Privacy Notice

The short version: Daily Captain stores what you write on your sheet, your email address, and what is needed to sign you in and keep your data in sync. We never read your goals, we never train anything on them, and we do not sell your information. There is no advertising and no tracking across other websites. Site analytics runs only if you accept it, and declining changes nothing about the app. One page, the giveaway page, shows a video in YouTube's own player, and section 4 says what Google sees there. Some things you write are meant to be seen: you get a profile page of your own, which is private until you publish it, and a week you send to a buddy is read by that buddy. Everything else stays yours alone. You can join our newsletter from the app with one tick box, and it is Kit, not us, that then emails you to confirm it is really you. Deleting your account starts a 30-day grace period, after which everything we are free to erase is erased for good; the law makes us keep a paid invoice longer, and section 6 says for how long.

1. Who we are

Daily Captain is operated by Heegstra LLC, a Wyoming (USA) limited liability company at 30 N Gould St Ste N, Sheridan, WY 82801 ("we", "us"). We are the controller of the personal data described here.

Contact for anything in this notice, including privacy requests: hello@dailycaptain.app.

2. What we collect

You give us:

• Your email address, when you ask for a sign-in code, or when you sign in with Apple or Google and they pass it to us. It is the only thing we need to make an account. If you use Apple's Hide My Email, what we get is the relay address Apple made for you, and our emails reach you through it. If you arrived through a buddy's invitation we also record that, so the invitation can be matched to the account it admitted.
• Your sheet: the goals you write and which ones you tick, your midday check, and the three evening fields (one word, notes, tomorrow's first goal), each stored against a date. Goals you write for your first day before it is saved in your account, on the first sheet or on the landing page, stay on your device only: they reach us after you sign in, when your first day is saved, and become that day's sheet, as far as it has room; the rest waits on your device, for a day at most.
• Your settings: your theme, and, if you turn reminders on, your reminder times and your time zone. If you turn on any of the other notifications, which ones, and when you turned each on or off.
• Feedback, when you send it: the text you wrote, whether you ticked "allow reply", a short label for where in the app you sent it from, and your browser's user-agent string.
• Support requests without an account, when you contact support without signing in: we store your email address, message, selected topic, submission time and browser user-agent to handle your request and reply. Cloudflare Turnstile processes browser/device signals and your IP address to prevent abuse. These messages are stored separately from any account and are not deleted when an account is deleted.
• A newsletter sign-up, if you tick the box when you set up your account. It is the Heegstra newsletter, the same one at heegstra.io, and it carries both Jan's own writing and tips for using Daily Captain. Ticking sends your account's email address to Kit, who hold the list. Kit then emails you one confirmation link, and you are only subscribed once you click it. On our side we record four things: that you asked, when, the exact wording you were shown, and where in the app you were shown it. We never claim you confirmed, because only Kit knows that. There is no toggle in the app to turn it off again: unsubscribing is the one-click link in every newsletter email, which is instant and final.
• Quotes you send to the community, if you use "submit a quote": the line you wrote, and the fact that it came from your account. A person reads every submission that reaches us before anything happens to it. Lines with swearing in them are refused as you send them and never stored. If it is approved it becomes the quote of one day, with your name on it and a link to your public profile page when you have one switched on. That day's quote is public: it appears on everybody's sheet, and anyone who asks the app for that day's quote can read it without having an account. When we approve a quote we put your name on it, or your handle if you have not given a name, and we store a copy of it alongside the quote, because it is the name the quote went out under. That copy is kept for as long as the approved quote is: changing the name on your profile afterwards does not rewrite a quote already published under the old one, and clearing your profile name does not take a published quote down. Ask us and we will change the name on it or remove the quote altogether; deleting your account deletes both. The link to your profile page is not a copy: it follows the setting, so switching your public page off removes it everywhere at once. If it is rejected it is seen by nobody but us. Either way we write you a notification in the app telling you what we decided, which repeats the line you sent. Either way, too, you can have it deleted by asking us, and deleting your account deletes your submissions and those notifications with it, approved ones included.

• Your profile: the name you choose, a line about what you do, where you are, a personal quote, the handle that forms your page's address, the handle you had before, for 30 days after you change it, links to your own social profiles and a playlist, and the lines you write in your Cookie Jar. If you add a photo, we store the picture itself in our database. It must be a JPEG, at most 80 KB and 2048 pixels on a side.
• Who you follow, and who follows you: a follow is one-way and needs no approval, so following somebody records that you did and when, and it shows them in your Following list and you in their Followers list. What a follow shows about a person is only what their public page already shows, so switching that page off suspends their handle, their line and their photo in those lists; their name stays, because you already saw it when you followed. A buddy ask records that you asked, who you asked, and their answer. When a buddy ask is accepted, the two of you also follow each other, so each of you shows in the other's Following and Followers lists; either of you can unfollow and still be buddies. A like on the day's quote records that your account liked it: nothing about it is public, and nobody but us ever learns that the like was yours. We use likes to choose which quotes to keep in rotation, and the person whose quote it is can be told that it was liked, never by whom.
• Your year and your week: your yearly goals and the names you give the four categories, your Dream Year lines, the tasks you line up for next week, the note you add to a goal in the Sunday review, and the day of the week you pick for that review. We also record when you closed a day, which is what your streak counts.
• A giveaway entry, if you enter one: that your account entered, when, the Instagram handle you typed, the version of the giveaway terms you agreed to, and, if you withdraw, when. Nothing else at entry. If you are drawn we may ask you for proof of your story, and that is kept with the winner's record. We use the Instagram handle for the giveaway and nothing else: it is not added to your profile, not published, and not passed to anyone.

