What happens to what you write

• Your account: email address, name if you give one, time zone and preferences. A password, if you set one, is stored only as a one-way hash. If you sign in with Google or Apple, we receive the name, email address and account identifier they share, never your password.
• What you put into Dayora: entries, moods, conversations, voice notes and call recordings, photos (including a selfie, if you add one), the people in your Circle, letters, and what Dayora writes back to you. Dayora also keeps short notes about you that it remembers between conversations; you can see, edit and delete them.
• How you use the app: which parts you use, device and browser type, IP address and approximate location, error reports, and anonymous page-speed measurements.
• Payments: if you subscribe, a record of what you bought. Card details go to the payment processor (or Apple, in the iPhone app) and never reach Dayora.

Dayora is built on AI models from third-party AI providers, and it uses several of them, sometimes more than one for the same task. Everything you put into Dayora, including your entries, conversations, voice notes, calls, photos and what Dayora writes back, may be sent to these models. They use it to run Dayora: to write its replies, turn speech into text, run calls, understand photos and paint portraits, and to read, sort, tag and route what you write and decide what Dayora shows or asks you next. Dayora also sends content to AI models to test, compare and check the quality of the service, and to build and improve its features.

Which models and providers Dayora uses changes as better or more suitable ones become available, and Dayora may try new ones alongside the ones it already uses. Everything on this page applies to whichever models and providers Dayora uses at the time.

In the newer version of the app, Settings has a switch that turns AI off. While it is off, nothing you write, record or say is sent to an AI provider.

It can be. Dayora may use your information, including your entries, conversations, recordings and photos, to train, fine-tune, test and improve the AI models and features that power Dayora.

The AI providers Dayora uses may also use what Dayora sends them to train and improve their own models. Some of Dayora's agreements with providers work this way: the provider may learn from the content, and Dayora gets free or reduced-cost usage in return, which helps keep the core of Dayora free.

Dayora never sells your entries to advertisers, data brokers or anyone else.

In practice, your journal is not a sealed room. If that is not a trade you want, you can export everything and delete your account at any time (see deleting your account). What has already been used to train or improve a model cannot be taken back out of it.

• You can.
• The Dayora team. Authorised people working for Dayora can access and review everything in your account: your entries, moods, conversations, voice notes and call recordings, photos, the people in your Circle, letters, and what Dayora writes back. They do this to check and improve the quality of Dayora, to test and build it, to keep it safe and secure (for example to protect you or someone else, or to prevent or investigate misuse, fraud or a security incident), to give support, and to meet legal obligations. They see it in Dayora's admin tools, in copies sent to the team for quality review, and in working copies of the database they use to build and fix Dayora.
• Nobody else who uses Dayora can see it, unless you choose to send or share something yourself. There is no public profile and no feed.

Dayora never sells, rents or trades your personal information. It shares data only with:

• AI providers, as described above.
• Service providers that run Dayora: hosting and file storage, the database, email delivery (some emails quote a line you wrote, and the email service tells us when an email is opened or a link is clicked), error monitoring (which may record a replay of part of a visit, with the text on screen hidden), product analytics (which knows your account, email address and first name, never what you write), payment processing, and a weather service that receives your city's location, never your exact place.
• Google, for analytics and advertising on Dayora's public website only, subject to your cookie choice (see cookies), and to confirm who you are if you sign in with Google. Apple, if you sign in with Apple or subscribe in the iPhone app.
• When the law requires it, or to protect people's safety or our rights.
• A buyer, if Dayora is ever sold or merged, with notice to you.

There are no ads in the app. Dayora advertises itself on Google, but never shows you ads and never sends what you write, or your email address, to an advertiser.

• When a voice note is saved as a recording, or you talk to Dayora on a call, we keep the audio itself, not only the transcript, so the team can check what Dayora heard and what it said back. When your speech is only turned into text for you to edit before saving, the recording is not kept.
• Recordings are kept with no time limit.
• You can play back a voice note on the entry it came from. Call audio has no playback screen yet, so only the Dayora team can reach it, along with the AI providers that transcribe speech and run the call. It is never sold.
• Deleting your account deletes all your recordings. Choosing "let it go" at the end of a call, or deleting the call's conversation, deletes that call's recording. Deleting a single entry does not delete the voice-note recording behind it; to remove recordings without closing your account, email human@dayora.ai.

