Mobile app privacy policy

Who is responsible

Velnova Software Solutions, India, operates DaysRemain and is responsible for the personal information described here. Contact info@velnovaapp.com for privacy, support, deletion, and grievances. Registered address: 6-84, Vidyanagar, Vepagunta, Visakhapatnam - 530047, India.

This policy covers the native Android and iOS apps. The website has a separate privacy policy because its browser dashboard, guest sharing, photo, and video tools work differently.

Your account and private library

You can explore public events and preview designs without signing in. Saving a private library requires an account. Supabase Auth processes your email, display name, password authentication, session information, and authentication security records. Authentication tokens are kept in the device’s secure storage on Android and iOS; passwords are not saved in the countdown library.

Your personal countdown titles, dates, timezones, themes, recurrence and elapsed-time settings, greetings, saved public events, record identifiers, revisions, timestamps, and deletion markers are stored in your account library in Supabase and cached on your device for offline use. Pending changes are queued locally and sent when connectivity returns. The library is restricted to your authenticated account; it is not a public profile or public posting feed.

The website’s browser-local dashboard is separate. Signing in with the same email does not automatically import browser-local countdown shortcuts into this app.

Optional social sign-in and member sharing

If you choose Google sign-in, Google authenticates your account and Supabase receives the identity, verified email, and profile information allowed by that provider. The iOS app also offers Apple sign-in when configured. Provider account and privacy settings apply. DaysRemain does not receive your Google or Apple password.

When you choose to share a card or countdown with another member, a shared edition of its title, date, timezone, countdown mode, and selected card design and captions is stored in Supabase. Photos are excluded. We also store the owner account, publication revision and time, invited email addresses, expiry times, hashed invitation secrets, accepted memberships, and rejection decisions and times. Verified invited accounts can preview the shared edition before choosing accept or reject. The owner and accepted accounts can continue reading it. Owners can publish updates, revoke an invitation or member, or stop sharing. Recipients can leave. The owner sees invitation email addresses and acceptance or rejection status; recipients see the owner’s display name.

Invitation links expire after seven days unless already accepted. Acceptance requires sign-in with the invited, confirmed email. The pending invitation is stored on the device until accepted, rejected, or replaced. Shared editions remain until the owner stops sharing or deletes their account. Account deletion also removes their accepted memberships and related accepted invitations. Revocation ends future server access; screenshots, exports, and previously received copies cannot be recalled.

Event planning, calendar imports, memories, and future messages

Personal preparation checklists, collections, archive status, important-person names and optional starting years, memory notes, and selected memory photos are stored per account on this device. They do not sync with your private countdown library or become part of a shared edition. Earlier on-device future letters remain in Android or iOS protected storage and use the device clock to reveal. Account deletion attempts to remove these local plans and letters; device backups and exported copies are separate.

When you seal a new future message, Supabase stores the letter text, sender account, recipient email and account when known, countdown title and reference, fixed reveal time, envelope style, acceptance or decline decision, and first-open time. Only the recipient's verified account can accept and open the letter. The server checks the reveal time before returning its text; lists contain only envelope details. This is account access control, not end-to-end encryption. Letter text is not saved in a persistent offline cache. The sender sees the recipient address, acceptance status, and whether the letter was opened, and can delete the letter. Recipients can decline or remove it from their collection, ending access and future alerts. The record remains for the sender until they remove it or an associated sender or bound recipient account is deleted. Removing the original countdown does not remove its separate letter. Screenshots or copies already made cannot be recalled.

Calendar access is requested only when you choose calendar import. You select which upcoming events to copy. Only the selected titles, dates, and time zones are saved in your synced account countdown library. Calendar notes, locations, and attendees are excluded. Import is a one-time copy and does not modify or continuously monitor your phone calendar.

When a shared-edition owner explicitly enables shared planning, accepted members can read its participant display names, preparation tasks and assignments, RSVP responses, and recent update history. These planning records are stored in Supabase. Members can add tasks, update their RSVP, and complete unassigned tasks or their own assignments; owners control assignments and removal. Pausing planning hides the plan from members; revoking access ends future server access. Deleting a shared edition removes its planning records.

Animated stories are rendered on the device as silent MP4 videos using selected text and an optional photo. Files are shared only to the destination you choose. PNG and MP4 exports remain temporarily in the app cache so the receiving app can read them, and exports older than a day are cleaned during a later export of the same type. Final-hours mode displays the selected countdown title and a live timer on an iOS Live Activity or Android notification; it can be visible on the lock screen.

Device information, reminders, and permissions

Appearance, country preference, notification choices, cached catalogue data, account caches, pending changes, card designs and selected photos, and widget selections are stored on the device. Country suggestions use device language/locale and timezone locally; no GPS or precise-location permission is requested.

