Dayline AI

PRIVACY POLICY

Last Updated: October 14, 2026

Introduction

This Privacy Policy explains how AllBlazing BV ("we," "our," or "us") processes your personal data when you use Dayline AI ("App"). Your use of the App is also governed by our Terms (EULA). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the Dutch GDPR implementation law (UAVG), and Apple's App Store requirements. This policy is written in clear language so you can understand what data we collect, why we use it, and how you can control it.

Summary (At a glance)

What we collect: Health data from Apple Health (with your consent). Raw samples stay on your device. Daily summaries may be stored in Firebase, as described below. Approximate location at city level only (for weather, with your consent). If you enable Apple Calendar, or connect Google Calendar (Pro, optional, read-only), event titles, start and end times, busy/free status, and your RSVP from calendars you select. Birthday and holiday feeds, and cancelled or declined events, are excluded. Locations, descriptions, attendees, and attachments are not read. Titles are processed to measure schedule load and identify lifestyle themes, then discarded rather than kept as calendar records. Only derived calendar values are stored in Firebase. If you turn it on, subject and body text from at most 12 recent Outlook messages, used to derive lifestyle themes (raw email text is not kept). We also store app preferences and optional connector inventories you confirm.

How we use it: To generate your daily Dayline insight and to provide app functionality. Google user data is used only for that user-requested functionality. We do not sell your data. We do not use your data for tracking or advertising purposes.

Sharing: Health summaries and connected-source data described in "AI-Powered Processing and Third-Party Services" may be sent to the OpenAI API to generate insights, and to analytics services for app performance. We use appropriate safeguards for any transfers outside the EEA.

Your control: You can withdraw Health and Location access in iOS Settings. Revoking Calendar access in iOS Settings stops future reading. It does not remove derived values already stored. Turn Apple Calendar off in the App, or disconnect Google Calendar in the App, to remove that provider's derived values. Outlook and Google Calendar are optional. You can request access, deletion, or export by contacting us. We respond within 30 days.

Data Controller

AllBlazing BV
c/o Dayline AI, Buitenwatersloot 81
2613 TB Delft, The Netherlands
KvK: 83648941
Email: support@daylineai.com

Types of Data We Process

Health Data: We access Apple Health only with your explicit consent. Raw samples remain on your device and are not stored on our servers. Daily summary values are stored in Firebase under a pseudonymous app user ID. Those summaries may include sleep duration and timing, heart rate variability, resting heart rate, steps, exercise minutes, daylight, VO2 max, and Bio Age estimates. They are used for personal baselines, trends, Battery, Bio Age, and Dayline generation, and may be sent to the OpenAI API as described in "AI-Powered Processing and Third-Party Services" below.

Location (Apple Weather): With your permission, we use Apple Weather, which may use your approximate location at city level only. We do not access, store, or use precise location (e.g. GPS coordinates). City-level location is used only to provide weather context for your Dayline.

Calendar (Apple Calendar and/or Google Calendar): Apple Calendar access is granted through iOS permissions. You select calendars under Settings → Apple Calendar → Choose calendars. Google Calendar is optional, available on Pro, and uses read-only access to calendars you select. Both integrations read event titles, start and end times, busy/free status, and your RSVP. Birthday and holiday feeds, and cancelled or declined events, are excluded. Locations, descriptions, attendees, and attachments are not read. Event titles are processed temporarily to measure schedule load, classify meeting purpose, and identify lifestyle themes. Apple Calendar titles are first processed on your device. If you are a Pro user and Calendar Insights is on, those titles are also sent to our server. Google Calendar titles are retrieved on our server. Titles are discarded after that processing and are not stored as calendar records. The only calendar values we keep in Firebase are derived, and each value is tagged Apple or Google: hours booked and event count; first and last event times; early-start, late-evening, and long-block flags; workout, travel, social-evening, and focus-block flags; meeting purpose categories; free-window times; and lifestyle theme levels. How long they are kept is set out in Data Retention below. Turning Apple Calendar off in the App removes Apple-derived stored values. Google-derived values remain if Google Calendar stays connected. Disconnecting Google Calendar in the App removes that connection, the related cache, and Google-derived stored values. Google access is revoked when no other Google connection needs it. Days saved before values were tagged by calendar are removed on disconnect when Apple Calendar is off. If Apple Calendar is still on, those older days stay until the normal 7-day or 120-day expiry. Days saved from now on are tagged and are removed on disconnect. Revoking Calendar permission in iOS Settings stops future reading and does not remove derived values already in Firebase.

