Privacy Policy

Effective date: January 16, 2026

Who we are. Daybeam is developed by Long Way Studio LLC. This Privacy Policy covers our iOS app (including TestFlight), our website, and related services (the “Service”).

Contact

Email: hi@letsdaybeam.com
Mailing address:
Long Way Studio LLC
c/o Northwest Registered Agent LLC
522 W Riverside Ave, Ste N
Spokane, WA 99201, United States

Summary (plain language)

• We don’t run ads and don’t sell your data.
• We don’t have user accounts.
• Your session audio/transcripts/generated audio are stored on-device. We don’t store this content on our servers beyond transient processing.
• We use a random User ID (Support ID) to reference your device across PostHog (US cloud), Sentry, RevenueCat, and our Cloudflare Worker logs, and we do not send it to AI providers.
• We do not log your intention/script text in analytics, proxy logs, or crash reporting. In uncommon OS-level crash scenarios, a short, non-searchable fragment of in-memory text might be included by the operating system or a third-party SDK. When that occurs, we automatically redact known sensitive fields, avoid storing request bodies, keep any crash payloads at most 30 days, and honor deletion requests tied to your Support ID (deleted within 7 days of verification).
• OpenAI model training is disabled for our organization. OpenAI may retain certain API logs (including inputs/outputs) for up to 30 days for abuse monitoring and reliability.
• US-only availability at launch.
• You can request access/deletion using your User ID (see “Your privacy rights” below).

Data we collect

• App telemetry & diagnostics. Crash reports (Sentry), performance metrics, basic device/application metadata (e.g., app version, OS version), event counts (PostHog).
• Purchase & entitlement data. Receipts and subscription status via Apple and RevenueCat (we don’t receive your full billing details).
• Network logs (proxy). Our Cloudflare Worker routes select AI requests; it logs routing metadata (timestamps, status codes) and the User ID. We do not log intention/script text at the proxy, and we do not forward the User ID to OpenAI.
• Support communications. If you email hi@letsdaybeam.com, we process and retain your message and address to respond and maintain support records.
• Beta signup (optional). If you choose to join, we collect your email address to send you Daybeam updates. We do not sell your email or share it with third parties for their marketing. You can unsubscribe at any time, and you can request deletion by emailing hi@letsdaybeam.com.
• Website analytics (if enabled). Our site may use non-advertising analytics (e.g., PostHog US cloud). Tools may set cookies or local storage solely to measure traffic and features.

Diagnostics & crash-log safeguards

• We configure analytics and crash reporting to exclude user content (no prompts/transcripts/TTS scripts or audio).
• We do not attach request bodies or chatty contexts to error events and regularly strip breadcrumbs/extra fields that could carry text.
• In uncommon OS-level crashes where a short fragment could appear, we auto-redact known sensitive patterns, retain payloads at most 30 days, and will delete on request within 7 days after verifying your Support ID.

Data we avoid

• No user accounts or profile fields.
• No address book, photos (beyond what you intentionally share via OS mechanisms), precise location, or motion activity.
• No ad networks; no cross-context behavioral advertising.

How we use data

• Operate core features (recording, transcription, script generation, TTS playback).
• Determine and restore subscription entitlement status.
• Debug, test, secure, and improve the Service (including pre-release TestFlight).
• Measure high-level usage (e.g., session counts) to find product-market fit without personal profiling.

AI processing & providers

• What’s sent. To create your session’s script and audio, we send your recording (or transcription) and related prompts to our AI provider through our secure Cloudflare proxy.
• Provider. We use the OpenAI Platform API. Model training is disabled. OpenAI may retain certain API logs (including inputs/outputs) for up to 30 days for abuse monitoring and service reliability. This retention is outside our direct control.
• Identifiers. We do not attach your User ID to AI requests unless required for reliability. We avoid sending personal identifiers to OpenAI.
• Your choices. You can minimize exposure by avoiding personal details in inputs or by not using AI features.

TestFlight participants

• TestFlight may include additional Apple diagnostics. Beta features can have incomplete privacy controls. Participation is voluntary and can be ended by uninstalling.