Your device or our systems generate:

• Sign-in material: a six-digit code, valid for 15 minutes and usable once, which we email to the address you gave and you type on the screen where you asked for it. Five wrong guesses end it, and a new code replaces the one before. We store only a hash of the code, never the code itself, plus a count of wrong guesses and the times a code was asked for, which is how the limit on asking again is kept: one code every five minutes and five an hour for an address.
• Sign in with Apple or Google, if you use it: the identifier Apple or Google gives us for you, which is a string made for Daily Captain and not the name of your Apple or Google account, and the email address they confirm is yours. On the website and in the Android app we ask them for nothing else: no name, no photo, no contacts. The Google button in the iPhone app is the one exception, and it is Google's doing, not ours: Google's own sign-in kit for iPhone always asks for your name and photo along with your address, there is no way for us to ask it not to, and Google says so on its consent screen. So the answer Google sends us from that one button also carries your name and the web address of your Google profile picture. We do not want them and we keep none of them: our code has no place to store them, they are read past and dropped in the moment of signing you in, they are never written to a log, and the kit is told to forget them on your phone as soon as your sign-in is done. Apple's button in the iPhone app asks for your email address and, the first time you use it, the name you choose to share; the web button asks for your email address only. We keep the identifier beside your account so that your next sign-in finds it, and, for Apple only, the key Apple gives us that lets us tell it later to withdraw the sign-in. If you signed in with a Google address that is not a Gmail or Google Workspace address and it already had an account here, we hold the provider's answer for up to fifteen minutes while you type the sign-in code we emailed, and then either attach it to your account or drop it. If the address they confirm already belongs to a Daily Captain account, you are signed in to that account rather than given a second one, and we email that address to say a new way of signing in was added. Apple's Hide My Email gives us an address that is new to us, so it never matches an account you already have: signing in that way makes a second, separate account, and to reach the one you have, sign in with the address it uses. In the iPhone app, Apple can also pass us the name you chose to share when you first signed in with Apple; the app uses it only to fill in the name on the setting-up screen, where you can change or clear it, and nothing reaches our servers until you save that screen.
• Session identifiers, stored hashed, so that you stay signed in for up to 90 days.
• Your first day, and the offer of the free week: the date of the day your account was made, as your device gave it, the moment we showed you the offer of the free week, and, if you said no, that you did and when. They decide whether the sheet can still be written without a membership.
• The share prompt: the highest number of goals done at which the app has already suggested you share your count (10, 25, 50, 100, then every 100), so it does not suggest it twice. Your own app sets it; nobody else sees it.
• Abuse-prevention records: a one-way hash (SHA-256) of the IP address a sign-in, code or counter request came from, so we can rate-limit. We do not store or log raw IP addresses. Newsletter sign-ups are rate-limited differently, because they happen inside your account: we note the moment of each attempt against your account and delete those notes after a day.
• Push subscriptions, if you turn on reminders or any of the other notifications: the notification token issued for that device, the user-agent string of the browser or app it came from, and the delivery status of the last push. In a browser that token is your browser's; in the iPhone app it is the one Apple's push service issues for that phone. Same thing, same purpose, same retention: it exists so the notifications you switched on can reach the device you allowed them on, and nothing else.
• Server logs, written by our host when the app answers a request. They record the event, not your content. Two of them record an email address: a sign-in code burned by five wrong guesses, and a sign-in request refused by the sign-up gate, which is off today and would only write anything if we closed it again. A third records only the part of an address after the @ sign, when a newsletter sign-up fails, so we can tell a provider-wide problem from a single bad address.
• Bot-check signals: when you request a sign-in code, Cloudflare Turnstile examines browser and device signals and your IP address to tell a person from an automated script. Cloudflare processes those signals; we receive only a pass or fail.
• Site analytics, only if you accept it: a pseudonymous browser identifier, the screens you view, approximate location derived from your IP address, and browser or device information. Never the contents of your sheet.

The invitation list. Separately from all of the above, we keep a list of invitations. Anyone can sign up now, so this is no longer a door: an address gets on the list when somebody already using Daily Captain invites them as a buddy, or when we invited someone during the preview. We hold the address, the date, and, when the invitation is ours, a short note about where it came from. A buddy invitation is marked as one, and we keep the record of which invitation admitted which address so an admission can be taken back. An invitation is not an account: the person creates one themselves by signing in, so until they do, the invitation is all we hold about them. Unused buddy invitations are swept off the list automatically when they expire; the rest stays until we remove it by hand, and deleting your account removes your own entry and the admissions your invitations granted.

