Trust & Security
Dayze holds relationships, finances, and memories. Here is how we treat that responsibility — today and as we scale.
Principles
No ads · no data sales
We monetize subscriptions, premium handles, and optional developer APIs — not by selling your attention or your life graph.
No third-party model training
AI providers process request context to run Dayze Agent. We do not allow your Dayze data to train their models.
AI writes are private, attributed and mostly undoable
ChatGPT, Claude, Cursor, and Gemini connect via MCP to read your life graph with sources. A connection you grant write access can also add and edit records, kept private by default. Every change is attributed to the app that made it: a record shows who added and changed it, and most changes can be undone for 30 days, unless the record changed since. Removals are previewed or archived. They never buy or send for you.
Each AI gets only the access you give it
A new connection from Claude, Cursor, Gemini or another AI app can read and add to your records. Removing records, reading your Gmail and sensitive details (contact details, booking references, financial details) stay off until you allow them for that app, when you connect or later in Settings → Agent access, where you can also take access away. API keys hold only the permissions you pick when you create them. ChatGPT keeps the permissions of Dayze's reviewed ChatGPT connectors.
Portable
Pro and Family can export JSON/CSV from Settings. Anyone can delete their account and data.
You control connectors
Calendars, health, messaging, and location are opt-in. Disconnect anytime.
Subprocessors (high level)
Dayze uses vetted infrastructure and AI providers to operate the product. Categories (not an exhaustive legal schedule — see the Privacy Policy for the full framing):
- Database, auth, storage — Supabase (AWS-hosted)
- Hosting / CDN — Netlify (and related edge delivery)
- Payments (web) — Stripe (card data stays with Stripe)
- Payments (apps) — Apple App Store and Google Play in-app purchases when you subscribe on a device
- AI model APIs — one or more third-party model providers for Dayze Agent chat/voice (providers may change; we do not brand a single vendor in product UI)
- Product analytics — Google Analytics and PostHog, for usage counts and app errors only (no message, email, or note content)
- Email / messaging delivery — transactional providers for auth links and notifications
- Integrations you connect — Google, Apple, Spotify, etc., under the scopes you authorize
Retention
- Active account — We keep your life-graph data while the account exists (see the Privacy Policy).
- Account deletion — After you delete your account, we target removing personal data from production within 30 days, subject to legal retention, billing and tax records, dispute and security needs, and infrastructure backups (see Privacy Policy §9 (Retention)). Backup retention periods and tool-call log retention are not published as fixed SLAs.
Security controls today
- HTTPS/TLS in transit; encryption at rest via infrastructure providers
- Authenticated APIs; row-level access patterns for user data
- Secrets kept in environment config — not in client bundles
- Account deletion cascade for profile + life data
Maturity roadmap
Before scaling paid family/Teams and enterprise-style trust asks, we plan:
- Keep legal + Trust pages product-accurate (current focus)
- Independent penetration test of critical auth and export paths
- SOC 2 Type I (or equivalent) when recurring revenue and customer demand justify it
- Formal incident-response runbook for internal operations