Daily Thread

Legal

Privacy policy

This is a translation for convenience; in case of doubt, the German version prevails.

1. Controller

Simon Luckey
Graf-Zeppelin-Straße 38
33181 Bad Wünnenberg
Germany
E-mail: hello@dailythreadapp.com

2. In short

3. This website

Hosting and server logs

The website is delivered via Firebase Hosting by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit it, the server processes technically necessary data such as IP address, date and time, the page requested, browser and operating system, in order to deliver the page and protect it against misuse. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). According to Google, IP addresses are kept for a few months to detect abuse and deleted afterwards. A data processing agreement is in place with Google.

No tracking

We use no analytics tools and no social media plugins. Fonts are not loaded from external servers.

If you choose light or dark mode at the top, your browser remembers this choice locally (in so-called localStorage), so the page looks the same on your next visit. This setting stays on your device and is not sent to us. You can delete it at any time in your browser settings.

Waitlist

If you sign up for notifications, we store your e-mail address, the time of sign-up and your consent in Cloud Firestore by Google Ireland Limited, data centre Frankfurt am Main, Germany. We use the address exclusively to inform you about the launch of Daily Thread.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by e-mail to hello@dailythreadapp.com. We delete your address after sending the launch message, at the latest 12 months after sign-up, or immediately after you withdraw your consent.

4. The "Daily Thread" app

Without an account: everything stays on your phone

Your entries (mood, feelings, texts, place, favourites, pictures), saved AI analyses and settings are stored encrypted (AES-256) on your device. The key is kept in the phone's security chip. We receive none of it.

Because diary entries can contain information about your health and mood, we ask for your explicit consent before use (Art. 9(2)(a) GDPR).

With an account: sign-in

For accounts we use Firebase Authentication by Google Ireland Limited. It stores your e-mail address, display name, sign-in method and technical sign-in data. When you sign in with Google, Google sends us your name and e-mail address. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Firebase Authentication is a global service; data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply.

With an account: cloud backup (end-to-end encrypted)

When you turn on the cloud backup, you set your own sync password. From it, a key is derived on your phone (PBKDF2, AES-256-GCM). Entries, settings and saved analyses are encrypted with it before they are uploaded, and stored in Cloud Firestore by Google Ireland Limited, data centre Frankfurt am Main, Germany.

Neither we nor Google can read the contents. Only technical details are unencrypted: on which days there are entries, when they were changed, and the salt and check value of the password (not the password). The password itself never leaves your phone. If you forget it, we cannot decrypt the cloud copy.

Legal bases: your explicit consent (Art. 9(2)(a) GDPR) and the performance of the contract (Art. 6(1)(b) GDPR). You can turn off the cloud backup at any time and delete the cloud copy in the app.

Protection against misuse (App Check)

So that only the genuine app can access our database, we use Firebase App Check with the Google Play Integrity API. Google checks whether the app comes unchanged from the Play Store and runs on a genuine device, and processes device and app information for this. The legal basis is our legitimate interest in security (Art. 6(1)(f) GDPR).

Features provided by Android

Backup file

You create a backup file yourself and store it wherever you like. If you wish, it is encrypted with a password. We do not receive it.

5. Recipients

Our processor is Google Ireland Limited (Firebase Hosting, Authentication, Cloud Firestore, App Check). Data is not passed on to other third parties, for advertising or for sale.

6. Retention

We keep account data and the cloud copy until you delete your account or the cloud copy. Deletion happens immediately in the app or within 30 days on request (Delete account). You delete data on your phone yourself, at the latest when you uninstall the app.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for your place of residence or the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

A note on access requests: because the cloud copy is end-to-end encrypted, we cannot read out its contents for you. You can get a complete, readable copy yourself at any time via the backup file in the app.

8. Age

Daily Thread is intended for people aged 16 and over.

9. Changes

We update this policy when the app or the legal situation changes. Last updated: November 2026.