Privacy

Version 2026-10-23.2. This is the version recorded against your account when you signed up.

Daybook holds a team's internal planning: what they are building, what is broken, what they have decided and why. That is more sensitive than most project tools admit, so this page says plainly what happens to it rather than describing a category of processing in the abstract.

Who is responsible

The controller for the personal data described here is Uladzislau Hreben, operating as HREBEN, a sole trader established in Poland and entered in the CEIDG register — NIP 5273097952, REGON 527715202. Reachable at privacy@daybook.team, which is the fastest way and the one that is read. A postal address is provided on request.

For your workspace's contents the roles reverse: you are the controller and Daybook is the processor. You decide what goes in, and it is not looked at, mined, or used to train anything.

What is stored

• Account details — email address, display name, a hashed password, and if you sign in with Google, the identifier Google returns. Passwords are hashed and never recoverable.
• Workspace content — projects, objectives, cycles, work items, comments, documents, releases, labels and any files attached to them.
• Feedback you collect — including anything the person submitting it typed, and the page context your widget captured.
• Activity — who changed what and when, including which assistant made a change through the connector.
• Use of this site and the app — the pages you open on daybook.team and in the console, when and for how long, and where you came from. With them: your browser, operating system and its version, kind of device and, where the browser gives it, its model; your screen's size and pixel density, light or dark mode and connection type; your languages, time zone, calendar and 12- or 24-hour clock. Where you are, as your network address places you: country, region, city, postal code and approximate coordinates. Your IP address itself is not kept — only a keyed hash of it, which shows that two visits came from one address but cannot be turned back into the address. Once you sign in, all of it is tied to your account's id, email address and name.
• Operational logs — requests, errors and email delivery records.
• Billing — a Stripe customer and subscription reference. Card numbers never reach Daybook; Stripe holds them.

Cookies

Two. The first does nothing but change a button. When you sign in, the app stores daybook_signed_in=1 against daybook.team so this site can offer you a link to your console instead of a sign-in form. It holds the digit 1 and nothing else — no identifier, no session, nothing that could be used to reach an account. Signing out removes it, and refusing it costs you one extra click.

The second, dbk_ followed by a few letters, is how Daybook counts the use described above. It holds a random visitor id, the current visit, where you first came from and, once you sign in, your account's id — against daybook.team, so this site and the console count one visitor rather than two. Signing out starts a new visitor id.

There is no analytics company, no advertising and no third-party script on this site. What is counted goes to Daybook alone, is kept with the rest of Daybook and is never shared or sold, and there is no banner asking you.

Where it lives

Your workspace is stored in the European Union, in Finland, and nothing is stored outside it. Traffic may pass through servers elsewhere on its way to you, as it does for any site reached over the internet, but it is not kept there.

Who else is involved

These are the only third parties that receive any data, and what each one gets:

Assistants connected over MCP are not subprocessors of Daybook. When you connect one, you are sending your own data to a provider you chose, under your agreement with them.

How long it is kept

• Workspace content — until you delete it. Deleting is reversible for a short period, because an accidental deletion is more common than a deliberate one.
• Backups — a matter of weeks, then permanently removed. Content you delete can persist in a backup until it ages out.
• Use of this site and the app — a year, then removed. Your account's id, email address and name in it stay until you ask for them to be erased, which removes everything counted about you with them.
• Operational logs — kept only as long as they are useful for running and debugging the service, which is longer for an error than for an ordinary request and is never more than a few months.
• Billing records — as long as tax law requires, which is longer than the rest.

Getting your data out, or deleted

Every workspace can be read in full through the API and the MCP connector using a key you create yourself, so an export needs nobody's permission.

There is not yet a one-click export or a self-serve account deletion. Email privacy@daybook.team from your account address and both are done by hand within 30 days, usually the same week. Deletion removes the workspace and its contents; backups containing it age out shortly afterwards.

Your rights

Under the GDPR you may ask for a copy of your data, correction of anything wrong, deletion, restriction of processing, or portability, and you may object to processing. Write to privacy@daybook.team. If the answer does not satisfy you, you can complain to your national data protection authority.

Security

Traffic is encrypted in transit and data is encrypted at rest. Passwords are hashed and cannot be recovered, by us or by anyone. Credentials you connect — a repository token, a calendar permission — are encrypted before they are stored. Uploaded files are private and reachable only through links that expire. Backups are taken on a schedule and restoring from them is tested rather than assumed.

Perfect security is not claimed by anyone honest. If something happens that affects your data, you will be told what happened and what it means, without waiting to have a tidy story.

Changes

This page carries a version. When it changes materially you will be told before the new version applies, not after.