Legal
Privacy Policy
Last updated:
This page explains what Tellday collects, why, where it goes, and what you can do about it. It describes what the product actually does today — not what a template says a product usually does.
1.Who is responsible
Tellday is operated by Andrii Plyska, sole proprietor, registered in Ukraine — the "controller" of your data in the sense of the GDPR and Ukrainian data protection law. For anything about your data, write to support@tellday.app. We reply within 30 days, usually much sooner.
2.What we collect
Only what the product needs to work. There is no advertising profile, no analytics tracking and no data bought from or sold to anyone.
| Category | What exactly | Why |
|---|---|---|
| Account | Email address, name, an optional avatar (stored as an image in our database), and a hash of your password — never the password itself. | To create the account, sign you in and send the emails that keep it safe. |
| Your records | Habits and their targets; daily check marks and time spent; mood (1–5) and diary notes; day-plan tasks. | This is the product: your grid, your statistics, your diary. |
| Preferences | Language, theme, accent colour, table layout, hidden statistics widgets, assistant settings (on/off, diary access, form of address) and the moment you gave consent. | So the app looks the same on every device and remembers your choices. |
| Assistant output | Letters and insights the assistant wrote for you, and a per-day count of requests. | To show them to you again, and to apply the daily quota. |
| Security log | Email address and IP address at sign-up, sign-in and session refresh. | To notice break-in attempts and abuse. |
| Technical | Three cookies and a few browser-storage keys — see “Cookies and browser storage”. | To keep you signed in and remember display settings. |
We do not collect your location, contacts, device identifiers, or anything about you from other websites.
3.Why we process it, and on what legal basis
- To provide the service you asked for — performance of a contract (GDPR art. 6(1)(b)). This covers your account, your records, your preferences, and the emails needed to run them: the verification code, password reset links, and notices that your password was changed or your account deleted.
- To keep the service safe — our legitimate interest (art. 6(1)(f)). This covers the security log, rate limiting, and the security emails you cannot switch off.
- To run the AI assistant — your consent (art. 6(1)(a)), given separately inside the app and revocable at any time. Letting the assistant read your diary needs a second, separate consent.
4.The AI assistant
The assistant is off until you switch it on. When you do, the relevant data goes to Groq, Inc. (USA), which runs the language model that writes the replies.
What it sees: the names of your habits, your check marks and time, your mood, and statistics derived from them. Your diary text is sent only if you separately allow “Let the assistant read the diary.” Without that permission, notes never leave our database.
Your data is not used to train models. Our provider's terms prohibit training on customer data. Requests are processed to produce a reply; we do not keep chat history. The assistant's letters and insights are stored so you can reread them — and you can delete them at any time.
Safety screening. The same text is also checked, in a separate call to the same provider, for signs that you might be in crisis, so the assistant can answer with care and show support resources. This is not a diagnosis, nobody at Tellday reads it, and it involves no data the assistant was not already given.
Switching off. Settings → Assistant. “Delete assistant data” removes every letter and insight immediately; export is available in the same place.
5.Where your data lives, and who helps us process it
We do not run our own servers. These companies process data strictly on our instructions, under data-processing agreements, and only for the role listed:
| Provider | Role | Location |
|---|---|---|
| Neon, Inc. | The database — all your records. | Frankfurt, Germany (EU) |
| Vercel, Inc. | Hosting and running the application. | Compute in the EU; Vercel is a US company |
| Resend, Inc. | Sending transactional emails. | Ireland (EU) |
| Groq, Inc. | The language model behind the assistant — only if you enable it. | USA |
| Upstash, Inc. | Short-lived request counters for rate limiting: an IP address or user ID, kept for 15 minutes. | EU |
| Sentry (Functional Software, Inc.) | Error monitoring: when something breaks, it receives the error, the file and line it happened in, and the route — deliberately without request bodies, cookies, headers or your identity. | Frankfurt, Germany (EU) |
Transfers to the USA (Groq, and Vercel's corporate access to its own infrastructure) rely on the providers' standard contractual clauses approved by the European Commission.
7.How we protect it
Everything travels over HTTPS. Passwords are stored as bcrypt hashes; sign-in and email tokens as SHA-256 hashes — a copy of our database would not reveal either.
Data at rest is encrypted by our database provider. It is not end-to-end encrypted: technically, Tellday can read your records. That is what lets the assistant work and lets us restore your access when something breaks. Nobody reads them for any other reason, and nobody does so as a matter of routine. If your diary needs stronger guarantees than that, Tellday is not yet the right place for it — we would rather say so plainly.
8.How long we keep it
- Your records and account — for as long as the account exists. Deleting the account erases everything at once (see “Your rights”).
- Sign-in sessions — 30 days without use, then removed automatically. Email codes and reset links — 30 minutes and 1 hour respectively, then removed.
- Security log — for a limited period defined by our hosting provider's log retention, then gone.
- Emails we sent you — our email provider keeps delivery records for a short period, for troubleshooting.
9.Your rights, and how to use them
- Delete everything. Settings → Profile → Delete account. It asks for your password, then removes your account and every record — immediately and irreversibly. No archive, no grace period. You will receive one last email confirming it.
- Export. The assistant's data can be exported from Settings today. A full export of all your records is on our roadmap; until it ships, write to support@tellday.app and you will receive it within 30 days in a machine-readable format.
- Correct. Name and avatar — in Settings. Email address — write to us.
- Withdraw consent. Switch the assistant, or its diary access, off in Settings. What was processed before stays lawful; nothing new is sent.
- Access, object, restrict. Write to support@tellday.app.
- Complain. If you believe we handle your data unlawfully, you can complain to a supervisory authority — in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the data protection authority of your country. We would rather hear from you first, but you do not have to.
10.Age
Tellday is for people aged 16 and over. If you learn that someone younger has an account, tell us and we will remove it.
11.Changes to this policy
When something that matters changes — a new processor, a new purpose — we tell you by email or in the app before it takes effect. Clarifications that change nothing about how your data is handled are simply published here with a new date.
12.Contact
support@tellday.app — for anything about your data, and for everything else too. One address, read by a person.