What you publish. Daily Captain gives you a page of your own at dailycaptain.app/your-handle. It is private until you publish it: nobody but you can open it until you press Publish or turn on the switch "Show my page to the world", and that is what this notice means where it says your page is on or switched on. Pages that existed before this changed are as their owners left them, on or off: we have switched nothing. Once a page is on, anyone who has the address can read it, and it asks search engines to index it, so it is meant to be found. To help them, we list every page that is switched on in our sitemap at dailycaptain.app/sitemap.xml, a file anyone can open, so those pages can be found together rather than one address at a time; switching yours off takes it out of the list on the next request. While your page is on, other signed-in members can also find it inside the app by typing your handle, or the first letters of it, into search. A result shows your name, your photo and your handle, which your page already shows, and nothing else. There is no list of members to browse. Switch your page off and you stop appearing in search at once. It shows your name, your handle, your line about what you do, where you are, your personal quote, your photo, your social and playlist links, the first five lines of your Cookie Jar, your yearly goals for the current year, and the month and year you joined, shown as "Captain since". Under "What is public" five of those parts have a switch of their own, so you can keep a part off a page that is public: your photo, your quote, this year's goals, your Cookie Jar and your links. Your Dream Year is behind a switch of its own, off until you turn it on. "Captain since" is new: on a page that was already public when it arrived, readers see it only after the owner has saved or published the page again, so nothing was added to a public page without its owner seeing it first. Your daily sheets, today's goals and today's count, your weeks and your review notes are never on it. If you did not choose a handle we build one from your name, never from your email address, so your address cannot become a web address behind your back.

All of it is yours to switch off, on the Profile screen. Turning the page off takes the page and the photo down at once, and both then answer as though the handle never existed. Changing your handle stops the old address working immediately, with no forwarding. We keep the old handle reserved to your account for 30 days, so that nobody else can take it and pass for you and so that you can have it back, and then we release it. What we cannot undo is what somebody else has already taken: a search engine's cache, the preview a chat app stored when the link was shared, a screenshot. And when a page's address is shared, the service it is shared in fetches the page and may keep its own copy of your name and your line or quote in that preview.

What you share with a buddy. You can invite someone to be your accountability buddy, and on a Sunday send them a copy of your week. When you do:

• The invitation is a one-time link that expires in 14 days. You share it however you like; we never send it for you and we never ask you for the other person's address. When somebody opens your link and asks for a sign-in code with their own address, we put that address on our invitation list so the link works, and we keep a record of which invitation admitted it. One link can admit up to three addresses that way, and they all come off the list when the link is used up or expires.
• Anyone holding that link, until it is used or expires, sees a page with your first name and your photo on it. That is what the link is for, but it means a link forwarded to somebody else shows them the same thing.
• A week you send is a frozen copy. It carries, for each day, the goals and whether you ticked them, the note you wrote on a goal in the review, and your one word for that day, plus next week's task list and your name as it was at that moment. Your buddy can read that copy for as long as the two of you are connected. Unlink, from either side, and it stops being readable in both directions at once; connect again and it comes back. You can also take a send back yourself, which deletes it and the replies to it outright. Your photo is not part of it. The page fetches your picture live, and only while you are still connected, so unlinking, deleting the photo or deleting your account takes your face off weeks they already hold. Deleting your account also removes the weeks themselves from the inboxes of everyone you sent them to.
• Their reply is stored with your week: what they wrote, the marks they put against individual goals of yours, and their name as it was when they wrote it. So are the notifications either of you get about any of this, and a notification can name the other person, so a line about you can sit in their app and a line about them in yours. When somebody sends a week to you, your name at that moment is frozen into their record of that send, and it stays there through a rename or an unlink. Whoever wrote a reply can delete it, and that removes the reply and the notification about it. If somebody sent you a week you would rather not keep, you can remove it: it goes from your side and nothing is sent to them about it, because the week is their writing and their record of what they sent and what came back is not yours to destroy.
• When you send a week, the person you sent it to gets an email saying so, with your first name in the subject line. Their mail provider sees that, and so does Resend, who deliver it for us. The email does not carry the week: it links to the app, and they sign in to read it.
• Your photo is shown to a live connection even when your public page is switched off. That switch governs the internet, not the people you chose to send your weeks to.

We also keep a daily tally of how many people reached each step of getting started, from seeing the first sheet to starting a free week, saying no to one, or coming back after that, split by the kind of site or link they arrived from or by the door they came through, a browser or one of our apps, and it holds no cookie, no IP address, no account and nothing else that identifies anyone: it is a set of counters, not a record of you.

The campaign code of the link you came through. Some links to Daily Captain, such as the ones in our own posts, end in a short campaign code of letters and digits, like h07, so we can tell which post brought someone. If you arrive through one of them and create your account by typing your sign-in code on the page you arrived on, without reloading it, we keep that code on your account. It is set once, when the account is made, and never changed afterwards. An account that already exists never gains one, and an account made with Sign in with Apple or Google has none. With it we keep the moment we counted your first free week and the moment we counted your first payment, so that neither is counted twice. We use the code and those two moments for one thing: to count, per code and per day, how many accounts were made and how many of them started a free week or paid for the first time, so we can see which posts bring people who stay. Those counts sit in the daily tally above, as a code and a number and nothing else, and only we see them. While your account exists, a count of one could in principle be matched back to it through the code and those two moments; we do not do that, and once your account is deleted nothing ties a count to you. The code is never sent to Stripe, Apple, Google or anyone else, and nothing is stored in your browser for it: the page holds it only while it is open. It is in Export my data, it goes when your account goes, and if you would rather we did not keep it, tell us and we will clear it.

