankings, reactions and nudges. Exact-handle search may return your handle, profile identifier, name and avatar. Other participants can see certain challenge activity and progress; active goal buddies can see action titles and progress. Invitation previews can display participants' names or avatars.

When an account is deleted, Daybond removes that user's relationships and attribution, but does not erase independently owned goals, actions or results belonging to other participants. Other users' independently saved content and challenge information remain subject to their own account lifetimes.

Notifications and diagnostics

The app generates a persistent device UUID rather than an advertising identifier. If you enable notifications, Daybond handles Apple push and Live Activity tokens, delivery status and notification content. Apple may receive challenge titles, names, identifiers and Live Activity state needed to deliver those notifications.

The audited account-deletion release logs operation names, route templates, status, timing and safe error codes. It is designed not to log user or record IDs, credentials or raw error details in those application logs. Container logs are size-rotated (about 30 MiB per container) without a guaranteed time-based expiry. Provider and infrastructure logging remains subject to production verification.

Progress statistics, advertising and optional ChatGPT connection

Daybond generates progress and consistency statistics from your own activity. The application code reviewed on 12 October 2026 contained no third-party advertising, analytics or crash-reporting SDK. There was no implemented billing or subscription data processing in that version.

If you choose to connect Daybond to ChatGPT, the current integration can exchange dates, time zones, proposed Goal plans and creation results. Daybond stores connection grants and plan drafts. The audited tools did not read previously saved goals or history, and existing ChatGPT conversations already exported outside Daybond cannot be erased by Daybond account deletion.

Service providers and storage

Daybond application records use PostgreSQL and local development uses MinIO. The prepared production design uses Cloudflare R2 for public media, private exercise media and encrypted database backups, with Apple and Google for sign-in and Apple for push delivery.

The VPS operator, live deployment region, Cloudflare R2 jurisdiction, contractual safeguards, relevant legal bases and cross-border data transfers have not been confirmed for the public release. These must be verified before this draft becomes an effective policy.

How to permanently delete your Daybond account

The account-deletion flow implemented on 12 October 2026 is Settings → Delete account. You must verify your identity using the same Apple or Google sign-in provider used for Daybond, and then choose Delete permanently. Back or Cancel before confirmation does not delete anything. Deletion cannot be undone, and signing in again does not recover the account.

An internet connection is required to verify and accept deletion. An offline request is not treated as completed. Once the server accepts deletion, all sessions and connected-app grants stop authorizing access, push registrations are disabled and Apple sign-in credentials are revoked where applicable. The iPhone shows Account deletion accepted only after durable server acceptance and successful local cleanup; this does not mean every backup or external object has already been removed.

If the response is uncertain, the app offers Retry, including after relaunch. Ordinary offline changes are not replayed while deletion is unresolved. Production Apple credentials and external service behavior still require end-to-end validation.

What deletion removes

After acceptance, a deletion worker permanently removes your account and profile, sign-in provider identifiers, session rows, device and push tokens, connected-app authorizations, goals, commitments, personal and challenge actions (including previously archived or soft-deleted items), workout details, completion evidence, progress, XP and rewards, saved items, mutation records and your social relationships from the primary database.

The worker normally completes primary database erasure at its next pass, around one minute after acceptance. Work remaining after 24 hours is treated as an operational incident, not a guarantee of completion during an infrastructure outage. The service also queues owned public and private media for removal, and removes your references from other users' records while preserving their independent content.

Records and content that can remain after deletion

Other participants keep their independently saved activities, challenge configuration, progress and results for their own normal account lifetimes. Your profile references are removed. Notifications already displayed by the operating system on someone else's device cannot be recalled remotely, and copies that others saved, shared, downloaded or screenshotted are outside Daybond's deletion control.

For safety and retry handling, Daybond retains a limited deletion receipt containing pseudonymous identifiers, timestamps and counters for 30 days, then removes it at the next worker pass. A used sign-in assertion's SHA-256 digest may remain up to 24 hours plus one worker interval to prevent replay. Unused deletion preparations are valid for five minutes and then cleaned up.

An independent restoration journal contains only the deletion ID, account ID and acceptance time, and remains for 200 days in private storage. It cannot log into or restore the account. The journal is reapplied to databases recovered from older backups before they can serve requests.

Media cleanup and temporary uploads

Canonical avatars, cover images and private exercise media are queued for deletion after account erasure. Removal normally begins during the next cleanup worker pass. Existing signed private viewing links expire within an hour at most, and stop working earlier if the underlying object is removed. The public CDN and object deletion controls must be verified during the live release.

A previously issued signed upload link cannot be revoked before it expires. Staged uploads are queued for deletion after expiry plus 24 hours, which can be up to eight days for the supported seven-day maximum URL lifetime. Planned bucket lifecycle controls expire public staging objects after eight days, private staging objects after two days and incomplete multipart uploads after one day; a late-uploaded object's lifecycle may run longer than the ordinary deletion queue.

If a storage provider or Apple revocation request fails, Daybond retains only the minimal identifiers, opaque storage keys, encrypted Apple revocation credentials and retry status needed to finish cleanup. Failed cleanup is retried; no fixed maximum age is imposed during a prolonged provider outage. Work overdue by 24 hours is treated as an incident. Neither 24 hours nor a scheduled lifecycle job guarantees object removal during an outage.

Encrypted backups and log retention

Backups are encrypted and individual records are not rewritten within existing snapshots. The planned policy has an absolute snapshot-age cutoff of 180 days, with weekly pruning normally removing retained backup data by 187 days and an operational limit of 190 days. Failed pruning must be treated as an incident rather than silently extending that period. The independent 200-day deletion journal prevents restoring previously deleted accounts from older backups.

Routine container diagnostic logs rotate by size rather than a set number of days. Older logs that contained identifiers must be removed at rollout; live storage, lifecycle, recovery and monitoring checks are still prerequisites for a production launch.

Other devices and copies outside Daybond

After accepted deletion, the current iPhone clears its credentials, private files, pending offline work, widgets, reminders and Live Activities, retrying local failures. A disconnected iPhone or Apple Watch cannot be wiped remotely; when it reconnects and receives the updated state, the app clears the deleted account's data. A device that never reconnects may retain local files until its app data is removed.

Device backups, screenshots, downloads, exported media, previously delivered notifications and external ChatGPT conversations are controlled by the respective device, platform or recipient. Daybond cannot guarantee their removal.

Your rights and this draft's status

For questions or privacy requests, contact office@atomsoft.io. How applicable access, correction, objection and deletion rights are exercised, age eligibility and lawful processing grounds need final legal review. No billing, litigation-hold, analytics-account or statutory tax retention exception was implemented in the audited Daybond repository.

This notice describes implemented code and a proposed operational policy as of 12 October 2026, not an independently verified live deployment. The final document must identify the controller and data protection details, approved service providers and regions, rights procedures, legal bases and its effective date before use as a public privacy policy.

Contact

Questions? Write to office@atomsoft.io.