Outlook (Pro, optional): Email integration is off by default and uses Microsoft Outlook only. Connecting an Outlook account via OAuth authorises us to read subject and body text from at most 12 recent messages to derive lifestyle themes for your Dayline. We do not keep raw message text after processing. We may retain OAuth tokens, message counts, and lifestyle themes. What is sent to the OpenAI API is described in "AI-Powered Processing and Third-Party Services" below. Legal basis: your consent (GDPR Art. 6(1)(a); Netherlands AVG). Microsoft processes authentication under its policies. Disconnect anytime in Settings.

App Data: We store locally on your device: widget display settings, Dayline history (7 days on Free, 120 days on Pro), health baselines, optional connector inventories you confirm (e.g. fridge/cupboard/supplement lists, Screen Time summaries), and your calendar and Outlook preferences. This data is stored using iOS UserDefaults and App Groups.

Purposes of Processing

We process your data only for the following purposes: (1) to generate and display your daily Dayline insight; (2) to provide weather context using city-level location; (3) to contextualize your day using calendar-derived values from Apple Calendar or Google Calendar when you have enabled that source; (4) to contextualize your day using Outlook message counts and lifestyle themes derived from subject and body text of at most 12 recent messages when you have enabled Outlook; (5) to operate and improve the App (including analytics). We do not process your data for any other purpose. You are not legally required to provide data to us; however, without health data we cannot provide the core Dayline feature. Location, calendar, and Outlook are optional and can be denied or disabled at any time.

Legal Basis for Processing (GDPR Article 6 and 9)

  • Health Data (Special Category Data under GDPR Article 9): Processed based on your explicit consent. You provide consent when you grant Apple Health permissions. You can withdraw consent at any time through iOS Settings > Privacy & Security > Health > Dayline AI.
  • Location (city only): Processed based on your explicit consent when you enable Apple Weather or location for the App. You can withdraw consent in iOS Settings > Privacy & Security > Location Services > Dayline AI.
  • Calendar (titles, times, busy/free status, and your RSVP, then derived values only): Processed based on your explicit consent when you grant Apple Calendar access or connect Google Calendar. You can turn Apple Calendar off in the App, or disconnect Google Calendar in the App. Revoking iOS Calendar permission stops future reading. It does not remove derived values already stored. See Data Retention and the Calendar section above.
  • Email (Outlook, subjects and content for lifestyle themes): Processed based on your explicit consent when you enable Outlook in the App and connect an Outlook account. Outlook is optional, available on Pro, and disabled by default. Subject and body text from at most 12 recent messages is processed ephemerally to derive themes and is not retained as a mailbox copy. You can withdraw consent at any time by turning off Outlook or disconnecting the account in App settings.
  • App Preferences: Processed based on contract performance (necessary to provide the App's functionality).
  • Analytics: Processed based on legitimate interest (improving app performance and user experience). You can opt out via iOS Settings > Privacy & Security > Analytics.

Note: Health data is considered 'special category data' under GDPR, requiring explicit consent. Withdrawing consent will disable the App's core functionality, as health data processing is essential for generating insights.

How We Use Your Data

Daily health summaries are used to calculate patterns and trends, generate your Dayline, and display Battery and Bio Age. Those summaries, not raw Apple Health samples, may be sent to the OpenAI API. We do not sell your data or use it for advertising.

