Privacy Policy

Last updated: 11 September 2026
Effective date: 22 May 2026

This Privacy Policy ("Policy") describes how Tirvane ("Tirvane", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal information in connection with the Daypeak mobile application (the "App") and any related services we provide (collectively, the "Services"). This Policy applies to individuals located anywhere in the world who use the Services.

By downloading, installing, accessing, or using the Services, you acknowledge that you have read this Policy and consent to the processing of your personal information as described herein. If you do not agree with the terms of this Policy, do not use the Services.

1. Information We Collect

1.1 Information You Provide Directly

Account information. When you sign in using Sign in with Apple, we receive an Apple-issued user identifier and, depending on the choices you make at the Apple consent screen, either your verified email address or an Apple-generated private relay email address. We do not receive your Apple ID password.
Event content. Information you create within the App, including event titles, dates, event categories (such as wedding, exam, or race), notes, reactions, and any photos you upload. For shared events, this content is replicated to the members you invite.
Communications. Information you provide when you contact us by email or other means, including the contents of your message.

1.2 Information Collected Automatically

Device and usage data. Including device model, operating system version, language, time zone, in-App screen views, feature interactions, session timestamps, and similar diagnostic and product-interaction information.
Crash and performance data. Stack traces, error messages, device state at time of error, and performance metrics, in each case generated when the App encounters an error or measurable performance event.
Push notification identifiers. A vendor-issued push notification token associated with your installation of the App, used to deliver notifications you have opted in to receive.
Subscription and purchase data. Whether you have an active subscription or one-time purchase, the product identifier, currency, and event timestamps. We do not receive your full payment card or banking information; payment is handled by Apple.

1.3 Information from Third Parties

We receive limited information from Apple regarding the status of your in-App purchases and subscriptions, including server-to-server notifications informing us of renewals, refunds, cancellations, billing retries, and family-sharing events.

2. How We Use Information

We use the information described above for the following purposes:

to provide, operate, maintain, and improve the Services;
to authenticate you and secure your account;
to deliver, synchronize, and back up the event data you create, including across devices and to other members of any shared event you participate in;
to provide and administer subscriptions, including trial eligibility, renewals, refunds, and family sharing;
to send transactional, service-related, and (where you have opted in) marketing communications, including push notifications;
to detect, prevent, investigate, and respond to fraud, abuse, security incidents, and violations of our terms;
to analyze usage patterns and conduct product research with a view to improving the Services;
to comply with applicable laws, regulations, and lawful requests from public authorities; and
to establish, exercise, or defend legal claims.

3. Legal Bases for Processing (EEA, UK, Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR for processing your personal information:

Performance of a contract — to provide the Services you have requested and to administer your subscription;
Legitimate interests — to operate, secure, and improve the Services, to communicate with you about the Services, and to protect against fraud and abuse, in each case where such interests are not overridden by your rights;
Consent — for any processing that requires consent under applicable law, including the sending of marketing push notifications and the use of optional analytics; and
Legal obligation — to comply with applicable legal, regulatory, tax, and accounting obligations.

You may withdraw any consent you have previously provided at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4. Disclosure of Information

4.1 Service Providers and Subprocessors

We disclose personal information to third-party service providers who process information on our behalf and under our instructions. Each provider is bound by contractual obligations to use the information only as necessary to deliver services to us and to implement appropriate security measures. Our current subprocessors are:

Provider	Purpose	Categories of data
Apple Inc.	Sign in with Apple, App Store distribution, in-App purchases, push notification delivery (APNs)	Account identifier, purchase events, push tokens
Supabase, Inc.	Database, file storage, authentication, and serverless backend functions	Email, event content, photos, account data
RevenueCat, Inc.	Subscription management, receipt validation, entitlement state	User identifier, purchase events, subscription state
PostHog Inc.	Product analytics and feature usage telemetry	Device identifier (anonymous), product interaction events
Functional Software, Inc. (Sentry)	Crash reporting and performance monitoring	Crash data, performance data, device diagnostics
OneSignal, Inc.	Push notification delivery and audience segmentation	Push notification identifier, coarse-grained tags
Cloudflare, Inc.	Remote configuration delivery and static hosting	Network metadata only; no personal data is intentionally transmitted

4.2 Other Recipients

We may also disclose personal information:

to other members of a shared event, to the extent that you have voluntarily added content (such as photos, notes, or reactions) to a shared event;
to public authorities, regulators, courts, and law enforcement agencies, where required by applicable law or in response to a valid legal process;
to professional advisors, including legal counsel, accountants, and auditors, in connection with the operation of our business;
to acquirers, successors, or assignees in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction; and
with your consent or at your direction.

