Privacy Policy

1. Who this applies to

DailyWit is for users 18 and older, and we ask for date of birth at signup to enforce that. We do not knowingly collect personal data from anyone under 18.

If we learn that an account belongs to someone under 18 — including where the date of birth was misstated — we close the account and delete its personal data. The only things we may keep are the limited records we are legally required to hold, and the minimum needed to stop the same account simply being created again. If you believe someone under 18 has an account, tell us at [email protected] and we will act on it.

2. What we collect

Account information you provide: email address, date of birth (to confirm age), and a username.

Usage information created as you learn: cards seen, quiz answers, days learned, saved/reviewed cards, threads and deep-dives opened, skills you mark learned in the Handbook, and similar in-app activity.

Technical information: basic device and log data needed to run the app and keep it secure.

Diagnostics: if the app crashes or errors, we may collect crash and error reports to find and fix the problem. These are configured to exclude your name, email, and date of birth.

Notifications: if you turn on reminders, we store a device push token so we can deliver the notifications you enable (such as your daily Wit or a weekly skill reminder). You can turn these off at any time in the app or in your device settings.

Payment information: we do NOT collect or store your card details. Purchases are processed by Apple, Google, or our payment processor, who handle that information under their own policies.

Where this data comes from: you give us some of it directly (your email, date of birth, and username), and the rest is created automatically as you use the app. We do not buy personal data about you from data brokers, and we do not build profiles of you from outside sources.

3. How we use it

To provide and personalize the app (your feed, days learned, progress, and reinforcement), to operate subscriptions, to keep the service secure, to improve our content and product, to send the reminders you turn on by push notification (such as your daily Wit — you control these in settings), and to communicate with you about the service (for example, account, security, and subscription emails).

When you contact support, we may use an AI assistant to help draft a reply. A person reviews and sends every response, we share only what is needed to answer you, and no automated decision is made about you or your account.

If we introduce optional product-update or marketing emails in the future, we will send them only to people who opt in, and every such email will include an unsubscribe link.

4. Legal bases (where applicable, e.g., GDPR)

We process data to perform our contract with you (providing the app), for our legitimate interests (improving and securing the service), to meet legal obligations, and on the basis of your consent for optional marketing.

5. Who we share it with

Service providers that run the app on our behalf: our database/auth and hosting provider (Supabase), our subscription manager (RevenueCat), our app platform (Expo, which also delivers push notifications), our crash- and error-diagnostics provider (Sentry), our email-delivery provider (Resend), the provider of the AI assistant we use to help draft support replies (Anthropic), and the app stores and payment processors (Apple, Google).

These providers may process your data outside the country you live in, and act on our instructions under contracts that limit what they may do with it. We do not authorise them to use your data for their own purposes.

We keep this list current. If we add a provider that handles your personal data, we will update this page, and where the change is significant we will tell you in the app or by email.

If DailyWit changes hands: if we are involved in a merger, acquisition, financing, or sale of all or part of our business, your data may transfer to the buyer as part of it. Any buyer would be bound by this policy for data collected under it, or would have to give you notice and a choice before handling your data any differently. This is not a sale of your personal data for advertising or any other commercial purpose, and it does not change our commitment not to sell it.

We may disclose data if required by law. We do NOT sell your personal data, and we do not share it for third-party advertising.

6. Retention, deactivation & deletion

Active accounts: we keep your data while your account is active.

Deactivate: your data is retained so you can return; reactivation happens when you sign back in.

Delete: we permanently erase your personal and activity data. We may retain limited financial records where law requires (with the person-link removed) and a minimal suppression record to honor your choices and prevent re-contact. Anonymous, non-identifying aggregates may be retained.

How long: while your account is active we keep your data so the app works. When you delete your account we remove your personal data from our live systems promptly — generally within 30 days — and routine encrypted backups age out on their normal schedule after that. Diagnostic and error logs are short-lived and expire on their own.

