Privacy Policy
Last updated: October 6, 2026
The short version
- Your notes, meetings and images are yours. They’re encrypted at rest, we never sell them, and we never use them to train AI models.
- We collect usage and device data to improve the quality and performance of DayCarp, to understand where visitors come from, and to keep the service safe.
- If you’re in the EU/EEA, the UK or Switzerland, we ask first. Until you say yes, we only count anonymous page views.
- You can change your cookie choice at any time, export your notes, and delete your account yourself in Settings.
1. Who we are
DayCarp is operated by 2599577 Ontario Corporation, doing business as DayCarp (“DayCarp”, “we”, “us”), a company incorporated in Ontario, Canada. We run the website at daycarp.com and the DayCarp app at note.daycarp.com (together, the “Service”) and are responsible for the personal information described in this policy.
We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and the privacy laws that apply to our users elsewhere, including US state privacy laws and, for users in the EU/EEA, the UK or Switzerland, the GDPR. Our Privacy Officer is accountable for this policy and can be reached at alex@daycarp.com.
2. What we collect
Account information
When you create an account: your email address, your name if you give one, a securely hashed version of your password (we never store the password itself), your time zone, your plan, whose referral link you signed up through (if any), and when you agreed to our Terms and this policy.
Signing in with Apple, Google or Microsoft
If you choose to sign in with Apple, Google or Microsoft, that company confirms who you are and tells us only your email address (with whether it has verified it), your name if it shares one, and a fixed identifier for your account there. We use them only to sign you in, to create your DayCarp account if you don’t have one, and to connect the sign-in to the account that already uses that email address (we email that account when we do). We keep the identifier and the email address the provider gave, so the same account can sign you in again, and you can see and remove them in Settings → Account. We don’t receive your password there, your contacts, files or anything else from that account, and we don’t ask for access to them. With Apple’s “Hide My Email” we get an address Apple forwards to you. Each provider’s own privacy policy applies to its part of the sign-in. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
Your content
The notes, tasks, topics, images, meeting transcripts, AI settings and integration settings you create or connect. Your notes, meetings and images are encrypted at rest with 256-bit keys, and API keys you add are encrypted separately. Meeting audio is never stored: we keep the transcript only.
Billing information
If you subscribe, payments are handled by Stripe. We receive your subscription status, plan, billing period and a Stripe customer reference. We never see or store your full card number.
Security and service logs
To sign you in and keep your account safe, we record sign-in attempts and active sessions, including the IP address and browser (user agent) they came from, and we apply rate limits per address.
Usage and device data (analytics)
We collect data about how the Service is used to improve its quality and performance. With full analytics this includes:
- A browser identifier: a random ID stored in a cookie (
dcv) that is shared between daycarp.com and the app. - A device fingerprint: an identifier calculated in your browser from characteristics of your device and browser (for example screen, fonts, graphics and audio capabilities), using the open-source FingerprintJS library that we host ourselves. It is sent only to us.
- Network and location: your IP address and the approximate location we derive from it (country, region, city), using the DB-IP database on our own servers.
- Device details: browser, operating system, device type and model, screen size, language, time zone, and hardware hints the browser provides.
- How you found us: the page that referred you and campaign tags in the link (such as
utm_source), and which pages you visit. - How you use the app: which features you use (for example opening a note, running a search, starting a meeting), linked to your account when you’re signed in.
- Automated checks: signals that help us tell people from bots and detect tampering or automation. These checks only produce labels; they never try to get around privacy protections in your browser.
We use this to see which features work and which don’t, find performance problems, understand which of our pages and campaigns bring people to DayCarp, count visitors and devices, and spot abuse. We may link devices that clearly belong to the same person (for example, the same account, or the same fingerprint on the same network) so our numbers count people rather than browsers.
“Essential only”
If you choose Essential only, or if you’re in the EU/EEA, the UK or Switzerland and haven’t said yes, we record only an anonymous page view: the page, the referring website, campaign tags and your country. We don’t set the dcv cookie, calculate a fingerprint, run the browser checks, or store your IP address, device details or a location finer than the country. If you’re signed in, we still record which app features you use as part of providing the Service to your account.