We do not collect your phone number, precise location, contacts, or anything else from your device. We do not need your name to create an account: that takes an email address and nothing else. Apple's button in the iPhone app offers to share your name, but that only fills in the setting-up screen for you. A name is asked for when you set up your profile, and it is optional there and afterwards: leave it blank, or clear it later, and we store no name at all, and wherever the app, your page, your buddies or a quote of yours would show your name, they show your handle instead. So wherever this notice speaks of your name and you have not given one, it means your handle. The only names we hold are one you typed yourself, or one Apple filled in and you saved, and frozen copies of whichever name or handle showed at the time: kept with a community quote we approved, with a week you sent, with a week somebody sent you, and with a reply you wrote. We do not use cookies or similar technology for advertising. We do not buy personal data about you from anyone.

Payments. If you subscribe on the website, the payment is taken by Link, LLC, a Stripe company acting as merchant of record for us. You enter your card on their checkout page, not ours: we never see or store your card number, and no part of it reaches our database. What we keep on your account is what we need to know whether you may sign in and what you have been charged for: a customer and subscription reference, which plan, monthly or yearly, the dates your free week and your billing period run to, the last four digits and expiry of the card so you can recognise it in Settings, the status of each payment, and a record of the moment you agreed to the subscription and its renewal terms. Your billing address and any tax identifier you give go to Link, who need them to work out the tax where you live. Link and Stripe also use what they hold to meet their own legal duties, such as tax and fraud and money-laundering rules, and for those purposes they decide things for themselves rather than acting only on our instructions.

If you subscribe inside the Android app, the seller is Google, through Google Play: Google LLC, or Google Commerce Limited in Ireland if you are in the EEA or the UK. Google takes the payment on its own payment sheet, with the payment method on your Google account: we never see the card, and no part of it reaches our database. What we receive from Google and keep on your account: a purchase token, Google's order number, which plan, the state of the subscription (in its trial, active, cancelled, or on hold), and the date it runs to. What Google sees is its own account, the payment method on it, and the purchase. Google uses what it holds for its own duties as the seller, such as receipts, tax, fraud and money-laundering rules and refunds, and for those it decides things for itself rather than acting on our instructions; Google's own privacy policy governs that part.

If you subscribe inside the iOS app, the seller is Apple, through the App Store: Apple Inc., or Apple Distribution International Limited in Ireland if you are in the EEA, the UK or Switzerland. Apple takes the payment on its own payment sheet, with the payment method on your Apple Account: we never see it. To tie the purchase to your account we generate a random token for your account and hand it to Apple with the purchase. It is not your email address, your name or your user id, so it lets Apple's messages about the subscription reach the right account without telling Apple who you are. What we receive from Apple and keep on your account: that token, Apple's transaction reference, which plan, whether it is in its free week, the date it runs to, and whether it is set to renew. What Apple sees is its own account, the payment method on it, the purchase, and our token. Apple uses what it holds for its own duties as the seller, such as receipts, tax, fraud rules and refunds, which Apple decides alone, and for those it decides things for itself rather than acting on our instructions; Apple's own privacy policy governs that part.

3. Why we use it, and our legal basis

Where the GDPR or UK GDPR applies, this is the basis for each purpose:

We do not profile you, we do not make automated decisions with legal or similarly significant effects about you, and we do not use your goals for advertising.

The emails we send you. Every account gets email from us, of two kinds. The things the account itself needs: your sign-in codes, security notices, messages about your membership, such as the reminder two days before a free week ends and the notice before a yearly plan renews, and the notices our terms oblige us to send, such as a change to those terms or anything that would delete your sheets. And the things the features you use produce: a message when a buddy sends you their week. Both kinds are the service itself, so they carry no unsubscribe link. The first stops when you delete your account. The second stops when you stop using the feature, by unlinking the buddy. What we decide about a quote you submitted reaches you as a notification in the app, not by email. A feature email never carries your sheet or the week itself: it says something is waiting and links you to the app. We send you no marketing on the strength of having signed up. The only marketing we send is our newsletter, which you have to ask for and then confirm with Kit, and which you can leave with one click without touching your account. We will not put promotional content into any of the emails above to get around that.

We do not read your sheet, publish it, or use it to train any AI model. Nobody at Heegstra opens your goals to look at them. The exceptions are the ones you make yourself, and only those: what you put on your profile page, the yearly goals you leave switched on there, a week you send to a buddy, and a quote you submit to the community. Those are read by the people you sent them to, or by anyone, because that is what you asked for. Everything else, meaning your daily sheets, your evening notes and your Dream Year while its switch is off, is seen by nobody but you. The only thing a person at Heegstra reads to run Daily Captain is a quote you submit to the community, because you asked us to consider publishing it. One more case is yours to choose. Our founder, Jan Sytze, has an account of his own and may be offered to you as a first buddy. Add him and he is your buddy like any other: he sees your name and your photo, he reads a week you send him and can reply to it, each of you sees the quotes of the other that we approved, and each of you can nudge the other within the limits this notice describes. He reads what you chose to send him and nothing else, and unlinking ends it as it does with any buddy. Profile text and published lines pass an automatic filter and nothing more, and a photo is checked only for being a real image within the size we accept: nobody looks at what a picture shows before it goes up. If we ever build a feature that sends your content to an AI model, it will be off unless you turn it on, we will name the provider in this notice before it launches, and content sent that way will not be used to train that provider's models.

