Privacy Policy

Effective October 28, 2026

Daystrand is a personal journal: pills, notebook, mood, cycle, books, films, gym, nutrition and messages with the people close to you. This policy explains, plainly, what the app keeps, where, why, and what you can do about it.

1. Who is responsible

Daystrand is developed and run by Jules Martineau, in Quebec (Canada). Jules Martineau is also the person in charge of the protection of personal information. For any question or request, write to us through the support form. We answer access, correction and deletion requests within 30 days.

2. What stays on your phone

Your journal is first kept on your device (the app's local storage). As long as backup is off and you don't use the social features or the AI analysis, this data never leaves your phone.

In the iPhone app, Face ID is handled by your phone: Daystrand never receives your biometric data. The widget reads today's doses directly on your phone.

3. What is kept on our servers

• Journal backup: a copy of your journal (including the health data you entered) tied to your backup code, so you lose nothing and can get it back on a new phone. It is on by default and you can turn it off in Settings, Backup.
• Account (optional): your email address and your password, stored only as an irreversible hash (PBKDF2). We never know your password.
• Reminders: to send notifications at the right time, the server keeps the name and schedule of your pills, your recent doses, your appointments, your time zone, your language, your first name and your device's technical notification address.
• Messages and friends: your profile (first name, photo, friend code), your friends list, and the messages, photos, videos, voice notes, reactions and shared items (books, wish list, gym week, music) you send. They are kept to be delivered to your friends and for as long as you choose in the conversation.
• Device keys: each phone gets a secret key that proves it is yours. The server only keeps a fingerprint of it. You can sign out other devices in Settings, Backup.
• Daystrand+ subscription (iPhone app): the type of subscription, its end date and the transaction number Apple sends us, to know what is unlocked. Payment is made by Apple: we never receive your payment details or your Apple ID.
• Spotify (optional): if you link your Spotify account to share what you listen to, we keep the access tokens Spotify gives us, only to read your recent and current plays. We never post anything on your Spotify. You can remove access in the app or in your Spotify account settings.
• Error reports: when the app crashes, a short technical report (error message and device type) helps us fix it. It does not contain your journal.
• Reports and support requests: what you send us, with the reported content, so we can act on it.

4. AI meal analysis (Daystrand+)

When you ask the app to estimate a meal, the photo, your voice note or your text are sent for analysis. A voice note is first transcribed by Cloudflare (Workers AI, Whisper model), then the photo or text is sent to Anthropic (United States), which returns a list of foods with estimated calories and nutrients. Under its commercial terms, Anthropic does not use this data to train its models.

Our servers keep neither the photo nor the recording after the analysis: only the result is written to your journal, on your phone. We keep a technical log of each analysis (install identifier, date, type, size and cost, without the content) for 12 months. Analysis is limited to 25 per day per install. Estimates can be wrong: check them, especially with an allergy or a medical diet.

5. Health data

Your pills, cycle, mood, weight and nutrition are sensitive information. They are only used to make the app work for you. They are never sold, never used for advertising or marketing, and never shared with a third party, unless the law requires it or in the cases described in sections 4 and 6. By turning on backup or the AI analysis, you expressly consent to this data being processed as described here. Daystrand does not replace the advice of a health professional.

6. Where the data is kept, and by whom

Daystrand's servers are provided by Cloudflare. The main database (backups, accounts, messages, photos and videos) is hosted in eastern North America. Some technical data (settings, rate limits, caches, Spotify tokens) is replicated across Cloudflare's global network to keep the app fast. Emails (confirmation codes) are sent by Resend, in the United States. iPhone app notifications go through Apple. The AI analysis goes through Cloudflare and Anthropic, in the United States.

Your data may therefore be processed outside Quebec. We chose these providers after assessing the protection they offer (encryption in transit and at rest, access control, contractual confidentiality commitments).

7. Services used during your searches

When you search for a film, a book, a food, an exercise, a song or a GIF, your search is sent to that service, usually through our server: TMDB (films and series), Open Library and Google Books (books), Open Food Facts and Health Canada (food), ExerciseDB (exercises), Apple iTunes, Deezer and Spotify (music), Klipy (GIFs and stickers) and Wikipedia (biographies). Images from these services may load directly from their servers. None of your journal data is sent to them.

8. Cookies and tracking

• No advertising, no selling or renting of your data.
• No tracking or advertising analytics, no profiling.
• A single technical cookie on daystrand.app (ds_lang) remembers the language you chose for the website. The app itself keeps your data in your phone's local storage, not in cookies.

9. Who can see your data

Your messages are visible to the people you send them to. The operator has technical access to the servers and only looks at data when needed to answer your request, handle a report, keep the service secure or comply with the law. Actions taken from the admin tool are written to a log. Messages, photos and backups are not end-to-end encrypted: they are encrypted in transit and at rest, but the operator could technically read them.

10. How long

• Messages follow the duration chosen in the conversation; little notes disappear after 24 hours.
• The backup, account, profile and device keys stay until you delete them. We do not delete an install because it is inactive.
• Error reports, abuse reports, support requests and the technical log of AI analyses are kept for at most 12 months.
• Photos and voice notes sent for AI analysis are not kept on our servers.

11. Your rights

At any time, you can:

• Delete your account and all your data right in the app: Settings, Delete my account and data. Everything is erased from our servers: backup, account, profile, friends, messages, photos, videos, device keys and Spotify tokens.
• Get a copy of your journal, in a structured format, with the Export feature in the calendar or Backup, Download a file.
• Correct your information directly in the app.
• Withdraw your consent: turn off backup, notifications, the AI analysis, the Spotify link or the social features.
• Sign out other devices in Settings, Backup.
• Write to us for any access, correction or deletion request, or to file a complaint. We answer within 30 days. You can also contact the Commission d'accès à l'information du Québec.

12. Security

All connections use HTTPS, with HSTS. Passwords are hashed, each phone has its own key, requests are rate-limited to block abuse, and the admin tool is protected by two-step authentication. If a privacy incident creates a risk of serious harm, we will notify you and the Commission d'accès à l'information, as the law requires.

13. Age

Daystrand is not meant for children under 14. If you are under 14, a parent or guardian must consent for you before you use the app.

14. Changes

If this policy changes in an important way, we will tell you in the app before the change applies. The date at the top of this page shows the version in force.