Reminders are optional local notifications scheduled with your device's operating system. With notification permission, sharing alerts use an Expo push token associated with your account, device platform, and registration time in Supabase. Expo Push Service and Apple or Google notification services process the token, sender display name, whether a card or moment is shared, and an invitation identifier to deliver the sharing alert. Future-letter reveal alerts use the same registered device and delivery services, carrying only generic surprise text and a message identifier; they exclude letter content, sender, recipient email, and countdown title. Letter alerts are queued after acceptance and the server reveal time, and delivery depends on the scheduled worker, device permission, and notification services. Sharing invitations can show the sender name on the lock screen according to device settings. You can revoke notification permission in system settings; invitations and letters remain available inside the app. Signing out removes the registered device from your account. Account deletion removes its registrations and related queued alerts. Registrations inactive for 60 days are not used for delivery. Delivery records remain until the invitation, shared edition, future letter, or associated account is removed.

Photos use the system image picker only when you choose an image. Selected images are resized on the device and can be saved in local card drafts or memories; photos are not uploaded to the private countdown library or member editions. Exported PNGs and rendered MP4 stories are sent only to the destination you choose through the device share sheet. Cached exports may remain until a later cleanup; saved recipient copies remain outside our control. The native app does not request camera, microphone, contacts, or precise-location access and does not record camera video or upload private diary notes.

Home-screen widgets store a local countdown snapshot and share it with the app’s widget extension. The title and date may be visible to anyone who can see your home screen. Widget data is not uploaded by the widget feature. You can clear widget content in Creations or remove the widget using your device. Do not select sensitive information for a visible widget.

Network requests and service providers

Supabase provides authentication and private countdown storage. The DaysRemain website provides the public event catalogue and authenticated account-deletion endpoint. Hosting and network services process IP addresses, requested URLs, timestamps, and technical request information to deliver and secure these services. Catalogue search text is sent to the website to find matching events. Fonts and included artwork are bundled in the app; opening an external website is governed by that website’s policies.

The app does not contain an advertising or analytics SDK, sell personal information, share it for targeted advertising, perform cross-app behavioral tracking, or send your private library to an AI provider. Supabase and hosting providers still process information to operate the service. Support messages contain the information you choose to send. Providers may process data outside your country; the operator must confirm actual regions, retention periods, and appropriate transfer safeguards before release.

Purposes and lawful processing

We use account and library information to authenticate you, save and synchronize your requested countdowns, manage deletion, and provide support and security. Where GDPR or UK GDPR applies, necessary service processing relies on performance of a contract; fraud prevention and ordinary support rely on legitimate interests balanced against your rights; legal compliance relies on legal obligations. Optional permissions and any processing requiring consent rely on the applicable permission or consent. Withdrawal does not affect earlier lawful processing.

We do not make automated decisions with legal or similarly significant effects about you. Accepting the terms does not authorize unrelated marketing or optional tracking.

Retention and deleting your information

Account records and private cloud library records are retained while your account exists. Library deletions use tombstones to prevent stale offline changes from recreating deleted records. Tombstones remain associated with the account until account deletion or an approved retention process removes them.

You → Delete account & data permanently deletes the authenticated account and its associated cloud library through the library’s account-deletion cascade. It also attempts to cancel this device’s DaysRemain reminders, clear the current account’s local card drafts and photos, clear widget content, and remove this account’s cache, pending changes, reminder preferences, and sign-in credentials. Deletion needs an internet connection. Unsynced changes are discarded when you explicitly confirm deletion; you do not have to sync them first. Guest creations and exported files remain separate.

Deleting an account affects the same Supabase account used for website sign-in, if you use one there. Separately created guest website countdown links, browser-local data, files you exported, messages you shared, and copies on other devices are separate. Contact support with guest links for a verified removal request. Other devices may retain cached copies until their local data is cleared. Provider security logs, backups, and records required by law may remain under their retention rules; immediate erasure from every backup is not promised.

Signing out is different from deleting an account: it ends a session but may leave an isolated device cache for offline restoration. Remove app data using device settings when disposing of a device. Uninstalling does not delete your cloud account, and on iOS some keychain information may survive uninstall. Use account deletion first if you want the cloud account removed.

Your privacy rights and grievances

Depending on applicable law, you may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, or withdraw consent. Contact info@velnovaapp.com with your account email and request, without sending passwords, session tokens, or unnecessary identity documents. We may need proportionate verification. Applicable response deadlines, exceptions, authorized-agent rights, and complaint rights apply without unlawful discrimination.

For India, privacy questions and grievances go to the same contact. The Digital Personal Data Protection framework has a phased commencement: rights and duties apply as the relevant provisions enter force. Where applicable, rights include information about processing, correction and erasure, grievance redressal, and nomination. EEA and UK users may complain to their data protection authority. Where California privacy law applies, relevant know, correct, delete, and opt-out rights apply; we do not sell or share information for cross-context behavioral advertising.

Children, security, and policy changes

DaysRemain is a general-audience service, not directed to children under 13. Users must have legal capacity to accept the terms, or involve a parent or guardian where legally permitted. The app does not provide verified parental consent. Requirements for children, including under-18s in India where applicable and in force, must be addressed before offering accounts to those users. Avoid putting sensitive or children’s personal information in countdowns or shared text.

Secure token storage and access restrictions reduce risk but do not guarantee absolute security. Protect your device and account. We will update the policy date when practices change and provide notice or obtain consent where required before materially new processing.

Contact and data controls

Delete your account and associated app library. Separately shared guest website countdown links require a verified removal request.