Accessibility preferences (local-only).

The app reads certain iOS accessibility settings (e.g., VoiceOver state, text size, Reduce Motion, Increase Contrast) on-device to adapt the UI. We do not collect or transmit these settings to our servers or analytics providers. If you voluntarily share information about accessibility needs or a disability, we use it only to investigate and resolve your support request and to maintain necessary support records.

Washington consumer health data

• Some information you provide (e.g., wellbeing reflections) may be “consumer health data” under Washington law. We apply the collection, use, and disclosure limits in this Policy to such data. We do not sell consumer health data. We use it only to provide and improve the Service.
• Categories & sources. If you share reflections about wellbeing, we process those only to generate your session (from your recording/transcript) and to operate the Service.
• Purposes. Provide session generation (Whisper → script → TTS), keep the Service secure and reliable, measure high-level usage, and handle support.
• Sharing. We share with processors only (Apple IAP, RevenueCat, Cloudflare, OpenAI, Sentry, PostHog). We do not sell consumer health data.
• Consent. Your use of these features is a clear affirmative action to process this data only for the purposes above.
• Your choices. Avoid including personal details; you can request access/deletion via your User ID.
• Geofencing. We do not use geofencing around health facilities.

Legal bases (where applicable)

• We process data to perform the contract (provide the Service), for our legitimate interests (safety, security, improvement), and to comply with legal obligations.

Retention

• App analytics events may be retained up to 7 years by our analytics provider. Crash diagnostics (including any rare OS-level fragments) are retained no longer than 30 days.
• OpenAI may retain certain API logs for up to 30 days.
• Apple/RevenueCat purchase records are retained as required for transaction integrity, fraud prevention, and accounting.
• Support emails are retained for as long as reasonably necessary to provide support and maintain records.

Sharing

• Processors only. We share data with service providers acting on our behalf: Apple (IAP), RevenueCat (entitlements), Cloudflare (proxy), OpenAI (processing), Sentry (errors), PostHog (usage analytics).
• No sale; no ads. We do not sell personal information or share it for cross-context behavioral advertising.
• Law & safety. We may disclose information if required by law or to protect users and the Service.

Security

• We use technical and organizational measures appropriate to our size and the nature of the Service. No method of transmission or storage is 100% secure.

Your privacy rights (US states)

• Depending on your state, you may have rights to access, correct, delete, or obtain a copy of certain information.
• Because we do not maintain user accounts, we may only be able to locate records using your User ID.
• If available in your app version, we may also verify using a purchase token associated with your account (for example, Apple’s appAccountToken).
• To exercise a right, email hi@letsdaybeam.com with your User ID (Settings → Support → Copy).
• We do not sell personal information or share it for cross-context behavioral advertising.

Appeals & authorized agents

• If we decline your request, you can appeal by emailing hi@letsdaybeam.com with subject “Privacy Appeal” and your User ID.
• You may submit requests via an authorized agent. We may need to verify your identity and your agent’s authority (for example, via your User ID and a short written permission).

Children’s privacy

• The Service is not directed to children and is intended for adults 18+. We do not knowingly collect information from children. If we learn a child has provided information, we will delete it upon notice.
• The App Store age rating reflects content guidelines, not legal eligibility; Daybeam is intended for adults 18+.

International

• The Service is offered US-only at launch. Data is processed in the United States and may be processed by our U.S.-based providers.

Critical: Save your User ID

• We cannot identify you without your User ID (found in Settings → Support).
• Before uninstalling: Save your User ID if you may want data deletion later.
• Without your User ID, we may be unable to locate or delete analytics logs associated with your device.

Your choices

• We don’t offer an in-app opt-out for basic analytics or crash reports. Some OS-level settings may affect diagnostic sharing with Apple, but they do not control our analytics providers. To avoid analytics/crash reporting, you can stop using the Service.
• You can avoid sending personal details in recorded inputs.

Changes to this Policy

• We may update this Policy from time to time. Material changes will be noted by updating the “Effective date.” Continued use means you accept the updated Policy.

Contact

• Email hi@letsdaybeam.com for privacy questions or requests (include your User ID).