Privacy policy

1. Who is responsible

This policy covers the DaysRemain website and its installed web app. The operator below is responsible for personal information processed through this service. The Android and iOS apps have a separate mobile privacy policy covering their synced private library, local photo cards, widgets, and device permissions.

2. Information you provide

• Optional accounts: email address, display name, authentication credentials, session information, and authentication security logs are processed through Supabase. Passwords are handled by Supabase Auth; they are not stored in your dashboard or shared countdowns. You can use countdown features without creating an account.
• Shared countdowns: the title, event date and time, timezone, theme, repeat and elapsed-time settings, preset greeting, random link identifier, and creation time are stored on our backend. These guest records are independent of your optional account. Anyone with the complete link can read them, including through embeds. Links are unlisted, not password protected. Avoid sensitive personal information or information about others without permission.
• On your device: saved events, dashboard shortcuts, display preferences, selected country, card drafts and photos, diary entries, reminder settings, and local interactions are stored in browser storage. The current dashboard does not synchronize this information to an account.
• Support and reports: messages you send to support may include your contact details and the information you choose to provide. In-app countdown reports contain a countdown identifier, a fixed report reason, time, and a pseudonymous reporter identifier.

3. Technical information and service providers

Hosting and network providers process your IP address, requested URLs, browser and device information, timestamps, and operational logs to deliver and protect the service. Supabase provides authentication and countdown storage. Cloudflare Turnstile processes verification and device signals when a protected form is loaded or used; our server sends your IP address to Turnstile to verify creation and reporting requests. Abuse counters and reports use an HMAC-derived IP identifier rather than storing the raw address in those tables. These identifiers remain pseudonymous personal data.

Google Fonts receives network information when font styles and files load. External event images, when present, are requested from their image host. Following an external link, exporting to a calendar, or sharing a file is subject to the destination service’s own policy. Optional AI facts send only an approved public event name and the number of days remaining to the configured AI provider from our server; personal countdowns, account details, photos, and diary text are not sent in that prompt.

Provider information: Supabase privacy, Cloudflare privacy, and Google privacy. The operator must confirm the actual hosting, AI provider, processing locations, log retention, and transfer safeguards for the released service.

4. Camera, microphone, photos, notifications, and location

Camera access starts only when you choose to enable it in the recording studio and approve the browser prompt. Microphone access is optional and separately controlled. Footage is processed in your browser and is not uploaded by DaysRemain. Photos you select for cards or local drafts also stay on your device. Downloading or sharing a file sends it only to the destination you choose. Downloads and copies made by recipients are outside our control.

Reminders require notification permission and currently work while the app is open. Permission can be revoked in browser or device settings. Country suggestions use your browser language and timezone locally, with a manual override. The app does not request GPS or precise device location.

5. Why information is used

Where GDPR or UK GDPR applies, processing necessary to provide the service you request, such as signing in or saving a shared countdown, relies on performance of a contract. Fraud prevention, service security, moderation, and responding to ordinary support requests rely on legitimate interests in operating a safe service, balanced against your rights. Processing required by law relies on a legal obligation. Optional device permissions and any processing requiring consent rely on your choice; withdrawal does not affect earlier lawful processing. Device permission alone does not authorize unrelated uses.

We do not use the current application for behavioral advertising, cross-app tracking, selling personal information, or sharing it for targeted advertising. The app does not include an advertising or analytics SDK. Service providers still process the technical information described above. We do not make automated decisions with legal or similarly significant effects about you.

6. Retention and deletion

• Browser data stays until you remove it, clear site data, or the browser evicts it. Data controls can clear this app’s local data. This does not erase downloads, other devices, accounts, or shared links.
• Account records remain while your account exists. The account deletion control permanently deletes the active Supabase Auth account, including its email and account profile, and its associated native-app cloud countdown library through the account-deletion cascade. If you use the same account in the mobile app, that sign-in access also ends. Device-local copies are separate. Authentication backups and logs follow provider retention and any applicable legal requirements.
• Shared countdowns have no automatic expiration and remain until an administrator deletes them or disables access. Account deletion does not remove these separate guest records. Contact the operator with the links for a removal request; possession of a link alone does not prove ownership.
• Abuse quota rows older than two days are removed on subsequent quota requests. Reports and moderation records currently remain until an administrator removes them. Security, legal, and backup retention must be confirmed by the operator; no immediate deletion from every backup is promised.

7. Your rights and choices

Depending on your location, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests, and withdraw consent. California residents may have rights to know, correct, delete, and opt out of sale or sharing where the CCPA applies; we do not sell or share personal information for cross-context behavioral advertising. You may use an authorized agent where permitted and exercise rights without unlawful discrimination.

Use account and data controls or contact the operator above. Include the email used for your account and relevant countdown links, but never your password, authentication token, or private diary. We may need proportionate verification and may retain information when the law requires it. Applicable response deadlines and exceptions depend on your jurisdiction. You can complain to your local data protection authority, including in the EEA or UK.

India privacy questions and grievances

Velnova Software Solutions is based in India. Send privacy questions, withdrawal requests, correction or erasure requests, and grievances to info@velnovaapp.com. We will handle them under laws applicable to the service and in force at the time of your request. India’s Digital Personal Data Protection framework has a phased commencement. Where applicable, you may seek information about processing, correction and erasure, grievance redressal, and nomination under that framework. We may need reasonable verification before acting.

The current service does not provide a verified parental-consent workflow. Children’s data, including the requirements applying to under-18s in India where in force, needs special protection. Do not submit a child’s personal information through shared countdowns. Contact us if it has been submitted improperly.

8. International processing and security

Providers may process information outside your country. Where required, the operator must arrange appropriate transfer safeguards, such as applicable standard contractual clauses, and provide details on request. Access controls, server-side verification, and restricted database permissions help protect information, but no system can guarantee absolute security. Share links carefully and protect devices and downloaded backups.

9. Children and changes

DaysRemain is a general audience service and is not directed to children under 13. Users below the age at which they can enter these terms or consent to applicable processing must involve a parent or guardian as required by local law. Do not provide a child’s personal information in shared titles. Contact the operator if a child’s data was provided improperly.

Changes will be reflected in the date above. Material changes requiring notice or consent will be communicated before the new processing begins. See also our cookies and storage policy and terms and conditions.