City-level location is used only for weather context. Calendar titles are used only for the processing described above, then discarded rather than kept as calendar records. A Dayline may refer to a calendar event in general terms. The App keeps recent Dayline history on your device: 7 days on Free and 120 days on Pro. The server separately keeps recent Dayline sentences so the same suggestion is not repeated: up to 7 days on Free and 14 days on Pro. In those server sentences, calendar titles are replaced with general descriptions, such as "client meeting". That repetition-prevention memory is not the same as Dayline history on your device. When Outlook is enabled, subject and body text from at most 12 recent messages is read to derive lifestyle themes; raw message text is not kept on our servers.

Data Storage and Security

Data Storage Locations:

  • Health Data: Raw Apple Health samples stay on your device. We do not store those raw samples on our servers. Daily summaries are stored in Firebase under a pseudonymous app user ID and may be sent to the OpenAI API, as described in "AI-Powered Processing and Third-Party Services" below.
  • App Data: Stored locally on your device using iOS UserDefaults and App Groups (widget data sharing).
  • Location & Calendar: We do not store your precise location. City-level location is used to fetch weather. We do not store calendar records of titles, locations, descriptions, attendees, or attachments. Firebase holds only the derived calendar values listed in the Calendar section, tagged by provider. While Google Calendar is connected, a cache of derived information, not raw event titles, is kept separately from those stored values. The cache is refreshed when the app syncs and the previous copy is older than about 15 minutes. It is deleted about eight days after the last sync. Firestore may take up to a day after that to remove the document.
  • Email (Outlook): We do not store full Outlook emails, attachments, or your entire Outlook mailbox. Subject and body text from at most 12 recent messages may be read to derive lifestyle themes, then discarded. We may retain OAuth tokens, message counts, and lifestyle themes — not raw mailbox content.
  • Cloud Sync: We use iCloud Key-Value Store only to sync your Pro subscription status across devices (not health data).
  • Third-Party Processing: Health-derived metrics and connected-source data described in "AI-Powered Processing and Third-Party Services" may be sent to the OpenAI API. Analytics services receive aggregated usage data, as described in that section.

Security Measures:

  • All data on your device is encrypted using iOS security features
  • Health data access requires explicit user consent via iOS Apple Health permissions
  • Outlook requires your explicit opt-in in the App; subject and body text from at most 12 recent messages may be read ephemerally to derive themes, then discarded — we do not keep a mailbox copy
  • API communications use industry-standard encryption
  • We implement data minimization: only necessary data is processed

Data Retention

Daily health summaries, calendar-derived values, Life Score history, and pattern records are kept for 7 days on Free and 120 days on Pro. Once that period has passed, the data is no longer available in the App and is then removed by Firestore's expiry mechanism. That removal is not promised within a fixed 24-hour window. Health baselines use the same periods. Dayline history on your device follows those same 7-day and 120-day limits. Server sentences kept only to avoid repeating a Dayline are kept for up to 7 days on Free and 14 days on Pro. If you move from Pro to Free, history older than seven days stops being available in the App. Pro records already stored may remain until their original expiry, and not beyond 120 days. The Google Calendar cache holds derived information, not raw event titles. It is deleted about eight days after the last sync. Firestore may take up to a day after that to remove the document. WhatsApp conversation context is kept only to operate that chat. It is not part of the 7-day or 120-day history. OAuth tokens, connection status, WhatsApp linking, and usage counters needed to run a connected service are kept while that service stays connected. Raw Outlook message bodies are not retained after theme extraction. Outlook tokens, message counts, and derived themes may be kept under the rules above. Google Calendar data and Outlook message data sent to the OpenAI API use store: false. OpenAI may separately retain API data in abuse-monitoring logs for up to 30 days. That retention is separate from model training. Settings → Delete All Data removes your server-side data, including derived calendar values, health summaries, and server Dayline sentences, and revokes Google access where it is no longer needed. Dayline history kept on the device is separate and is not removed by that server deletion. OpenAI abuse-monitoring logs are not deleted by that control.

