Privacy Policy

Last updated: April 1, 2026

DailyEcho ("we", "our", "the app") is a mood tracking and journaling app developed by DailyEcho. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

Account data. When you create an account we store your email address and an authentication token via Supabase (our backend provider). This is required for cloud sync and account recovery.

Journal data. Mood entries, activity tags, journal notes, photos, and voice recordings you create inside the app. This is the core content you choose to log.

Health data. If you grant permission, the app reads step count, heart rate, and sleep data from Android Health Connect (or Apple HealthKit on iOS). This data is used solely to display health insights alongside your mood entries. We do not share health data with any third party.

Usage analytics. We collect anonymous event data (e.g., app opened, onboarding completed, entry created) via Sentry to understand how the app is used and to detect crashes. These events do not contain journal content. Crash reports may include device model, OS version, and stack traces.

Subscription data. If you purchase DailyEcho Premium, your purchase is processed by Google Play or Apple App Store. We receive a purchase token to verify your subscription status but do not have access to your payment details.

2. Data We Do NOT Collect

• We do not collect your precise location.
• We do not collect your contacts or call logs.
• We do not serve advertising or share data with ad networks.
• We do not sell your personal data to anyone.

3. How We Use Your Data

• Provide the service: store and sync your entries across devices.
• Generate insights: mood statistics, streaks, and patterns are computed from your entries.
• Improve the app: anonymous analytics help us fix bugs and prioritise features.
• Crash reporting: Sentry receives crash data so we can fix issues quickly.

4. Data Storage and Security

• Local encryption: journal entries are encrypted on your device using AES-GCM before being stored locally.
• Transit encryption: all communication with our servers uses HTTPS/TLS.
• Backend: cloud data is stored in Supabase (hosted on AWS, EU-West region) with PostgreSQL row-level security.
• Offline-first: the app works fully offline. Cloud sync happens when connectivity is available.

5. Data Sharing

We do not share your personal data with third parties except:

• Supabase — backend infrastructure (authentication, database, storage). Supabase acts as a data processor under our instructions.
• Sentry — crash reporting and anonymous analytics. Sentry receives technical event data, not journal content.
• Legal obligations — we may disclose data if required by law or to protect the rights and safety of our users.

6. Data Retention

Your journal data is retained as long as your account exists. If you delete your account, all associated data (entries, activities, settings) is permanently removed from our servers within 30 days. Local data is removed when you uninstall the app.

7. Your Rights

You can:

• Export your data from Settings > Export.
• Delete your account and all associated data from Settings > Account > Delete Account.
• Revoke permissions (audio, health data, notifications) at any time in your device settings.
• Request access to your stored data by contacting us.

If you are in the EU/EEA, you have additional rights under the GDPR including the right to rectification, restriction of processing, and data portability. Contact us to exercise these rights.

8. Children's Privacy

DailyEcho is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via an in-app notice. The "Last updated" date at the top reflects the most recent revision.

10. Contact

For privacy questions or data requests:
Email: privacy@dailyecho.nl