4. Cookies, local storage, and analytics

Strictly necessary. Four first-party cookies, and no others. __Host-dgs_session keeps you signed in: it lasts up to 90 days, is HttpOnly and Secure, and carries no information about you beyond a session reference. __Host-dgs_login is set when you ask for a sign-in code. It marks the browser that asked, and the code works only in that browser: the right code typed in any other browser signs nobody in, and it still works in the browser that asked. To sign in somewhere else, ask for a code there. What rides on a sign-in, a buddy's invitation you accepted or a Sign in with Apple or Google waiting to be attached to your account, is also only carried out in the browser that asked for it. It holds a random value and nothing about you, lives the 15 minutes the code lives, and is deleted the moment you are signed in. dc_oauth is set only when you press Sign in with Apple or Sign in with Google, and only then: it proves that the browser Apple or Google sends back to us is the one that started the sign-in, and, if you opened a buddy's invitation, carries that invitation into the sign-in. It holds random values, the page to return you to and, for an invitation, a one-way hash of its token: no name, no address, nothing from your account. It lives ten minutes at most, and is deleted the moment you come back, whether or not the sign-in worked. One more lasts only until you close the browser: dc_inapp is set once we can tell you are reading a page inside the Daily Captain app itself, so the page does not also suggest installing it. It holds nothing about you. Those four are the only cookies Daily Captain sets by itself. When you subscribe, the checkout page is Link's, not ours: what it stores in your browser is covered by Link's own notice, and nothing on it is ours to set.

Your device also keeps things in the browser's own local storage so that the app works offline and remembers you between visits: your recent sheets and the quotes for those days, your theme, which account the cached sheet belongs to, any feedback waiting to be sent, and your cookie choices. It also keeps the goals you write for your first day until that day is saved in your account, for a day at most, so that they are still there when you sign in; once you have signed in on this device they also carry which account they are for, so that no other account there sees them. It keeps what you enter on the setting-up screens, your photo included, until it has been saved; anything you typed on the longer setting-up screens and never sent stays until you sign out. And until you answer the offer of the free week it keeps where you are in your first session, for 30 days at most, so that a reload continues where you were. A few things are kept only until you close the tab, such as the token of a buddy's invitation you arrived with. That data never leaves your device except as described elsewhere in this notice, and signing out clears everything except your theme, your cookie choices, and the goals of a first day that has not been saved yet, which go within a day. The installed app also keeps a copy of its own files in your browser's cache so it opens without a connection.

None of the above needs your consent, and none of it is used for advertising. There is a full list with names and lifetimes in our cookie table.

Bot check. Cloudflare Turnstile protects the sign-in form. We do not use its pre-clearance option, so it stores nothing on your device.

Optional: site analytics (Google). If, and only if, you accept site analytics, we load Google Tag Manager, which loads Google Analytics 4 for us. Tag Manager is how we manage that measurement; it is not a separate purpose and we use it for nothing else.

Analytics measures visits, screens viewed, approximate location and browser or device information, so that we can understand and improve the app. It uses first-party cookies (_ga and a _ga_<id> cookie) to tell browsers and sessions apart. We configure those to expire 390 days after they are first set, which is inside the 13-month maximum we work to, and we switch off the setting that would otherwise restart that clock on every visit. We keep event-level analytics data for 2 months and user-level data for 14 months, without resetting the user-level period when a browser comes back.

We keep Google Signals, Google advertising features, ads personalisation, user-provided data and Google Ads linking switched off. We never send your email address, your goals or any other direct identifier to Analytics. Google explains how it handles information from services that use its tools on its partner sites page.

Marketing: none, and nothing to accept. We do not run any advertising or retargeting technology today, and our cookie banner offers you no choice about it, because there is nothing to choose: accepting analytics accepts analytics and nothing else. We keep a reserved "Marketing" slot in the record of your choice, always off and impossible to switch on, so that the day we add something we have to ask you about it rather than treat today's choice as permission for it. If that day comes we will update this notice, add the choice to the banner, and ask you before anything runs.

The video (YouTube), on one page. The giveaway page at dailycaptain.app/giveaway carries a short video in which Jan explains how to take part. The player is YouTube's, loaded from youtube-nocookie.com, which is YouTube's privacy-enhanced player, and it loads when the page opens, before you press anything. So on that page, and nowhere else in Daily Captain, Google LLC sees that your browser asked for the video, your IP address and your browser or device information, whether or not you go on to watch it. If you press play, Google also sees what you watch and may store cookies or similar data on its own youtube-nocookie.com domain, for the player's settings and to protect its service; in privacy-enhanced mode it says it does not use them to personalise what you see on YouTube. All of that is under Google's privacy policy: Google decides what it stores and for how long, and it is not acting on our instructions for this, which is why it is described here and not only in the provider table below. The cookie banner does not govern this, and we do not ask before loading it: our reason for showing the video is that it explains the giveaway, and we chose the privacy-enhanced player and a bare referrer (Google learns which site embedded it, not which page) to keep what it sees to the minimum a YouTube embed allows. If you would rather Google saw nothing, do not open that page: everything the video says is also written out on it in text, and the rest of Daily Captain loads nothing from YouTube, the landing page at dailycaptain.app/about included.

Your choice. Nothing optional is pre-selected, declining keeps the entire app available, and you can change your mind at any time from the cookie settings link in Settings. If you decline analytics, nothing from Google loads at all, with the one exception described above: the video player on the giveaway page. We remember your choice for 390 days, or until a material change means we should ask again. If your browser cannot store the record of your choice, nothing optional runs and we ask again next time.