AI-Powered Processing and Third-Party Services

Dayline AI uses the OpenAI API to generate personalized Dayline insights and to derive limited lifestyle context from data sources that you choose to connect.

OpenAI API

  • Provider: OpenAI
  • Service: OpenAI API
  • Account: Pay-as-you-go API account
  • Integration: Directly from Dayline AI's Firebase Cloud Functions to the OpenAI API. Dayline AI does not use an aggregator, gateway, model hub, or consumer ChatGPT product to process Google Calendar data or Outlook message data.

The following OpenAI models process calendar or Outlook data. Each request sets store: false:

  • gpt-4.1-mini — temporarily processes Apple or Google Calendar event titles to derive lifestyle theme levels, and subject and body text from at most 12 recent Outlook messages for the same purpose. Titles and message text are not kept as records after that processing.
  • gpt-5.5-2026-04-23 — generates the Dayline from derived health and calendar information. It may receive a short description drawn from today's titles, such as "11–12 client demo", so the suggestion can be specific. Those descriptions are not stored as calendar records.
  • gpt-5.4-mini-2026-03-17 — supports WhatsApp and in-app chat. It receives derived data, not raw calendar titles.

These are the only OpenAI models that process this calendar and Outlook data.

Locations, descriptions, attendees, and attachments are not read and are not sent to OpenAI. Sending a title or a short description to a model for a single request is not the same as storing it in Firebase or in Dayline history.

The Google Calendar integration is optional and is enabled by the user.

Dayline AI does not use raw, aggregated, anonymized, or derived Google Calendar data to create, train, or improve generalized or foundational artificial intelligence or machine-learning models.

OpenAI states that data submitted through the OpenAI API is not used to train or improve OpenAI models unless the API customer explicitly opts in to data sharing. Dayline AI has not opted in to sharing API inputs or outputs for model training or improvement.

API requests that include health summaries, calendar titles or short descriptions, or Outlook message text are made with store: false.

OpenAI may separately retain API data in abuse-monitoring logs for up to 30 days by default in accordance with its API data-retention policies. This retention is separate from model training.

Google Calendar data is not sold, used for advertising, transferred to data brokers, or used for unrelated profiling or other secondary purposes.

AI processing may occur outside the European Economic Area (EEA). Where required, we use appropriate safeguards for international transfers, including applicable Standard Contractual Clauses approved by the European Commission.

AI-generated insights are informational only and may contain errors or inaccuracies. They are not medical diagnoses or professional health advice.

Dayline AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the functionality you request. It is not sold, used for advertising, transferred to data brokers, used for unrelated purposes, or used to train general-purpose AI models. People at Dayline AI do not read Google user data except where that policy permits it, including with your agreement, for security, to comply with the law, or where the data is aggregated for internal operations.

Outlook (Microsoft): when you connect Outlook, subject and body text from at most 12 recent messages may be sent to gpt-4.1-mini solely to derive lifestyle theme levels, with store: false. Raw message content is not displayed or retained by Dayline AI after processing. Whether a reply is required is classified in our Firebase Cloud Function, not by an AI model.

Sub-processors: We use sub-processors (OpenAI and our analytics provider) to provide the App. We have contracts in place that require them to process data only on our instructions and to protect your data in line with GDPR (Article 28).

Analytics: We use Firebase Analytics and Google Analytics 4 (GA4) in the App for basic, aggregated usage and performance. Data is anonymized and does not include health data. You can limit device analytics in iOS Settings > Privacy & Security > Analytics.

No tracking or advertising: We do not use your personal data for cross-app or cross-website tracking, and we do not use your data for advertising purposes. Data is used only to provide the App's functionality and to improve the App.

