Privacy, at this stage.

The current preview

The local development application stores the email provided at signup, a password hash, account and session records, optional profile names, workspace and brand details, and draft titles and captions in a local PostgreSQL database. Passwords are hashed by Better Auth. Session cookies keep you logged in; the authentication service also stores session technical data and rate limits. Drafts are associated with the signed-in owner’s workspace.

Social connection setup is disabled until developer apps are configured. When enabled, it stores provider identifiers, granted permissions, account names, expiry times, optional brand assignments and encrypted authorization tokens on the server. There are no media upload submissions, payments, competitor imports or installed analytics trackers. Fonts and icons are served with the application. Normal browser/server requests still occur. Public hosting serves information pages only; account and social access remain disabled there. Development account access is restricted to the configured loopback origin.

Who is responsible

The intended operator is Clubi Life LTD, with postal contact at Thessalinikis 13, Limassol, Cyprus. The owner supplied these details; company jurisdiction and registered-office status have not been verified. A monitored privacy contact is available at hey@dayfizz.net. See contact information.

Email contact

Support and privacy messages sent to hey@dayfizz.net are forwarded through Cloudflare to owner-managed Gmail inboxes so we can respond. Messages include the sender address and any information you choose to provide. Email retention, backup handling and applicable transfer arrangements still require confirmation. Do not send passwords, access tokens or private media.

Removing social access

Accounts in the workspace provides a disconnect action for each provider authorization. Confirmed revocation deletes its local tokens and discovered accounts. If the provider cannot confirm revocation, local use is disabled and encrypted credentials remain for a retry; access can also be removed in the provider’s settings. A signed Meta data-deletion request removes Meta authorization data from the application database. It does not delete your login, brands or authored drafts. Deletion receipts last 30 days; a hashed Meta identifier protects against an in-flight authorization restoring removed data for 24 hours. Cleanup occurs on later callback activity, so expired records may remain until that activity. Backup/log retention and whole-account deletion remain unresolved.

Intended future processing

If the service launches, it is expected to handle business profile information, connected-account identifiers and authorization tokens, uploaded media, draft captions, approval records, publishing schedules and statuses, and supported performance metrics obtained with the relevant permissions. Optional generation would also process the brief and source materials you deliberately provide.

The intended purposes are delivering authorized publishing, account management, performance reporting and evidence-linked advice. The exact permission scopes, legal bases, recipients, subprocessors, transfer arrangements and any separate consent choices must be confirmed and disclosed before this processing starts.

Retention, security and deletion

Retention periods, deletion workflows, backup handling and technical safeguards are not finalized. A future policy must state how long each data category is kept, how tokens are protected, what happens after disconnection or account deletion, and how people can exercise applicable access, correction, portability, objection and deletion rights. No completion times or finalized security assurances are claimed by this draft.

Platform controls

Connected platforms will retain their own account settings and privacy rules. Future DayFizz connections will need to explain what access is requested, how to revoke it and how reconnection works. No platform authorization occurs in this preview.

Before launch

Replace this draft with an accurate, reviewed policy covering the actual operator, data flows, hosting and logs, rights contact, retention and applicable complaint channels before public registration or submitting the product for platform approval.