Privacy Policy

Daily Responsibility (the "app")

Effective date: 7 September 2026

Last updated: 7 September 2026

Version: 1.0

The short version

Daily Responsibility keeps a shared ledger of who did what in a household or a group of friends, and turns it into two percentages. To do that it needs an account, and it stores what you log.

• We collect an email address, a display name, an optional profile photo, and the entries, expenses, chat, and settings you and your group create.
• We do not sell or share your personal information, we do not run advertising, and the app contains no analytics, attribution, or tracking software of any kind.
• Everything you log inside a group is visible to the other members of that group. That is the point of the app. Your email address and your profile photo are not.
• Chat messages are deleted five minutes after they are read, and in any case within seven days.
• You can delete your account, and everything attached to it, from inside the app.

The rest of this document is the detail. If you only read one other section, read Who can see your information.

1. Who we are, and how to reach us

Mykola Pakhniuk (Микола Пахнюк), a sole proprietor registered in Ukraine (фізична особа-підприємець, "ФОП"), is the controller of the personal data described in this policy (the "we", "us" and "our" below). "Controller" means we decide why and how your information is used, and we are the ones answerable for it.

Where the app is offered. Daily Responsibility is not offered in the European Economic Area, the United Kingdom, or Switzerland, and is not listed on the App Store in those territories. That is deliberate rather than accidental. Offering it there would place us under GDPR Art. 3(2) and require us to appoint a representative inside the EU, another in the UK, and another under Art. 14 of the Swiss FADP — obligations we would rather meet properly than late. If those territories are added, this section changes before they are, not after.

None of that is a reason to treat anyone worse. If you hold an account from one of those places regardless, Section 10 describes the rights we will honour anyway.

We answer privacy requests sent to the address above. We aim to reply within 30 days, and we tell you if we need longer (see Section 10 and Section 11).

2. What this policy covers

This policy covers the Daily Responsibility iOS app and the server it talks to. It does not cover:

• Apple. The App Store and your Apple Account are Apple's, and Apple's privacy policy governs them.
• Anything you link to. If a note or a message contains a link, following it takes you somewhere we do not control.

3. What we collect

We collect only what the app needs to work. There is no advertising identifier, no analytics SDK, no crash-reporting SDK, no attribution SDK, no social login, no location data, no contacts access, no microphone or camera access beyond the photo you deliberately pick for your avatar, and no App Tracking Transparency prompt, because there is nothing to track you with.

3.1 Information you give us

3.2 Information created by using the app

All of the following belongs to a group, and is visible to that group's members.

Free-text fields. Notes and chat messages accept anything you type. If another member reports something you wrote, a copy of those words is kept with the report for two years, which is longer than the message itself lives — see Section 9. Please do not put information in them that you would not want the other members of the group to read — especially anyone else's health, finances, or other sensitive details. We do not scan or read them, but we also cannot police them.

Amounts are not payment data. An expense records that somebody spent an amount of money. It is not connected to a bank account or a card, and we never see card numbers, account numbers, or bank details.

3.3 Information collected automatically

We do not use cookies for tracking. The app is not a website and sets no advertising or analytics cookies.

3.4 Stored on your device only

This information stays on your iPhone. It is not sent to us.

• Your session tokens, in the iOS Keychain, marked "this device only" so they are not restored onto another device from a backup.
• Which group you last had open, and which server address the app is pointed at.
• The identifiers of notifications the app has already shown you as a banner, so it does not show them twice.
• A copy of what the server last told the app — your name and photo, your groups and their members, and the current period's split, history and activity list — so a screen can be drawn before the network answers rather than after. It is stored in the area iOS reserves for caches, which means the system may delete it whenever it wants the space, and it is deliberately left out of device backups.

Signing out or deleting the app removes these. The cached copy is also erased when you delete your account, and when you point the app at a different server.

4. Why we use your information, and our legal bases

For people in the EEA, the UK and Switzerland, the GDPR requires us to name a legal basis for each use. Here they are.

Where we rely on legitimate interests you have the right to object — see Section 10. Where we rely on consent you can withdraw it at any time, without affecting anything done before you withdrew it.

We do not use your information to advertise to you, we do not build profiles, and we do not make automated decisions that produce legal or similarly significant effects about you (GDPR Art. 22).

5. Who can see your information

5.1 The other members of your groups

This is the main thing to understand about the app. Within a group you belong to, the other members can see:

• your display name, your colour, and your role;
• every task and expense credited to you or logged by you, including its title, points or amount, when it happened, and any note you attached;
• whether you approved or rejected somebody else's entry, and any reason you gave;
• your chat messages, for as long as those live;
• your duels and their results;
• the percentages calculated from all of the above.

