Privacy Policy

Last updated: August 1, 2026

Daily-flow ("Daily-flow," "we," "us," or "our") provides a service that connects to your email, calendar, and other accounts you choose to link, and organizes what it finds into a single daily list of commitments and priorities (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information we collect

1.1 Account information

When you sign up, we collect your name and email address, and information necessary to process payment for paid plans (handled by our payment processor, Stripe — see Section 4).

1.2 Information from connected accounts

The Service is built around connecting third-party accounts you authorize, including Google, Yahoo Mail, and Outlook.com/Hotmail accounts. When you connect a Google account, we request access to:

• Gmail (read-only) — to identify messages containing commitments, deadlines, and other items relevant to your goals.
• Calendar (read-only) — to identify upcoming events and recurring commitments.
• Your Google account email address — to identify which account is connected.

When you connect a Yahoo Mail account, we request access to:

• Yahoo Mail (read-only, via IMAP) — to identify messages containing commitments, deadlines, and other items relevant to your goals.
• Your Yahoo account email address — to identify which account is connected.

Yahoo Mail connectivity is Mail-only at this time — we do not request access to Yahoo Calendar.

When you connect an Outlook.com/Hotmail account, we request access to:

• Outlook Mail (read-only, via Microsoft Graph) — to identify messages containing commitments, deadlines, and other items relevant to your goals.
• Outlook Calendar (read-only, via Microsoft Graph) — to identify upcoming events and recurring commitments.
• Your Microsoft account email address — to identify which account is connected.

Outlook connectivity is limited to personal Microsoft accounts — we do not support connecting a work or school (organizational) Microsoft 365 account.

We access only what is needed to build your daily list. We do not send email, create or modify calendar events, or take any action on your behalf through these connections.

1.3 Usage information

We collect information about how you use the Service — such as which items you mark complete, dismiss, or rate with feedback (thumbs up/down) — to operate and improve the Service, including improving the accuracy of what we surface to you.

2. How we use your information

We use the information we collect to:

• Extract and classify commitments, deadlines, and goal-relevant items from your connected accounts;
• Build and update your daily list of what matters;
• Operate, maintain, and improve the Service, including using your feedback (e.g., thumbs up/down, completions, dismissals) to improve classification accuracy;
• Communicate with you about your account, including service notices and — with your consent where required — product updates;
• Process payments and manage subscriptions;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations.

We do not sell your personal information, and we do not use content from your Gmail, Calendar, Yahoo Mail, or Outlook Mail/Calendar data for advertising purposes.

3. Google API Services User Data Policy (Limited Use disclosure)

Daily-flow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through Google APIs (Gmail and Calendar) is used only to provide and improve the user-facing features of the Service described in this policy. It is not used to serve advertisements, and it is not transferred to third parties except as described in Section 4 (Service Providers) or as required by law.

The same limited-use commitment applies to data obtained through your connected Yahoo Mail account (via IMAP) and your connected Outlook.com/Hotmail account (via Microsoft Graph): it is used only to provide and improve the user-facing features of the Service described in this policy, it is not used to serve advertisements, and it is not transferred to third parties except as described in Section 4 (Service Providers) or as required by law.

4. Service providers we share data with

We use a small number of third-party service providers to operate the Service. Each is contractually bound to use data only to provide their service to us.

• Google Cloud Platform — hosting, and Firestore for storing your account data and extracted commitments.
• Anthropic — the Service sends relevant text from your connected accounts to Anthropic's API to classify it (e.g., "is this a commitment?", "does it relate to a goal?"). Anthropic does not use this data to train its models under our commercial agreement with them.
• Stripe — payment processing for paid plans. We do not store your full payment card number; Stripe handles it directly.
• Google (OAuth / Gmail / Calendar APIs) — as described in Section 1.2 and Section 3.
• Yahoo (OAuth2 / Mail via IMAP) — as described in Section 1.2 and Section 3, for accounts you choose to connect via Yahoo Mail.
• Microsoft (OAuth2 / Microsoft Graph) — as described in Section 1.2 and Section 3, for accounts you choose to connect via Outlook.com/Hotmail.

5. Data retention and deletion

We keep account information (your name, email, and billing details) for as long as your account is active, so you can keep using the Service.

Content we extract from your connected email and calendar accounts — such as the specific text of a message or event we used to identify a commitment — is kept for up to 35 days from when it was extracted, then automatically deleted. We keep it this long, and no longer, so the Service can continue showing you accurate, up-to-date items and so we can measure and improve how accurate our extraction is over that window.

If you dismiss an item as not useful, we go further: the underlying message or event content is deleted immediately, and the remaining record (which no longer contains any of your content) is fully deleted within 7 days.

With your separate, explicit permission, we may keep a small number of real examples longer — up to 12 months — in a dedicated, limited-access set used only to test and improve extraction accuracy. This is never done automatically: it requires your specific opt-in, separate from simply using the Service, and you can withdraw that permission at any time.

You can disconnect a Google, Yahoo, or Outlook account at any time from your account settings, which stops further access to that account. To request deletion of your account and associated data, contact us at [privacy@daily-flow.io]. We will delete or anonymize your data within a reasonable time, except where we are required to retain it by law (for example, billing records).

6. Security

We use industry-standard measures to protect your information, including encryption in transit (TLS), encryption at rest for stored data, OAuth-based authentication (we never see or store your Google password), and access controls limiting who can access production data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your rights

Depending on where you live, you may have rights under applicable law (such as the EU/UK GDPR or the California Consumer Privacy Act) to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To exercise any of these rights, contact us at [privacy@daily-flow.io]. We will respond within the timeframe required by applicable law.

You can also revoke Daily-flow's access to your Google account at any time via your Google Account permissions page. For an Outlook.com/Hotmail account, disconnecting in Daily-flow removes our locally-held access immediately, but Microsoft does not offer us a way to instantly revoke that access on their end — you can review or remove Daily-flow's access directly from your Microsoft account's app permissions if you want to be certain it's fully revoked.

8. International data transfers

Our infrastructure is hosted on Google Cloud Platform. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate, which may have different data protection laws than your country of residence.

9. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us at [privacy@daily-flow.io] and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the change takes effect. The "Last updated" date above reflects the most recent revision.

11. Contact us

Questions about this Privacy Policy or your data can be sent to [privacy@daily-flow.io], operated by [Daily-flow, Inc. — legal entity name to be confirmed].