Legal exception: we may also retain the minimum information necessary to comply with our legal obligations, resolve disputes, prevent fraud or abuse, and establish, exercise, or defend legal claims — and only for as long as needed for that purpose. We do not keep your data simply in case of a hypothetical future dispute; deletion is honored except where one of these specific bases applies.

7. Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent.

US state residents (for example under the California CPRA and similar laws): we do not sell or share your personal data as those laws define it. Because we do not sell or share, opt-out preference signals such as Global Privacy Control do not change how we handle your data. Section 10 sets out the California-specific detail.

EU/UK residents: you also have the right to lodge a complaint with your local data protection authority. You can also contact us directly using the details in Section 11.

In the app you can update your profile and deactivate or delete your account. To exercise any other right, contact us at [email protected].

How we verify a request: to keep your data safe from someone impersonating you, we will ask you to send the request from the email address on your account, or otherwise confirm you control it, before we act. We do not ask for more personal information than we need to check who you are.

How quickly: we respond within the time your law allows — for example about 45 days under California law, or one month under UK/EU rules — and if we need longer we will tell you why before that deadline. Exercising these rights is free, and we will never treat you differently for using them.

You may also authorise someone to make a request for you; we will still need to verify both of you. If we cannot fulfil a request, we will explain why, and you can appeal by replying to us.

8. Marketing communications

We do not currently send marketing emails; the emails we send are service-related (for example account, security, and subscription messages). If we introduce optional marketing or product-update emails, we will send them only to people who opt in, every such email will include an unsubscribe link, we will honor opt-outs promptly, and we will not market to people who have deleted their account.

9. Security & international transfers

We use reasonable technical and organizational measures to protect your data, including row-level access controls and secure storage of authentication tokens. No system is perfectly secure.

Your data may be processed in countries other than where you live (our providers are primarily US-based); where required, we use appropriate safeguards for those transfers, such as the EU Standard Contractual Clauses or an adequacy decision.

10. California privacy disclosures

This section describes our practices using the categories that California law uses. It covers the last 12 months and applies to everyone, not only Californians.

Identifiers — your email address, username, account ID, and device push token. You give us the email and username; the rest is created by your device. We use them to run your account, sign you in, and send the reminders you turn on. They are handled by Supabase, Expo, and Resend on our behalf. We keep them while your account is active and delete them within 30 days of account deletion.

Personal information under Cal. Civ. Code §1798.80 — your date of birth. You give it to us at signup, and we use it only to confirm you are 18 or older. It is stored by Supabase. We keep it while your account is active.

Commercial information — your subscription status and purchase history. This comes from Apple, Google, and RevenueCat, and we use it to operate your subscription. It is handled by RevenueCat, Apple, and Google. Financial records are retained where the law requires, with the link to you removed.

Internet or network activity — cards seen, quiz answers, saved cards, threads opened, skills marked learned, and app and error logs. This is created automatically as you use the app, and we use it to personalize your feed, track your progress, keep the service secure, and fix bugs. It is handled by Supabase and Sentry. Activity data is kept while your account is active; diagnostic logs are short-lived and expire on their own.

We do not collect sensitive personal information as California law defines it, we do not sell or share personal information, we do not use it for cross-context behavioral advertising, and we do not use or disclose it for any purpose other than those described above.

11. Who we are & how to reach us

Who we are: DailyWit is operated by Semper Labs LLC, a limited liability company formed in New Jersey, USA. Semper Labs LLC is the controller of the personal data described in this policy.

How to reach us: for privacy questions or to exercise your rights, email [email protected]. For anything else, email [email protected]. You can also write to us at Semper Labs LLC, 971 US Highway 202N, Ste N, Branchburg, NJ 08876, USA.

12. Changes to this policy

We may update this policy. When we do, we will post the new version with a new date and version number at the top and, where the change is significant or the law requires it, tell you in the app or by email. We keep dated copies of previous versions — email [email protected] if you would like to see the one that applied when you signed up.