They cannot see your email address or your profile photo through the app.

Group owners and admins can additionally remove members, delete the group, and issue or revoke invite codes. Nobody, including owners and admins, can approve their own entries — that is deliberate.

Anyone who joins a group later can see the group's existing history.

5.2 Service providers (processors)

We use a small number of companies to run the service. They act on our instructions under written contracts that include the data-processing terms required by GDPR Art. 28, and they may not use your information for their own purposes.

An up-to-date list is available from the privacy contact in Section 1.

5.3 Everyone else

We disclose personal information outside the above only:

• When the law requires it — a valid court order, subpoena, or lawful request from a public authority. We assess each request, disclose no more than is necessary, and tell you unless we are legally forbidden from doing so.
• To protect people — where we believe in good faith that disclosure is necessary to prevent serious harm, fraud, or a crime, or to defend our legal rights.
• In a business transfer — if the app is sold, merged, or transferred, your information may move with it. We will tell you before it does, and the buyer will be bound by a policy at least as protective as this one, or you will be able to delete your account first.

We have never sold personal information, and we do not share it for cross-context behavioural advertising. See Section 11.

6. Information about people who do not use the app

Two features let you record information about somebody who has no account:

• Managed members — a name and colour you add so a person can be credited in the split without installing anything. A child, for instance.
• Notes and chat — free text that may mention anyone.

If you add somebody as a managed member, or write about them:

• Only add a person's name if you are entitled to. For a child, that means you are their parent or guardian, or have that person's permission.
• Use a first name or nickname. Do not add addresses, phone numbers, dates of birth, identity numbers, or health information.
• Tell them the group exists, if they are old enough to understand it. We rely on you for that, because we have no way to reach them.

If you are named in somebody's Daily Responsibility group and want that removed, write to the privacy contact in Section 1. We will act on it — we may need the group's name or an invite code to find the right record, and we will not disclose the group's other contents to you in the process.

7. Children

You must be at least 16 years old to create an account. If the age of digital consent where you live is higher than 16, that higher age applies to you.

We do not knowingly collect personal information from children under 13 (or, in the EEA and the UK, from anyone below the applicable age of digital consent) — and the app is not directed to children. If you believe a child has created an account, write to the privacy contact and we will delete it.

A child can appear in the app as a managed member: a name in a household's list, added by an adult in that household, with nothing collected from the child themselves — no account, no email, no device, no contact details, and no way for the child to communicate through the app. Under the US Children's Online Privacy Protection Act (COPPA), the adult who adds that name is the one providing it, and they should provide no more than a first name. A parent or guardian may write to us at any time to review or delete what a group holds about their child.

8. Where your information is stored, and international transfers

Your information is stored in Ireland and read from the United States: each request the app makes crosses the Atlantic and comes back. We reach the same database from Ukraine in order to run and repair the service — in practice one person, connecting over an encrypted link, to fix things that break.

Neither the United States nor Ukraine has an adequacy decision from the European Commission. If the GDPR, the UK GDPR or the Swiss FADP applies to you, we rely on the following for those transfers:

• the European Commission's Standard Contractual Clauses (Decision 2021/914), with the UK International Data Transfer Addendum where UK data is involved, and the Swiss amendments where Swiss data is involved; and
• a transfer impact assessment, plus technical measures — encryption in transit and at rest — that make the data useless to anyone who intercepts it.

You can ask us for a copy of the safeguards we rely on.

9. How long we keep things

What deleting your account actually does

In Settings → Account settings → Delete account, confirmed with your password:

• Your account, your email address, your name, and your photo are erased.
• Your memberships are erased, and with them every task entry, expense, chat message and duel attached to you, in every group. This changes the historical percentages the other members see. There is no way to undo it.
• Any group in which you are the only remaining account holder is erased entirely.
• A group you own that other people still use will not be deleted, and the request is refused until you hand that group over to somebody else or delete it deliberately. This is to stop one person destroying everyone else's history by accident.

Deletion is immediate on the live database. Copies in backups are overwritten within the backup retention period above.

10. Your rights in the EEA, the UK and Switzerland

If the GDPR, the UK GDPR, or the Swiss FADP applies to you, you have the right to:

• Access — get a copy of the personal data we hold about you, and information about how we use it.
• Rectification — have inaccurate data corrected, and incomplete data completed.
• Erasure — have your data deleted ("the right to be forgotten"), which you can also do yourself in the app.
• Restriction — have us stop using your data while a dispute about it is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Object — object to any use we base on legitimate interests, on grounds relating to your particular situation. We will stop unless we can show compelling legitimate grounds that override your interests.
• Withdraw consent — at any time, where we rely on consent.
• Not be subject to automated decision-making — we do none.