3. How we use it, and our legal bases
We only collect what we need for the purposes below. In Canada and the US we rely on your consent: you give it expressly when you create an account and agree to this policy, and for analytics we rely on your implied consent based on this notice, which you can withdraw at any time with Cookie settings. For users in the EU/EEA, the UK and Switzerland, the legal bases are:
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Providing the Service: your account, syncing and storing your content, AI and transcription features you use, integrations you connect | Performance of our contract with you |
| Billing and subscriptions | Performance of our contract; legal obligations (tax and accounting) |
| Security, fraud and abuse prevention, rate limiting | Our legitimate interest in keeping the Service and its users safe |
| Full analytics (browser identifier, fingerprint, IP, location, device details) for visitors in the EU/EEA, UK and Switzerland | Your consent, which you can withdraw at any time |
| Full analytics for visitors elsewhere; anonymous page counts; feature usage of signed-in accounts | Our legitimate interest in understanding and improving the Service |
| Messages about your account, security or changes to these terms | Performance of our contract; legitimate interest |
We don’t use your data for advertising, we don’t sell it, and we don’t share it for cross-context behavioral advertising. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Cookies and local storage
| Name | What it’s for | How long |
|---|---|---|
__Host-dcs | Keeps you signed in (essential) | Until you sign out, or 30 days without use (a year at most) |
__Host-dcc | Protects forms against cross-site request forgery (essential) | Browser session |
__Host-dcp | Holds a sign-in with Apple, Google or Microsoft while you’re at that company’s page, to check it’s the same sign-in when you come back (essential) | 10 minutes |
dc_signed_in | Notes that this browser is signed in to the app; holds no identity (essential) | Browser session |
dc_consent | Remembers your cookie choice (essential) | 180 days |
dcv | Analytics browser identifier (full analytics only) | 400 days |
dcfp (local storage) | Caches the device fingerprint so it isn’t recalculated on every page (full analytics only) | 24 hours |
dcreg (local storage) | Remembers whether to show you the consent choice | 24 hours |
The app also keeps your preferences and unsaved drafts in your browser’s local storage, and while you’re signed in a copy of your notes, meetings and the app’s own files, so it opens quickly and works offline. Signing out deletes the copy. We don’t use third-party advertising or tracking cookies.
5. Who we share it with
We share personal data only with service providers that process it for us under contract, and only as needed to run the Service:
- DigitalOcean (United States): hosting, databases and file storage.
- Stripe: payments and subscriptions.
- Apple, Google and Microsoft: only if you choose to sign in with one of them; they confirm who you are (see “Signing in with Apple, Google or Microsoft” above).
- Amazon Web Services (United States): sends account emails (sign-up codes, password resets, account notices) through Amazon SES.
- AI providers (such as OpenAI and Anthropic): only when you use DayCarp AI, and only what that request needs (the text you ask about). Meeting audio is transcribed on your device and never sent to anyone. If you connect your own provider or key, that provider’s own terms apply.
- Integrations you connect (such as Attio): only what you choose to send.
We may also disclose data if the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.
6. Where your information is processed
We’re based in Canada, and the Service is hosted in the United States (DigitalOcean, New York). Some of our service providers may process information in other countries. When your information is stored or processed outside your province or country, it is subject to the laws of that place, and may be accessible to its courts, law enforcement and national security authorities. We use contracts with our providers to protect it. For users in the EU/EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK addendum) where the law requires them.
7. How long we keep it
- Account and content: for as long as you have an account. You can delete your account at any time in the app (Settings → Account → Delete account). That immediately deletes your account, your content and your analytics records from our live systems (and from backups as they expire), removes your images from storage, and cancels any subscription.
- Analytics: page views, events and browser records are deleted after one year (a browser record, one year after it was last seen).
- Security logs: sign-in attempts and sessions are removed on a rolling basis once they’re no longer needed for security.
- Billing records: as long as tax and accounting laws require.
8. Your choices and rights
- Cookie choice: change it at any time with Cookie settings. Choosing “Essential only” also removes the analytics identifier from your browser.
- Export: you can export your notes to PDF or Markdown in the app whenever you like.
- Delete your account: in the app, under Settings → Account → Delete account. You’ll be asked to confirm twice, the second time with your email address and password.
- Access and correction: you can ask to see the personal information we hold about you and to have it corrected. Depending on where you live, you may also have rights to deletion, restriction, objection and portability.
- Withdrawing consent: you can withdraw consent at any time, subject to legal or contractual limits; we’ll tell you what that means for the Service (for example, we can’t keep an account without the information needed to run it).
- California and other US states: you can ask what we collect, ask us to delete or correct it, and you won’t be treated differently for doing so. We don’t sell or share personal information as those laws define it.
- Browser signals: we record Global Privacy Control and Do Not Track signals, and honor “Essential only” wherever you choose it.
To use any of these rights, email alex@daycarp.com. We’ll answer within 30 days and may need to confirm it’s you. If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, if you live elsewhere, to your local privacy or data protection authority.
9. Security
Everything travels over HTTPS. Your notes, meetings, images and API keys are encrypted at rest, passwords are hashed with a modern algorithm, and access to production systems is limited. No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach affects you.
10. Children
DayCarp isn’t directed to children. You must be at least 16 to use it (or the age of digital consent where you live, if higher). If you believe a child has given us personal data, contact us and we’ll delete it.
11. Changes to this policy
We may update this policy as DayCarp changes. We’ll change the “Last updated” date, and for significant changes we’ll tell you in the app or by email before they take effect.
12. Contact
Questions about privacy or this policy, or to reach our Privacy Officer: 2599577 Ontario Corporation (DayCarp), alex@daycarp.com.
IP geolocation by DB-IP.