We do not sell personal information for monetary consideration, and we do not "share" personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act ("CCPA") as amended.

5. International Data Transfers

We and our service providers may process personal information in countries other than the country in which you reside, including in the United States. The data protection laws of those countries may differ from those of your country of residence. Where required by applicable law, we implement appropriate safeguards for international transfers, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of complying with our legal, regulatory, tax, accounting, and reporting obligations and, where applicable, to establish, exercise, or defend legal claims. When personal information is no longer required, we delete or anonymize it. Specifically:

Event content remains on our servers for as long as your account is active, or until you delete it.
Crash and analytics data is retained for a rolling period not exceeding twenty-four (24) months.
Subscription records and associated transactional logs are retained for the period required by applicable tax and consumer-protection law.
Upon account deletion, we initiate cascading deletion of your event data, photos, authentication records, and revoke any Sign in with Apple refresh tokens previously issued to us. Some information may persist in encrypted backups for a limited period before being purged on the ordinary backup-rotation schedule.

7. Security

We implement and maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit, encryption at rest for sensitive fields, row-level access controls on our database, periodic credential rotation, and least-privilege access controls for our personnel. Notwithstanding the foregoing, no method of transmission over the Internet or method of electronic storage is one hundred percent (100%) secure, and we cannot guarantee absolute security.

8. Your Rights

8.1 EEA, United Kingdom, and Switzerland

Subject to applicable law and certain exceptions, you have the right to:

access the personal information we hold about you;
rectify inaccurate or incomplete personal information;
erase your personal information ("right to be forgotten");
restrict processing of your personal information;
object to processing of your personal information, including for direct marketing;
data portability — receive a copy of your personal information in a structured, commonly used, and machine-readable format;
withdraw consent, where processing is based on consent; and
lodge a complaint with your local supervisory authority.

You may exercise most of these rights directly within the App (Settings → Account → Delete Account) or by contacting us as set out in Section 13.

8.2 California

If you are a California resident, you have the following rights under the CCPA, as amended by the California Privacy Rights Act:

the right to know what categories and specific pieces of personal information we have collected about you;
the right to delete personal information we have collected from you;
the right to correct inaccurate personal information;
the right to opt out of the sale or sharing of personal information (we do not sell or share, as defined under the CCPA); and
the right to non-discrimination for the exercise of your privacy rights.

You may also designate an authorized agent to act on your behalf. We will verify your request consistent with applicable law before fulfilling it.

8.3 Other Jurisdictions

Residents of jurisdictions including Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), and certain U.S. states with comprehensive privacy statutes may have analogous rights under local law. Please contact us as set out in Section 13 to exercise any such rights.

9. Children's Privacy

The Services are not directed to children under the age of thirteen (13) (or such higher age as may be required by applicable law in your jurisdiction, such as sixteen (16) in certain EEA member states). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without verified parental consent, we will take steps to delete such information promptly. If you believe that we may have collected personal information from a child, please contact us at the address in Section 13.

10. Sign in with Apple Disclosures

The Services use Sign in with Apple for authentication. When you sign in, Apple provides us with a stable user identifier and, depending on the choices you make at the consent screen, either your verified email address or an Apple-generated private relay email address. You may revoke our access at any time from Settings → Apple ID → Sign in with Apple on your Apple device. Account deletion within the App will also cause us to invoke Apple's token-revocation endpoint with respect to any refresh token we hold.

11. Tracking, Cookies, and Similar Technologies

The Services do not engage in cross-application or cross-website tracking as defined by Apple's App Tracking Transparency framework. We do not request the IDFA. We do not use third-party cookies for marketing or behavioral advertising purposes. The Services may persist limited local identifiers (such as a randomly generated installation identifier) on your device for the purpose of session continuity and analytics aggregation; these identifiers are not linked to your identity unless you sign in to the Services.

You can turn off analytics at any time in the App under Settings → Privacy & legal → Share anonymous usage data.

12. Changes to This Policy

We may amend this Policy from time to time. The "Last updated" date at the top of this Policy indicates when this Policy was last revised. If we make a material change, we will provide additional notice (such as via the App or by email) as required by applicable law. Your continued use of the Services after the effective date of an amended Policy constitutes your acceptance of the amended terms, except where additional consent is required by applicable law.

13. How to Contact Us

For questions regarding this Policy, or to exercise any of the rights described above, please contact us at:

Tirvane
Email: support@daypeak.app

If you are located in the EEA or the United Kingdom and we have not satisfactorily addressed your concerns, you have the right to lodge a complaint with your local supervisory authority.