• Every connection to Dayora uses HTTPS, and browsers are told to use nothing else.
• Every request for your journal is checked against your account.
• Sign-in, sign-up and other sensitive requests are rate limited.
• You can sign in with a password, a link emailed to you, or Google or Apple. A sign-in lasts 7 days, or 30 if you ask Dayora to remember you.
• Your email account is the key to your Dayora account, so protect it with a strong password and two-factor authentication, and do not forward sign-in links.

No system is perfectly secure. If you notice anything unusual, or find a vulnerability, write to human@dayora.ai.

Dayora uses the cookies it needs to keep you signed in and secure, and to remember your cookie choice. On the public website it also uses Google Analytics and Google Ads. Neither runs inside the app, and the app loads no advertising cookies. Whether they start straight away on the website depends on where you are:

• In the European Economic Area, the United Kingdom, Switzerland, Turkey, Quebec, Washington State and Nevada, nothing from Google loads until you choose “Accept”.
• In Connecticut, Google Analytics runs by default and Google Ads waits until you choose “Accept”.
• Everywhere else, both run by default and the cookie notice says so. Choosing “Decline” turns them off.

A Global Privacy Control signal is treated as a decline for advertising, wherever you are. Ad personalisation signals are off, and the Google Ads tag does not load on pages about topics such as anxiety, grief or trauma.

If you arrive from one of Dayora's ads and Google may run for you, we record which ad and search brought you, including the click identifier Google adds to the link, and later report a signup or a Plus purchase (with its amount) so we can tell which ads work. Choosing “Decline” deletes what was recorded; closing the notice without choosing does not. Your entries, your email address and anything you write are never sent to Google.

Separately from Google, and wherever you are, Dayora's own servers count loads of its language pages and clicks on the website's signup buttons. Each count records only the page and which button, sets no cookie, stores nothing on your device and identifies nobody.

Your account comes with the emails that are part of how Dayora works (your daily reflection, weekly patterns, letters to your future self, follow-up questions), account emails (sign-in links, receipts, plan changes), and occasional product news. Every non-essential email can be turned off in Settings and carries an unsubscribe link. We never share your address or send third-party offers. If you ask Dayora to email someone for you (a letter, or a Between Us question), Dayora uses their address only to deliver it (and, for Between Us, one reminder), the Dayora team gets a copy for quality review as it does of every Dayora email, and every such email lets them stop email from anyone on Dayora for good.

You can download everything at any time from Profile, then Account & data: the full archive as JSON, or your entries as a PDF or Word document.

You can delete your account in the same place. It happens straight away and cannot be undone. Before it goes, Dayora asks why you are leaving, and the reasons you give are sent to the Dayora team with your name.

• What deleting removes: your account, every entry, mood and conversation, your voice notes and call recordings, your photos and portraits, and the text of every request Dayora sent to an AI provider about you.
• What stays, without your words: a note that emails were sent to your address, security records of sign-in attempts, the count and cost of AI requests, and usage records.
• What deleting cannot reach: emails already in your inbox, copies already sent to the team for quality review, what AI providers keep under their own terms, models already trained or improved with it, and working copies of the database on the team's computers.
• If you only remove your photo in Profile, the file is kept for safety review until you delete your account. Some older photos on entries were stored in a way that does not show whose they are; deleting your account takes them out of your journal, but their files can stay in storage until you ask us to remove them.

You can ask to access, correct or restrict the use of your personal information, or object to how it is used, by writing to human@dayora.ai. You can also export and delete it yourself at any time, as above.

Dayora keeps your information for as long as you have an account, and deletes it as described above when you delete your account. Your information may be processed in countries other than your own, by Dayora and the providers it uses.

Dayora is not for children under 13. If we learn that we hold information from a child under 13, we delete it.

When you start a new conversation in the Chat tab on a phone, a sunrise above the box changes with how what you are writing reads, along with the short line under "I'm listening.". To decide, a check on your device and an AI model both read the words you have typed so far, before you send them and even if you never do. A moment after you pause, the AI model receives the opening of what you have typed (up to the first 600 characters) and answers with a word for its tone. That answer changes only how the sunrise looks and that one line. Dayora keeps neither the text sent nor the answer, and nothing is sent if you have turned AI off.

If this policy changes in a way that matters, we will tell you by email or in the app.

Dayora is run by Crafted in Context Pty Ltd (ACN 694 376 853), Victoria, Australia, the data controller. Write to human@dayora.ai with any question about your privacy or to report a security problem. We usually reply within 48 hours.