Global Privacy Control. If your browser sends a GPC signal and you have not answered the banner yourself, we take it as a decline, record that it came from the signal rather than from you, and do not ask: your browser has answered. A choice you make yourself in Settings takes over from then on, which also means the signal does not undo an acceptance you gave before you switched it on. Change that in Settings and it changes. The full detail is in our cookie table.

If we ever add another technology that uses non-essential storage, we will update this notice before it goes live, and where it relies on your consent we will ask first.

5. Who else sees your data

Other people, when you choose. Before the list of companies below, the more important answer: some of what you write is seen by other people, always because you switched something on or sent something.

• Anyone on the internet can read your profile page once you have published it and while it is switched on, and search engines are asked to index it. That is your name, your handle, your line, your place, the month and year you joined, and, each behind its own switch, your photo, your quote, your links, your Cookie Jar lines, your yearly goals and up to four lines of your Dream Year.
• Signed-in members who search for your handle see your name, your photo and your handle in the results, while your page is switched on and not otherwise.
• The people you follow, and the people who follow you, see you in a list of theirs. What they see is only what your public page already shows, so switching that page off suspends your handle, your line and your photo in those lists and leaves your name, which they saw when they followed. Nobody else sees either list, and no follower count appears on your page: a follow is not something we publish about you.
• A buddy you connect with sees your name and your photo, and reads any week you send them: the goals, ticks, review notes and one-word entries for that week, and next week's tasks. The photo reaches them whether or not your public page is on.
• Anyone holding an invitation link you sent sees your first name and your photo on the page that link opens, until that link is used or expires.
• Anyone at all sees a community quote of yours we approve, on its day. The quote of the day is public, so it takes no account to read it, and it carries your name and a link to your page when that page is on.
• Anyone can see the numbered list of hashed entry codes we publish for a giveaway draw; it names nobody. The winner's Instagram handle and public profile link are published only if the winner agrees.
• The service you share a link in, a chat app or a social network, fetches the page to build a preview and may keep its own copy of what it found.

None of this happens to your daily sheet, which is not published or shared by any of these features.

Our service providers. We use a small number of them. Each acts on our instructions under a data processing agreement and may not use your data for its own purposes, with the exceptions the notes under the table explain: Link and Stripe, who sell your subscription on the website, and Google and Apple, when they sell it to you in their stores, also answer to tax and anti-fraud law in their own right and decide refunds themselves; and Google, when it plays you a video, does so under its own policy rather than ours.

Link and Stripe, Google as the seller on Google Play, and Apple as the seller on the App Store are the entries above that are not only working to our instructions. As the seller of your subscription, each of them decides for itself what it must keep for tax, fraud and anti-money-laundering law, and each decides refunds of what it sold. Their own privacy policies govern that part: you can reach Link at link.com, Google through Google Play, and Apple through the App Store.

Google's YouTube is the other exception. For Analytics, Google works to our instructions and sees nothing until you accept. The video on the giveaway page is different: YouTube's player loads with that page, under Google's own terms and privacy policy, so Google sees the request from everyone who opens it, sees what anyone who presses play watches, and may store data on its own domain, as section 4 describes. We chose YouTube's privacy-enhanced player and send it only the bare origin of this site; what Google does with what it sees is Google's to answer for, and its policy says how.

That is the whole list. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we have never done either. We disclose data to authorities only where the law requires it, and we will tell you when we are allowed to.

If Heegstra LLC is ever sold or merged, your data may transfer with the product. We would tell you first, and the buyer would be bound by this notice until it gave you a new one.

