Privacy
policy.

01

Who runs this

Daily Tracker (daily.imjay.in) is a personal productivity tool operated independently by Jayesh Patil, based in Nashik, Maharashtra, India. For the purposes of the General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act 2023 (DPDP Act), we are the data controller for the information described below.

02

What we collect

From Google sign-in. When you sign in with your Google account, Google sends us:

• Your name
• Your email address
• A unique Google account identifier (the sub claim)
• The URL of your Google profile picture

Signing in uses only the openid, email, and profile OAuth scopes. On its own, signing in gives us no access to your Gmail, Google Drive, Calendar, contacts, or anything else in your Google account.

Google Calendar is the one exception, and it is entirely optional and separate. If — and only if — you choose to connect it in Settings, Google asks you to approve a second, read-only permission. That is described in full in section 06. Signing in never grants it, and disconnecting a calendar never affects your ability to sign in.

From your use of the app. Everything you type into Daily Tracker is stored:

• The text of each task
• The date each task is for
• Whether each task is pending or completed
• Timestamps of when tasks are created, edited, and finished
• Meeting notes you write, including titles, times, attendee names you type, and the note body
• Repeating-task templates you set up
• An activity log of changes to your tasks — created, completed, edited, deleted — so your history stays accurate even after a task moves between days

Automatically. Our server logs receive standard web traffic information including your IP address, browser user agent, and request timestamps. These logs are retained for at most 30 days and are used only for security and debugging.

First-party analytics. We run our own analytics on our own server — your task data is never sold or shared. We record page views (the page path and the referring site), an anonymous visitor identifier stored in a first-party cookie, and brief presence pings while the app is open so we can show how many people are using it right now. We use this only in aggregate to understand usage and how people find us, and to keep the service healthy. We do not build advertising profiles, and we do not use it to identify you personally.

Search and AI crawlers. When automated crawlers (such as Googlebot, or AI answer-engine bots like GPTBot, ClaudeBot and PerplexityBot) visit public pages, we record the visit so we can see how the site is indexed and surfaced. These are counted separately from people.

We use two first-party cookies: a session cookie that keeps you signed in, and an anonymous analytics cookie (dt_vid) that lets us count unique visitors without identifying you. There are no third-party cookies, no third-party analytics tags, no advertising identifiers, and no fingerprinting.

03

How we use it

We use the information above only to:

• Authenticate you and keep you signed in
• Show you the tasks you've created
• Operate, maintain and improve the service
• Diagnose and fix bugs
• Investigate and prevent abuse or security incidents

That's the complete list. We don't profile you, we never train any AI model on your tasks or notes, and we don't use your information for any other purpose. If you switch on the optional AI features, text you choose to send is passed to your own AI provider account — described in section 07 — and never through an account of ours.

04

Who we share it with

Almost nobody. We do not sell your data and we do not share it with advertisers. Our analytics are first-party only — we use no third-party analytics service, and analytics data never leaves our server. We have no marketing partners.

Google handles authentication when you sign in, and — only if you connect it — serves your calendar events. Google's handling of your information is covered by the Google Privacy Policy.

xAI receives text only if you have added your own AI key and then use an AI feature. See section 07 for exactly what is sent and when.

People you choose. If you share a project with a team, its members can see that project's tasks. If you create a shareable report link, anyone holding that link can read that report. Both are actions you take deliberately, and both can be undone — see sections 08 and 09.

If we are ever required by valid legal process to disclose information, we will comply with the minimum scope required and notify you unless prohibited from doing so.

05

Where your data is stored

Your data is stored on our hosting provider's infrastructure. Communication between your browser and our server is encrypted using TLS (HTTPS). Tasks, account records, and session tokens are stored in a MySQL database; all queries use prepared statements, and access is restricted to the application itself.

06

Google Calendar (optional)

This is off unless you turn it on in Settings, and it is a separate permission from signing in.

What we ask for. A single read-only scope, calendar.readonly. There is no code in this application that can create, edit or delete anything in your calendar — not restricted by policy, but absent entirely.

What we read. For each day you view or sync, the events in the calendar you selected: title, start and end time, and attendee names. We do not read calendars you did not select.

What we store. From each event we keep the title, times and attendees, in order to create the meeting note and optional task on your board. We also store an encrypted Google refresh token so the connection keeps working without asking you again. The token is encrypted with a key held in the server’s configuration, not in the database.

What we ignore. All-day events, and invitations you have declined.