How to exercise them. Some you can do yourself, immediately, in the app: change your name, replace or remove your photo, delete individual entries and expenses, mute notification categories, leave a group, delete your account. For anything else, write to the privacy contact in Section 1.

We respond within one month. We may extend that by two further months for complex requests, and will tell you within the first month if we do. There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse it — and we will explain why. We may ask you to confirm your identity, and we will not ask for more than we need to do that.

Complaints. You can complain to a supervisory authority, in particular in the country where you live, work, or where the problem happened. We have no single "lead" supervisory authority: the one-stop-shop mechanism in GDPR Art. 56 is for controllers established in the EU, and we are not one — so the authority in your own country is competent to deal with your complaint directly. In the UK, that is the Information Commissioner's Office (ico.org.uk). In Ukraine, where we are based, it is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua). We would rather you came to us first, but you do not have to.

11. Your rights in the United States

This section applies if you live in a US state with a comprehensive privacy law — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Indiana, Kentucky, or Tennessee — and we do our best to give everyone in the US the same rights regardless of where they live.

11.1 What we collect, in the statutory categories

For California's CCPA/CPRA, in the twelve months before the date at the top of this policy:

We collect this for the business purposes described in Section 4, and we retain it for the periods in Section 9.

11.2 We do not sell or share your personal information

We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding twelve months — and we do not do so now. We do not sell or share the personal information of anyone, of any age, including consumers we know to be under 16. Because we do not sell or share, there is no opt-out to offer, and a Global Privacy Control signal changes nothing about how we treat you. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

11.3 Your rights

Depending on your state, you have the right to:

• Know / access what we have collected about you, where it came from, why, and who we disclosed it to, and to receive a copy in a portable format.
• Delete what we hold about you.
• Correct inaccurate information.
• Opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects — none of which we do.
• Limit the use of sensitive personal information — we collect none.
• Not be discriminated against for exercising any of these. We do not offer financial incentives for your data, and using your rights will never degrade the app for you.

How to exercise them. Delete your account in the app, or write to the privacy contact in Section 1. We verify your identity against the account — usually by requiring the request to come from, or be confirmed at, the account's email address — and we respond within 45 days, extendable once by another 45 days if we tell you why. An authorised agent may act for you with written permission signed by you; we may still ask you to confirm the agent's authority directly.

Appeals. If we refuse your request, you may appeal by replying to our decision with the word "appeal". We will respond within 45 days (60 in some states) explaining our reasoning. If we deny the appeal, you may contact your state Attorney General — in Virginia, oag.state.va.us; in Colorado, coag.gov; in Connecticut, portal.ct.gov/ag; in Texas, texasattorneygeneral.gov.

California Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada (NRS 603A). We do not sell covered information, and have no sale to opt out of.

12. Security

• Passwords are stored as bcrypt hashes with a per-password salt. Nobody at our end can read your password.
• Long-lived sign-in tokens are stored on the server only as SHA-256 hashes, so a database leak does not hand out live sessions. They expire, and signing out revokes them.
• On your iPhone, tokens live in the iOS Keychain, marked "this device only".
• All traffic between the app and the server is encrypted with TLS in released builds.
• The database is Supabase's managed Postgres. The connection from the API server is encrypted with TLS, and every table has row-level security enabled with no policies, so the database's own public API grants nobody anything — only the API server, which connects as the tables' owner, can read them.
• The cached copy on your phone is written with iOS file protection, so it cannot be read until the phone has been unlocked at least once since it was switched on.
• Access to the production database is restricted to the sole developer, over an authenticated, TLS-encrypted connection. Nobody else holds credentials for it.

No system is perfectly secure, and we cannot promise one. If a breach happens that is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as GDPR Art. 33 requires, and we will tell you directly and without undue delay where Art. 34 or the applicable US state breach law requires it.

Please help: use a password you do not use anywhere else, and keep your phone locked.

13. Changes to this policy

We will update this policy when the app changes. The version number and the "last updated" date at the top always tell you which version you are reading, and the current version is always available in Settings → Privacy inside the app and at <https://api.dailyresponsibility.app/legal/privacy>.

If a change materially affects your rights, we will tell you in the app before it takes effect, and — where the law requires your consent — ask for it rather than assume it. Past versions are available on request.

14. Contact

Questions, requests, and complaints: privacy@dailyresponsibility.app.

If you would rather write on paper — to send a formal notice, or simply because post suits you better than email — ask at that address and we will give you one to write to.

This document describes Daily Responsibility version 1.0 (build 2) and the server it talks to.