The short version
- Your family’s journal is yours. We do not sell it, rent it, or use it to train anybody’s AI models.
- Your data is stored in the United Kingdom or the European Union.
- Your child’s photographs are never sent to an image-generation service.
- The only content that leaves our systems is voice recordings, sent to be turned into text, and only when you record one.
- You can delete everything from inside the app, and it is actually deleted.
The rest of this page is the detail behind those five lines.
Who is responsible for your data
Days and Tales is run by Daniel Pilling, a sole trader based in the United Kingdom, trading as Days and Tales. Under the UK GDPR that makes me the data controller — the person legally responsible for the information described on this page.
You can reach me about anything on this page at hello@daysandtales.com. I read every message myself.
Who this app is for
Days and Tales is for parents, guardians and the family members they invite. It is not designed for, or directed at, children, and a child should not create or hold an account.
The app records information about children, which you provide as their parent or guardian. By adding a child you confirm that you have the authority to share that information, and that anyone else you invite into your family space has your permission to see it.
What is collected, and why
| What | Why it exists | Legal basis |
|---|---|---|
| Your email address and password | To create your account, sign you in, and let you recover access. Passwords are stored as one-way hashes — nobody, including me, can read them. | Contract |
| Your child’s first name and date of birth | To label their journal and work out their age when a memory is saved, which is what lets the app organise a week into a story. | Contract |
| Journal entries, photographs and voice notes | This is the product. You write or record a moment; the app keeps it and builds the weekly book from it. | Contract |
| Height, weight and milestones | To draw the growth chart and mark first steps, first words and so on. Recording these is entirely optional. | Explicit consent |
| Your family members and their roles | So that a grandparent can be given view-only access while a second parent can write, and so nobody sees a family they were not invited to. | Contract |
| Your subscription status | To unlock paid features. Apple handles the payment; we receive whether a subscription is active, never your card details. | Contract |
| Anonymous usage events | To see which parts of the app get used and where people get stuck. These are a fixed list of event names — “journal entry created”, “paywall viewed”. They never carry a child’s name, date of birth, journal text, transcript, photograph or health information. | Legitimate interests |
| Technical and security logs | Error reports and sign-in records, kept so that failures can be diagnosed and accounts protected against misuse. | Legitimate interests |
A note on the health-adjacent bits
Height, weight and developmental milestones can count as health data under the UK GDPR, which gets stronger protection than ordinary information. They are only ever recorded because you chose to record them, and that choice is the explicit consent the law asks for. You can withdraw it at any time by deleting the entries, and nothing else in the app stops working if you do.
Days and Tales is not a medical device and does not offer medical advice. Growth charts show what you entered, plotted over time. They do not compare your child to a percentile, assess development, or tell you whether anything is normal — deliberately, because that is a job for your health visitor or GP.
What is not collected
- No card or bank details. Apple takes the payment. We never see the numbers.
- No location. If you attach a place to a memory, the identifier for that place stays on your phone and is never sent to our systems.
- No contacts, no address book, no advertising identifiers.
- No tracking across other apps or websites. There is no advertising network in this app, and nothing here is used to profile you.
Voice notes and transcription
If you record a voice memory, the audio is sent to OpenAI to be turned into text, and the text comes back into your journal where you can edit it. That is the only time your content leaves our own systems.
OpenAI processes it on our instructions as a data processor, under terms that do not permit it to be used to train their models. The recording is sent for transcription and is not retained by them for any other purpose. If you would rather nothing was sent, type the memory instead of recording it — the app works exactly the same way.
What the app does not send anywhere
Your child’s photographs stay in our storage and are never sent to an image-generation service, an AI art tool, or any third party for processing. The illustrated characters in the app are built from choices you make on a menu — hair, eyes, glasses — not from a photograph.
The weekly story is composed on your own device from the words you wrote. No text-generation service writes it, and the app is built so that a story page cannot contain a fact you did not record.
Who else is involved
Running an app means using other companies for the parts that would be reckless to build myself. Each is a processor acting on documented instructions, not a partner we share data with for their own purposes.
| Who | What they do | Where |
|---|---|---|
| Supabase | Hosts the database, the account system and the file storage — your journal, photographs and audio live here. | European Union |
| OpenAI | Turns a voice note into text, when you record one. | United States |
| RevenueCat | Keeps track of whether a subscription is active. Receives an anonymous account identifier, never your email or your content. | United States |
| Apple | Distributes the app and takes subscription payments. Apple’s own privacy policy covers what they do with that. | Global |
Data leaving the UK
Two of those companies are in the United States. Where information goes there, it is covered by the UK’s approved safeguards for international transfers — the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — which contractually hold them to UK standards. Your journal itself, including every photograph, stays in the EU.
How long things are kept
- Your journal — for as long as your account exists. It is a keepsake; deleting it after a period of quiet would be the opposite of the point.
- After you delete your account — removed from the live systems straight away. Copies survive briefly in encrypted backups until those are overwritten in the normal cycle, within 30 days.
- Usage events and technical logs — up to 24 months, then deleted.
- Billing records — kept as long as tax law requires, which in the UK is six years. These are records of a transaction, not of your family’s content.
Keeping it safe
- Everything is encrypted in transit, and at rest on the servers.
- Photographs and audio sit in private storage. They are reachable only through short-lived links issued to you, and cannot be opened by guessing an address.
- The database enforces family boundaries at the row level, so one family’s records cannot be read by another family even if the app itself were compromised.
- Your sign-in session is held in your phone’s secure keychain, not in ordinary app storage.
- No promise here is absolute. No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach ever affects your rights, you will be told, and so will the ICO, within the time the law allows.
Your rights
Under the UK GDPR you can ask to:
- See what is held about you, and get a copy.
- Correct anything that is wrong.
- Delete your account and its contents — see Delete your account, which you can do yourself without asking anybody.
- Take your data elsewhere in a portable format.
- Object to, or ask me to restrict, processing based on legitimate interests.
- Withdraw consent for anything you consented to, without affecting what happened before.
Email hello@daysandtales.com and I will respond within one month, which is the limit the law sets. There is no charge.
If you are unhappy with how I have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. You are welcome to raise it with me first, but you do not have to.
Cookies and this website
These pages set no cookies, run no JavaScript and contain no analytics or advertising trackers. The only external request a page makes is for the two typefaces, which are loaded from Google Fonts; Google receives the request in the ordinary course of serving a file. Nothing here identifies you.
Changes to this policy
If this policy changes in a way that materially affects you, you will be told in the app before the change takes effect — not quietly, and not by an updated date at the top of a page nobody revisits. The version number and date above always show what is currently in force.
Contact
hello@daysandtales.com
Daniel Pilling, trading as Days and Tales, United Kingdom.