Your Rights Under GDPR

As a data subject under GDPR, you have the following rights regarding your personal data:

  • Right of Access (Article 15): Request a copy of all personal data we hold about you. View cached insights through Settings > Insight History, or contact support@daylineai.com for a complete export.
  • Right to Rectification (Article 16): Correct inaccurate data. Modify app preferences in Settings. Health data accuracy depends on your devices and Apple Health.
  • Right to Erasure (Article 17): Request deletion of your data. Delete all app data via Settings > Delete All Data, or contact support@daylineai.com. Note: Data previously processed through the OpenAI API may remain temporarily in OpenAI abuse-monitoring logs in accordance with OpenAI's API data-retention policy. This limited retention is separate from model training.
  • Right to Restrict Processing (Article 18): Limit how we process your data. Revoke Apple Health permissions in iOS Settings > Privacy & Security > Health > Dayline AI. You can also revoke location (Location Services > Dayline AI). Revoking Calendar access in iOS Settings > Privacy & Security > Calendars > Dayline AI stops future reading and does not remove derived values already stored. Turn Apple Calendar off in the App, or disconnect Google Calendar or Outlook in the App, to remove that connection. Use Settings → Delete All Data to remove server-side data.
  • Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format. Contact support@daylineai.com to request an export of your insight history.
  • Right to Object (Article 21): Object to processing based on legitimate interests. Withdraw consent at any time through iOS Settings. You can also disable analytics in iOS Settings > Privacy & Security > Analytics.
  • Right to Withdraw Consent: You may withdraw consent for health data processing at any time through iOS Settings. This will disable the App's core functionality.

To exercise any of these rights, contact us at support@daylineai.com. We will respond within one month, as required by GDPR (or explain in writing if we need an extension). If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (see Supervisory Authority below).

Children's Privacy

The App is intended for users aged 18 and over. Under GDPR, valid consent for health data processing requires users to be 18+ (or parental consent for younger users). We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data, contact us at support@daylineai.com and we will delete it promptly.

Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will:

  • Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach
  • Notify you without undue delay if the breach poses a high risk to your rights
  • Provide clear information about the nature of the breach, likely consequences, and measures taken

Raw Apple Health samples are not stored on our servers. Daily summaries and derived calendar values may be. Data sent to the OpenAI API is subject to the safeguards described in "AI-Powered Processing and Third-Party Services." A breach could affect those stored summaries and values, and app data on your device.

Website cookies (daylineai.com)

Our website uses strictly necessary cookies and, with your consent, Google Analytics 4 for aggregated usage data. We do not use advertising or profiling cookies on this site. You can change your choices at any time via in the footer, or our Withdrawal form (EU) for subscription withdrawal requests.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the App or via email. The "Last Updated" date at the top indicates when this policy was last revised.

Contact Us

For questions about this policy, to exercise your rights, or for data protection concerns, contact us at support@daylineai.com. We aim to respond within 30 days as required by GDPR.

EU AI Act Compliance

Dayline AI uses artificial intelligence to generate personalized wellbeing insights and recommendations. The service is designed for informational and general wellbeing purposes and is not intended to diagnose, prevent, monitor, predict, or treat disease, make medical decisions, or replace professional healthcare advice.

We assess Dayline AI against the requirements of the EU Artificial Intelligence Act based on its intended purpose, functionality, and applicable legal classification. Where obligations under the AI Act apply, we implement appropriate measures relating to transparency, human oversight, data governance, risk management, and user information.

AI-generated outputs may be incomplete or inaccurate and should not be relied on as the sole basis for medical, legal, employment, insurance, or other high-impact decisions.

We monitor regulatory guidance and will update our compliance measures as the EU AI Act and related guidance develop.

Supervisory Authority

You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Website: autoriteitpersoonsgegevens.nl
Phone: +31 (0)70 - 888 85 00
Address: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, The Netherlands

Download