6. How long we keep it

• Your account and your sheets: for as long as your account exists, whether or not you are paying for it. An account that stops paying goes read-only and keeps everything; we do not delete it for not paying. If that ever changes we will tell you before it does.
• Billing records: for as long as your account exists, and then for as long as tax and accounting law makes us keep them. For a subscription bought on the website, that is the invoice Link issued and the transaction record, kept for up to 7 years. Deleting your account does not erase them, because we are not allowed to erase them; it stops us using them for anything except that legal duty. For a subscription bought through Google Play or the App Store, we issue no invoice: the store issues the receipt and keeps it under its own rules, and what we hold is the store's transaction reference and the dates the subscription ran to, kept for as long as your account exists and deleted with it, except where a tax or accounting rule requires us to keep the transaction reference longer, in which case it is kept for that and for nothing else. Google Play also sends us a message each time something happens to a subscription, and we keep a log of those messages so that none is handled twice: the purchase token the message came with, a message id, its type, and when we handled it. That log is deleted with your account, and when your account moves to a new purchase token the old token's entries are deleted then. An entry whose token belongs to no account, because the purchase was never linked to one or because that clean-up missed it, is kept for at most 12 months and then deleted by the same automatic cleanup. The store's payout reports to us are records about our business, not about you. Your card details are not ours to keep or delete: Link, Google or Apple holds them under its own policy.
• Your agreement to the subscription: the record that you saw the price and the renewal terms and accepted them, kept for 3 years, or 1 year after the subscription ends, whichever is longer. California law sets that minimum and we apply it to everyone.
• Your newsletter consent: the record of what you were shown and when, kept while you are subscribed and for 3 years after you unsubscribe, so we can show the consent was real if anyone asks.
• Sign-in codes: 15 minutes from the moment the code is sent, then it stops working. The records are cleared once they are more than a day old by an automatic cleanup that runs every few minutes.
• Sessions: up to 90 days, and immediately when you sign out or delete your account. Signing in again replaces the session on the device you sign in on; a session on another device runs to its 90 days unless you sign out there.
• Your first day, and the offer of the free week: for as long as your account exists, and deleted with it.
• The share prompt: for as long as your account exists, and deleted with it.
• The campaign code of the link you came through, and the two moments counted against it: for as long as your account exists, and deleted with it. The daily counts they fed are kept as counts, a code and a number, with nothing in them that names you.
• Sign in with Apple or Google: the identifier is kept for as long as your account exists and deleted with it, and so is the key Apple gives us for withdrawing the sign-in. When an account that used Sign in with Apple is deleted, we use that key to tell Apple to withdraw the sign-in it issued for Daily Captain, and then the key goes too. A Google sign-in waiting for you to type the code we emailed is kept fifteen minutes at most, and deleted when the code is used or runs out. The name and picture address that Google's iPhone kit sends with a sign-in are kept nowhere: not on our server, not in a log, and not on your phone once the sign-in is done.
• Hashed IP records for rate limiting: one hour, cleared by the same automatic cleanup.
• Your profile and your photo: for as long as your account exists. Clearing a field or deleting the photo removes it at once; deleting the account removes all of it, and takes your page down before the 30-day grace period even starts. A handle you changed is kept reserved to your account for 30 days and then released; it goes sooner if your account is deleted first.
• Your year and your week: for as long as your account exists. A week becomes read-only once its Sunday has passed, on purpose, so a past week is a record rather than something you can tidy up afterwards. Deleting the account still erases it.
• Newsletter rate-limit records: one day, cleared by the same automatic cleanup, and deleted with your account before then if you delete it.
• Server logs: kept by our host, Cloudflare, for 3 days and then deleted automatically. We do not copy them anywhere.
• Feedback: for as long as your account exists, and deleted with it.
• Support requests without an account: 12 months from when you sent them, then deleted. To have yours deleted sooner, email hello@dailycaptain.app from the address you gave us.
• The invitation list: an unused buddy invitation and the admissions it granted are swept off automatically when the invitation expires, 14 days after it was made. Entries we created ourselves stay until we remove them by hand, and you can ask us to remove yours. Deleting your account removes your own entry and the admissions your invitations granted.
• Follows, buddy asks and likes: a follow is kept until you unfollow or either account is deleted. Unfollowing deletes the record outright: there is no undo offered for it and nothing is kept to say it was ever there. A buddy ask is the invitation it is made from, so it expires with that invitation 14 days after it was made, whether it was accepted, declined or left alone, and the answer is kept with it until then. A like on the day's quote is kept for as long as your account exists and is deleted with it. A nudge you sent is kept for 7 days, which is longer than the daily limit needs and short enough to mean nothing afterwards, and then deleted by the automatic cleanup; the notification it left in a follower's app is kept as other notifications are.
• Connections, sent weeks, replies and notifications: for as long as either account exists, and readable only while the two of you are connected. Unlinking hides delivered weeks and the replies on them in both directions rather than deleting them, which is what lets the ten-second undo be honest, and reconnecting brings them back. Three things do delete outright: a sender taking a week back, which removes it, the replies on it and the notifications pointing at it; the author of a reply deleting it, which removes the reply and its notification; and deleting your account, which removes every week you are either side of. A week somebody sent you that you remove is hidden on your side only, because the writing is theirs and their record of what they sent is not yours to erase. Notifications go the same way, including the copies that sit in somebody else's app because they are about you.
• Push subscriptions: until you have turned off reminders and every other notification, the device stops being registered for them, or your account is deleted. A browser can drop its subscription on its own; on a phone the registration lapses when you delete the app or turn its notifications off in iOS Settings. Turning off the last of them deletes the subscription for every device on your account, not only the one you switched it off on, so turning any of them back on means allowing notifications again on each device.
• Newsletter: the list itself is held by Kit under the Heegstra privacy policy. What this app keeps is the record that you asked: that you ticked the box, when, the wording you were shown and where you were shown it, for as long as your account exists and for 3 years after you unsubscribe, so we can show the consent was real if anyone asks. One click in any newsletter unsubscribes you, and your address then goes on a suppression list so it is not used for marketing again.
• Quotes you submitted: for as long as your account exists, whether they were approved, rejected or never reviewed, and deleted with your account. An approved one leaves everybody's rotation the moment your account is deleted.
• Giveaway entries: 12 months after the draw, then deleted. The winner's entry is kept with the record of the payment, for as long as that record is kept.
• Analytics: as set out in section 4.
• Deleting your account: everything is scheduled for erasure and removed 30 days later, by the same cleanup. Signing in during those 30 days brings it all back. The one thing that outlives it is a paid invoice, which tax and accounting law require us to keep; it is kept for that and for nothing else, and section 6's billing line says for how long.

7. Your rights

You can do the following yourself, from Settings: change or delete anything you wrote, turn reminders and each of the other notifications off, change your cookie choices, download a copy of everything we hold about you, and delete your account. Every newsletter email has a one-click unsubscribe.

