Privacy Policy

Daykite is a calendar, task and booking service run by Daykite (“we”, “us”). For the personal data you put into your account, we are the data controller.

When you use Daykite to collect other people’s details — guests who book a time on your booking page, or colleagues you add to a project — you decide what is collected and why. For that data we act on your behalf, and you’re responsible for having a reason to collect it.

Questions about this policy or your data: privacy@daykite.com.

We collect only what the service needs to work:

We don't use advertising trackers, sell data to data brokers, or run third-party analytics scripts in the app.

Our public website (the home page, feature and pricing pages, docs and blog) uses Google Analytics to count visits and see which pages are useful. It records the pages you view, roughly where you are, your device and browser, and how you arrived. It doesn't run on the signed-in app, and we don't send it your account details or anything you put in Daykite. You can block it with your browser's tracking protection or Google's opt-out add-on.

• To run the service — show your calendar, sync it, send booking confirmations and reminders, run the automations you set up, and keep your devices in step.
• To keep accounts secure — verify your email address, check sign-ins and two-factor codes, show you your active sessions, and stop abuse.
• To bill organizations — count seats and keep subscription status up to date.
• To support you — answer questions and fix the bugs you report.
• To tell you about the service — important changes to your account, security or these terms. We don’t send marketing email without your consent.

Where laws such as the GDPR require a legal basis, we rely on performing our contract with you for running the service and billing, legitimate interests for security and fixing problems, consent for connecting Google and any optional email, and legal obligations for keeping financial records.

We do not use your content to train artificial-intelligence or machine-learning models, unless you turn on “Help improve DayKite AI” (section 5). Data from Google is never used for that, whatever you choose.

Using Google is optional. Continue with Google only signs you in. Connecting Google Calendar is a separate step, and you’re asked separately again for Gmail, Google Meet and Google Sheets — only when you turn on a feature that needs them. Here is exactly what each permission is used for:

In line with those requirements:

• We use Google user data only to provide and improve the features you can see in Daykite and that you turned on.
• We transfer it to others only when needed to provide those features (for example, to the people you share a Space with, at the visibility you choose), to comply with the law, for security, or as part of a merger or sale with notice to you.
• We don't use it for advertising, including retargeting or personalised or interest-based ads, and we don't sell it.
• We don't use it to build or train generalised artificial-intelligence or machine-learning models.
• No person at Daykite reads it unless you give us permission for a specific support request, it's necessary for security (such as investigating abuse), it's required by law, or it has been aggregated and anonymised for internal operations.

Google access and refresh tokens are encrypted (AES-256-GCM) before they are stored. You can disconnect Google at any time under Integrations: we revoke our access with Google straight away and stop syncing. You can also remove access from your Google Account permissions page. Events already copied from Google stay in your account, hidden, until you delete them or your account; ask us at privacy@daykite.com and we’ll remove them sooner.

The assistant answers questions about your calendar, tasks and routines, and suggests changes that happen only when you confirm them. It sees what you can see in Daykite, under the same visibility rules.

Most requests never reach an AI model — quick actions and everyday requests are answered by Daykite’s own code. Open-ended requests are sent to an AI model provider (see section 6): the request, the last few messages of the conversation, the information the assistant looked up to answer it, and any page or email text you chose to share from the Chrome extension. Before anything is sent, passwords, keys, tokens and payment card numbers are masked, and shared page text is cut to a fixed size. The provider processes it only to produce the answer.

The Chrome extension reads a web page only when you ask it to — by right-clicking selected text, or by ticking “Include this page” — and then only the selection, the open email, or the page’s main text. Web addresses are stored without their query strings.

• Retention: conversations are kept for 90 days unless you choose 7 days, 30 days or a year in Settings → Assistant; shared page and email text is removed after 7 days; unanswered suggestions expire after 30 minutes. You can delete all assistant history at any time.
• Improving the assistant: “Help improve DayKite AI” is off unless you turn it on. When on, conversations without page or email content may be used to improve the assistant. Data received from Google APIs is never used for this, or to train any AI model.
• Separate storage: assistant data is kept apart from your calendar data and is deleted with your account.

We share personal data only in these cases:

• People you share with. Members of your Spaces, projects and organization see what the visibility settings allow — full details, “busy” only, or nothing. Guests see what your booking page shows them.
• Service providers who process data for us under contract, only to run Daykite:

• Tools you connect yourself. Webhooks, API keys and apps you authorise receive the data you point them at. Their own privacy policies apply once it reaches them.
• The law. When we must, to comply with a valid legal request, or to protect people’s safety or the service. Where we’re allowed to, we’ll tell you first.
• A change of ownership. If Daykite is merged or sold, your data moves with the service under this policy, and we’ll tell you beforehand.

We don't sell personal data, and we don't share it for cross-context behavioural advertising.

• Your account and content — for as long as you have an account. Items you delete are marked deleted so your other devices can catch up, and are removed with your account.
• When you delete your account — your profile, the Spaces you own and their calendars and events, tasks, routines, connected accounts and sessions are deleted immediately. Events you organised in other people’s Spaces stay there without your name on them. Copies in encrypted backups are overwritten as those backups rotate.
• Sign-in sessions — up to 30 days, or until you sign out. Email and sign-in codes expire within 15 minutes and stop working after five wrong attempts.
• Billing records — as long as tax and accounting law requires, even after an account is closed.

Most of these you can do yourself, straight away, without contacting anyone:

• See and download your data — Settings → Account → Your data exports everything as a JSON file, and each calendar as an .ics file.
• Correct it — edit your profile and content in the app.
• Delete it — delete items individually, or your whole account from Settings → Account.
• Withdraw consent for Google — disconnect it under Integrations.
• Control notifications — Settings → Notifications.

Depending on where you live (for example under the GDPR, UK GDPR or California law), you may also have the right to restrict or object to processing, and to complain to your local data protection authority. Email privacy@daykite.com for anything the app doesn’t cover; we answer within 30 days and won’t treat you differently for asking.

Connections to Daykite use HTTPS. Passwords are hashed, never stored as text. Tokens for connected services are encrypted. Attachments are only served to signed-in people with access to them. You can turn on two-factor authentication and see or end your active sessions in Settings.

No system is perfectly secure. If we learn of a breach that affects your data, we’ll tell you and the authorities as the law requires. To report a vulnerability, email security@daykite.com.

In the app we use only what's needed to sign you in and remember your settings — no advertising or cross-site tracking cookies. The public website also sets Google Analytics cookies:

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

Daykite isn’t meant for anyone under 16, and we don’t knowingly collect their data. If you believe a child has given us personal data, email privacy@daykite.com and we’ll delete it.

When we change this policy we update the effective date above. If a change is significant — especially to how we use Google user data — we’ll email account owners before it takes effect, and ask for your consent again where the law or Google’s policies require it.

Privacy questions and requests: privacy@daykite.com. Everything else: help@daykite.com.