Disconnecting. Settings → Google Calendar → Disconnect deletes the stored token immediately. Notes and tasks already created stay, because they are yours; delete any of them individually if you’d rather not keep them. You can also revoke access from your Google account permissions page, which we honour immediately.

07

AI features (optional, your own key)

AI is off unless you add your own API key from xAI. We do not operate a shared AI account, so nothing you write is ever processed under our credentials or mixed with another user’s data.

Your key. It is encrypted before being stored, using a key held in the server’s configuration rather than the database — so a copy of the database alone cannot reveal it. It is never shown in the browser again; the screen displays only the last four characters. Remove it at any time in Settings, which deletes it and switches every AI feature off.

What gets sent, and only when you ask. Nothing is sent automatically. Text leaves this server only when you press an AI button:

• Rephrase — the single task you typed
• Extract action items / Summarise — that meeting’s notes, title, date and attendees
• Ask about this meeting — the same, plus your question and recent replies in that conversation
• Rewrite report — the report as displayed on screen

Where it goes. Directly to xAI’s API under your key. Their handling is governed by the xAI privacy policy, and your usage is billed to your account. We keep a record of when AI was used and whether it succeeded, for rate-limiting and troubleshooting — not the content.

A caution worth stating plainly. Meeting notes often contain other people’s names and words. Sending them to any AI provider means sending that information to a third party. Consider whether that is appropriate before using these features on sensitive material.

08

Teams and shared projects (optional)

By default every project is private to you. If you choose to share one with a team:

• Team members can see all tasks in that project, including who created each one and who it is assigned to
• Your name and email address are visible to other members of that team
• Projects you have not shared remain private, as do your meeting notes — those are never shared by a team

Inviting someone sends a single-use link tied to the email address you entered; it expires after 14 days and can only be accepted by an account using that address. Set a project back to Personal, or leave the team, at any time.

09

Shared report links (optional)

You can turn a report into a link that is readable without signing in. Anyone who has the link can read that report, so treat it like a password and send it only to people you intend to see it.

Links carry an expiry date you choose, can be revoked instantly, and are marked so search engines do not index them. A link shows the report’s current contents rather than a frozen copy, so corrections you make later are reflected for anyone still holding it. We record how many times a link has been opened, and when it was last opened — not who opened it.

10

How long we keep it

• Tasks — kept until you delete them.
• Account records — kept until you ask us to delete your account.
• Server logs — kept for at most 30 days, then automatically rotated.
• Session cookies — expire 30 days after your last sign-in.

11

Your rights

You can export your own data at any time, without asking us: open Export in the app and download your tasks, meeting notes and activity log as CSV or JSON. No request or waiting period.

You have the right to:

• Access your data — most of it is visible inside the app itself.
• Export your data — use the "Copy DAT" / "Copy DS" buttons in the app, or email us for a complete machine-readable export.
• Correct your data — edit any task in the app at any time.
• Delete your data — delete individual tasks in the app, or email hello@imjay.in to delete your entire account, after which all associated data is wiped within 30 days.
• Withdraw consent — sign out and request account deletion at any time.
• Lodge a complaint — if you are in India, you may approach the Data Protection Board under the DPDP Act 2023; if you are in the EU/EEA, your local supervisory authority.

You can also revoke Daily Tracker's access to your Google account at any time from Google's third-party access page.

12

Children

Daily Tracker is not directed at, or intended for, children under 13 (or under 16 in the European Union). We do not knowingly collect data from anyone in this age group. If you believe a child has used our service, please contact us and we will delete their data.

13

Security

We protect your data using:

• HTTPS (TLS) for every request
• HttpOnly, SameSite=Lax session cookies
• CSRF tokens on every state-changing request
• Prepared SQL statements (no string interpolation)
• Per-user isolation enforced at the database query level — users cannot see or modify each other's tasks
• Session ID regeneration on sign-in to prevent fixation attacks

No system is perfectly secure. If you discover a security issue, please email hello@imjay.in — we'll respond promptly and credit you if you'd like.

14

Changes to this policy

If we change this policy in any material way, we will update the "Last updated" date above and, if you have an account, send a notification to your account email at least 14 days before the changes take effect. Your continued use of Daily Tracker after the effective date constitutes acceptance of the revised policy.

15

Contact

For any privacy question, request, or concern:

• Email: hello@imjay.in
• Operator: Jayesh Patil
• Location: Nashik, Maharashtra, India