For everything else, email hello@dailycaptain.app. That includes:

• Access: a copy of the data we hold about you. You can take it yourself: Settings > Information > Export my data gives you one JSON file with your sheets, settings, profile and feedback, your giveaway entry if you made one, and, if you have used the buddy loop, the weeks you sent, the replies you received, and a week somebody sent to you. It leaves a few things out and names every one of them inside the file, with the reason. Some are secrets that, in somebody else's hands, would let them sign in as you, withdraw a sign-in of yours, send notifications to one of your devices, or accept an invitation in your name. Some belong to other people, such as the addresses of people who opened your invitation link, and weeks and replies somebody else wrote that you have removed or unlinked from. Some say nothing about you or cannot be tied to you, such as a cache token for your photo's address, the secret of a buddy ask that opens nothing, and the hashed IP addresses we keep only for rate limiting. Others are records we keep for running the service rather than things you gave us, such as the log of messages Google Play sent us about your purchase and the entry with your address on our invitation list. Whatever in those is about you is yours to have by email. Everything you wrote yourself is in it either way. Email us instead if you would rather, and we will send you the same thing, with those records added.
• Correction of anything inaccurate.
• Erasure, beyond the self-serve deletion in Settings.
• Restriction of processing, and objection to processing based on our legitimate interests.
• Portability of the data you gave us.
• Withdrawing consent for the newsletter, for analytics, for reminders or for any of the other notifications, at any time. Withdrawing does not affect the lawfulness of anything we did before you withdrew.

What erasure reaches, and what it cannot. Deleting your account takes down your profile page and photo at once, removes your submissions and any approved community quote from everybody's rotation, and removes the weeks you sent from your buddies' inboxes along with the notifications about you in their apps. It cannot reach what has already left us: a search engine's index or cache, a preview stored by a chat app, a screenshot, or anything a buddy chose to write down elsewhere. If a search engine still shows an old copy of your page, tell us and we will help you ask them to remove it, but the request is theirs to grant.

We answer within 30 days, usually much sooner, and we do not charge for it. We may ask you to confirm control of the email address on the account before we act, because that address is the only identifier we hold.

If you are in the EEA or the UK, the rights above are yours under the GDPR and UK GDPR, and you may also complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); elsewhere, your national authority.

If you are in California, you have the right to know what we collect and why, to delete it, to correct it, and not to be treated differently for exercising those rights. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. The categories we collect and our purposes are in sections 2 and 3, and we honour these requests whether or not the law formally applies to us.

8. Where your data is stored, and transfers

The app and the database run on Cloudflare's network, with the database in the United States. Our providers are US companies.

If you are in the EEA, the UK or Switzerland, that means your data is transferred to the United States. Kit and Google are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Our providers' data processing agreements also incorporate the European Commission's Standard Contractual Clauses, which is the mechanism we rely on for transfers generally. Link and Stripe are US companies and rely on the European Commission's Standard Contractual Clauses for the same transfers.

A purchase through a store is different, because there the store collects the data from you itself, as the seller, rather than receiving it from us. If you are in the EEA, the UK or Switzerland, your Google Play purchase is with Google Commerce Limited and your App Store purchase is with Apple Distribution International Limited, both in Ireland, so the purchase data starts inside the EU, and what those companies send on to their US parents is governed by their own privacy policies, which name the mechanism they use: Google relies on its Data Privacy Framework certification and on Standard Contractual Clauses, and Apple relies on Standard Contractual Clauses. The little we receive back from a store about your subscription, listed in section 2, is stored in our database in the United States under the general mechanism above.

9. How we protect it

Everything travels over HTTPS and nothing else is accepted. Session identifiers are stored only as hashes, so a copy of our database would not let anyone sign in as you. A six-digit code is short enough that its hash could be worked back to the code, so what protects it is not the hash: it is that the code is alive for 15 minutes, works once, dies after five wrong guesses, and is replaced when a new one is asked for. The code reaches you by email, and the email carries nothing else that signs anyone in: there is no link in it for a mail scanner to follow. A code works only in the browser that asked for it: the right code typed in any other browser signs nobody in, and a guess typed there counts only against the limit we keep for that IP address, so it cannot use up the five wrong guesses the code allows. Whoever has your address can still ask for a code in their own browser, and whoever is then given that code can sign in with it, which is why our terms ask you to keep your inbox secure and to give the code to nobody. Asking for codes is limited, to one every five minutes and five an hour for an address, signing in replaces that device's session, and the sign-in form is rate-limited and protected by a bot check. We store no raw IP addresses. The app sends strict browser security headers on every response.

If a breach ever puts your rights at risk, we will tell you and the relevant authority, within 72 hours of becoming aware where the law requires it.

10. Children

Daily Captain is for people aged 16 and over, and you confirm that you are in the same sentence that creates your account. We do not ask for your date of birth and we store nothing about your age: the confirmation is part of the acceptance line you agree to, not a field we keep. We do not knowingly collect data from anyone younger, and we ask people not to publish a page, a photo or an invitation for anybody under 16. If you believe a child has an account, tell us at hello@dailycaptain.app and we will delete it and take down anything published from it.

11. Changes to this notice

When this notice changes we update the version and the date at the top and note it in the changelog below. For anything material we tell you in the app or by email before it takes effect, and where the change relies on your consent we ask again rather than assume.