Privacy
Version 2026-09-06. This is the version recorded against your account when you signed up.
Daybook holds a team's internal planning: what they are building, what is broken, what they have decided and why. That is more sensitive than most project tools admit, so this page says plainly what happens to it rather than describing a category of processing in the abstract.
Who is responsible
The controller for the personal data described here is Uladzislau Hreben, operating as HREBEN, a sole trader established in Poland and entered in the CEIDG register — NIP 5273097952, REGON 527715202. Reachable at privacy@daybook.team, which is the fastest way and the one that is read. A postal address is provided on request.
For your workspace's contents the roles reverse: you are the controller and Daybook is the processor. You decide what goes in, and it is not looked at, mined, or used to train anything.
What is stored
- Account details — email address, display name, a hashed password, and if you sign in with Google, the identifier Google returns. Passwords are hashed and never recoverable.
- Workspace content — projects, objectives, epics, work items, comments, documents, releases, labels and any files attached to them.
- Feedback you collect — including anything the person submitting it typed, and the page context your widget captured.
- Activity — who changed what and when, including which assistant made a change through the connector.
- Operational logs — requests, errors and email delivery records.
- Billing — a Stripe customer and subscription reference. Card numbers never reach Daybook; Stripe holds them.
Cookies
One, and it does nothing but change a button. When you sign in, the app stores daybook_signed_in=1 against daybook.team so this site can offer you a link to your console instead of a sign-in form. It holds the digit 1 and nothing else — no identifier, no session, nothing that could be used to reach an account. Signing out removes it, and refusing it costs you one extra click.
There is no analytics, no advertising and no third-party script on this site, so there is nothing else to consent to and no banner asking you.
Where it lives
Your workspace is stored in the European Union, in Finland, and nothing is stored outside it. Traffic may pass through servers elsewhere on its way to you, as it does for any site reached over the internet, but it is not kept there.
Who else is involved
These are the only third parties that receive any data, and what each one gets:
| Subprocessor | Purpose | What it receives | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, database, file storage, backups | Everything | Finland |
| Cloudflare | DNS, TLS, proxy | Traffic in transit | Global |
| Postmark | Transactional email | Recipient address and message content | United States |
| Stripe | Payments | Billing contact and payment details | United States / EU |
| Sign-in, only if you use it | The fact that you signed in | Global |
Assistants connected over MCP are not subprocessors of Daybook. When you connect one, you are sending your own data to a provider you chose, under your agreement with them.
How long it is kept
- Workspace content — until you delete it. Deleting is reversible for a short period, because an accidental deletion is more common than a deliberate one.
- Backups — a matter of weeks, then permanently removed. Content you delete can persist in a backup until it ages out.
- Operational logs — kept only as long as they are useful for running and debugging the service, which is longer for an error than for an ordinary request and is never more than a few months.
- Billing records — as long as tax law requires, which is longer than the rest.
Getting your data out, or deleted
Every workspace can be read in full through the API and the MCP connector using a key you create yourself, so an export needs nobody's permission.
There is not yet a one-click export or a self-serve account deletion. Email privacy@daybook.team from your account address and both are done by hand within 30 days, usually the same week. Deletion removes the workspace and its contents; backups containing it age out shortly afterwards.
Your rights
Under the GDPR you may ask for a copy of your data, correction of anything wrong, deletion, restriction of processing, or portability, and you may object to processing. Write to privacy@daybook.team. If the answer does not satisfy you, you can complain to your national data protection authority.
Security
Traffic is encrypted in transit and data is encrypted at rest. Passwords are hashed and cannot be recovered, by us or by anyone. Credentials you connect — a repository token, a calendar permission — are encrypted before they are stored. Uploaded files are private and reachable only through links that expire. Backups are taken on a schedule and restoring from them is tested rather than assumed.
Perfect security is not claimed by anyone honest. If something happens that affects your data, you will be told what happened and what it means, without waiting to have a tidy story.
Changes
This page carries a version. When it changes materially you will be told before the new version applies, not after.