Draft. This text has not yet been reviewed by a lawyer and only applies from the closed beta. Placeholders are in square brackets.
This English version is a translation for your information. Only the German version is legally binding.
Privacy policy
Last updated: 20 October 2026 (draft 2)
In short
- Your entries, notes, your journal and your settings are encrypted in your browser before they reach my server. I cannot read them.
- In plain text I only know what your account needs: your email address, your subscription, your consents and technical data such as sign-in times.
- No advertising, no tracking cookies, no scripts or fonts from third parties.
- You can export all your data at any time and delete your account immediately.
1. Controller
René Huske
c/o Impressumservice Dein-Impressum
Stettiner Straße 41
35410 Hungen
Germany
Email: datenschutz@dayblock.de
No data protection officer has been appointed, because the legal requirements for this are not met.
2. What I process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Account, sign-in, important messages (e.g. confirmation, forgotten password) | Contract, Art. 6(1)(b) GDPR | until the account is deleted |
| Sign-in data (OPAQUE record, no password) | secure sign-in without me ever learning your password | Art. 6(1)(b) | until the account is deleted |
| Encrypted content (entries, notes, journal, settings) | storing and syncing between your devices | Art. 6(1)(b); for possible health information your explicit consent, Art. 9(2)(a) | until you delete it or until the account is deleted; deletion markers 90 days |
| Consents (type, version, time) | proof | Art. 6(1)(c) in conjunction with Art. 7(1) | until the account is deleted |
| Sessions (times, shortened browser identifier) | sign-in, overview of your devices, security | Art. 6(1)(b) and (f) | 12 hours or 30 days (“stay signed in”) |
| “Focusing right now” (only the fact, without entry, title or duration) | “Focus together” feature: showing how many others are focusing right now; can be switched off in the settings | Art. 6(1)(b) | only in memory, at most 150 seconds |
| Shared numbers: end of the day, return after a break (only the fact, without content or reasons) | Evening sky, welcome back: showing how many are taking part; can be switched off in the settings (“Count me in”) | Art. 6(1)(b) | only totals without any link to your account are stored; the check for duplicate reports stays in memory for at most 9 days |
| Day of last use (date only, no time of day) | seeing how many are active and how long people stay – as totals only (What René sees) | Art. 6(1)(f) | until the account is deleted |
| Anonymous website statistics: source of a visit (e.g. “search engine”), article read with reading time and whether read to the end; optional answer “How did you hear about DayBlock?” | understanding how people find DayBlock and what helps in the magazine – no cookies, nothing stored in the browser, no IP address or identifier; nothing is sent with “Global Privacy Control” or “Do Not Track” | Art. 6(1)(f) | totals per day or week only, not linked to any person or account |
| Server logs (IP address, time, request) | operation, defence against attacks | Art. 6(1)(f) | [7] days |
| Subscription and billing data (from the public launch) | billing via Paddle | Art. 6(1)(b) and (c) | statutory retention periods |
3. End-to-end encryption and its limits
Your content is encrypted with a key that is derived only from your password or your recovery key (24 words). Neither ever leaves your browser. Without the password and without the recovery key, nobody can open your data – not even I, and not even if you ask me to.
An honest note: DayBlock runs as a web app. Your browser loads the program code from my server. In theory, manipulated code could capture data before encryption. I counter this with strict security policies (Content Security Policy, no third-party scripts) and an external security audit before the public launch.
Not encrypted are technical details the server needs for syncing: random IDs, version numbers, times of saving and the approximate size of the data.
4. Health data
DayBlock is made with people with ADHD in mind. Your entries, notes or your journal may therefore contain information about your health. I only process it with your explicit consent (Art. 9(2)(a) GDPR), which you give when signing up. You can withdraw it at any time by deleting your account.
5. Recipients and service providers
- Hosting: Hetzner Online GmbH, Gunzenhausen, servers in Germany, data processing agreement under Art. 28 GDPR.
- Email delivery: Brevo (Sendinblue GmbH), Berlin, data processing agreement under Art. 28 GDPR. Brevo only receives your email address and the content of the respective email.
- Payments (from the public launch): [Paddle.com Market Ltd., London] sells the subscription as merchant of record in its own name and is itself responsible for the payment data. [Transfer to the United Kingdom on the basis of the adequacy decision; possibly USA: to be checked.]
Apart from that, no data is transferred to third countries.
6. Cookies and storage in the browser
I only set one technically necessary cookie for signing in (__Host-dayblock_session). In your browser, DayBlock stores your encrypted data (IndexedDB) so the app also works offline, as well as small settings for this device. No consent is required for this (§ 25(2) TDDDG).
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of your consents (Art. 7(3)). You can do much of this directly in the app:
- Access: Settings › Account › “What the server stores about me”.
- Export: Settings › Your data (JSON, Markdown, CSV).
- Deletion: Settings › Account › “Delete account” – immediately; backups are overwritten within 30 days.
You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work (Art. 77 GDPR).
8. Minimum age
DayBlock is for people aged 16 and over.
9. Changes
If this policy changes significantly, I will let you know in the app.