Fillday Privacy Policy

At a glance

Your calendar, task, journal and mood entries remain in the app's local storage. An account is optional. Account, reward and purchase records are different from the personal entries you write.

1. Scope

This policy applies to the features available in the Fillday version you use. Optional features such as sign-in, rewards, ads, purchases and watch sharing may be unavailable depending on version, region, account eligibility and rollout state, and their related processing starts only when you choose to use them.

2. Accounts and optional online features

Google or Apple sign-in supplies an account identifier, provider type and, when supplied, an email address and name to Supabase Auth. Fillday does not receive your Google or Apple password. Session credentials are used to restore your sign-in and authenticate account requests. Apple authorisation credentials needed to revoke access when you delete your account are held by the account service with restricted access.

The app asks for birth date and country of residence to check account eligibility. These inputs are sent to the account service for the check. The application does not persist those inputs in its account database; it saves the resulting age tier. The tier also restricts adult-only rewards and purchases. Account identity and age information are not supplied by Fillday as ad targeting data.

2.1 Services that process information

2.2 Device calendars

Calendar access is requested when you choose to connect a device calendar in Settings. Declining permission leaves local entry features available. You can change permission in device Settings. Imported events stay in local app storage. When you export an event, the OS calendar editor lets you choose the destination and confirm the save. The selected calendar provider can then sync it according to that provider's settings and policy.

2.3 Attendance and collection

When enabled, account rewards store your account identifier, reward time zone, attendance dates and type, accumulated progress, ticket balance, owned and equipped companions, draw results and transaction times on Supabase. These records provide consistent rewards across account sessions and prevent duplicate grants. They do not include calendar, task, journal or mood content. A device may cache its account's reward state to display it.

2.4 Optional rewarded ads

The app checks adult eligibility and feature availability before starting its rewarded-ad consent flow. It requests non-personalised ads. You can decline the consent message and continue using local recording features; declining does not promise an ad will be available. Where Google requires a privacy-options entry point, the collection screen provides one to revisit your choices.

Google's ads services may process IP address and approximate location inferred from it, app/device identifiers, ad views and interactions, and performance or diagnostic data for ads, measurement and fraud prevention. Removing an advertising identifier or requesting non-personalised ads does not mean no data is processed. On Apple devices, choosing an adult rewarded ad may prompt for tracking permission for ad frequency control and measurement. Declining does not affect local records; if an ad can still be requested, Fillday requests a non-personalised ad without Apple's advertising identifier (IDFA). Fillday does not request GPS location or pass entry content to ad requests. Actual ad partners and purposes must match the consent message shown to you.

For reward verification, Fillday sends a random ad-session identifier to Google. Google's signed completion callback returns that identifier with ad-unit, transaction and completion information to our server. Our server connects the session to your account and grants progress only after verification. The app does not send your email or account identifier as that ad-session value.

2.5 Optional purchases

Adult ticket purchases use the device's store. Fillday passes an app account identifier to the store to bind a purchase to the correct account. Our server receives the product and purchase proof, verifies them with Apple or Google, and stores the account, platform, product, verified transaction reference, ticket grant, time and refund state. Google purchase tokens are processed during verification; the reward database stores a token hash as the transaction reference. Apple transaction references and verification revisions are retained in the reward database. Fillday does not receive payment-card details. Store purchase and refund records are also governed by the store's policy.

3. Your entries and device surfaces

Calendar, task, journal and mood entries are stored in a SQLite data file in the app's private storage. Signing in does not upload these entries or provide entry sync. Export, backups and the device surfaces below are separate from account sync.

A home widget can show today's schedule, open tasks and companion on your phone. A paired watch receives a limited summary only after you enable watch sharing. Watch summaries exclude entries marked local and exclude journal and mood content. Titles require a separate display choice; app lock hides them on these surfaces. Counts and times may still be visible. Watch sharing uses Apple or Google device services; Wear OS transfer may use Google's cloud relay when direct connectivity is unavailable. You can turn off watch sharing and control titles and companion display in Settings. A disconnected watch may retain an earlier summary until the new choice reaches it.

4. Device OS backups

OS backup and device-transfer services may include the app's local data. They are operated by your OS provider, and the Fillday operator cannot access your OS backups. Availability, encryption and deletion depend on your device and backup settings. Review those settings if you do not want app data included. Removing an app does not necessarily remove existing backups.

5. App lock

App lock restricts screen access with a PIN or supported OS biometrics. It does not encrypt the SQLite data file. The OS performs biometric authentication; Fillday receives the result, not your fingerprint or face data. Face ID and biometric permissions are used for app lock.

6. Diagnostics

Fillday's own local diagnostic buffer keeps bounded error codes, classes, call sites and timestamps, without journal or mood text. You choose whether and where to share it from Settings. This local buffer is separate from the technical information processed by online services and the ad SDK described in section 2.

7. Export

Where export is available, the app creates a temporary file and offers the OS share sheet. You choose the destination. The app removes its temporary file when sharing completes or is cancelled; the receiving app or person may keep the copy you shared.

8. Reminders

You control reminder permissions and the phone or watch used for delivery. Notifications do not include journal or mood text. Explicitly scheduled reminders may fire at the time you chose, including at night; automatic app suggestions follow separate quiet-hour limits. Watch reminder scheduling transfers an opaque reminder identifier and firing time, without entry titles or journal content. Lock-screen visibility and delivery also depend on OS settings.

9. Age restrictions

The app is not directed to children under 13. Account eligibility requires age 14 in South Korea and age 13 in other supported regions. A failed eligibility check leaves local recording available. The candidate restricts rewarded ads, random draws and ticket purchases to the adult account tier; it does not use minors' data for behavioural ad targeting.

10. Retention and deletion

Entry deletion removes the entry from ordinary app views; internal deletion markers may remain. Per-module data removal and OS app-data removal have different scopes. Exports and OS backups can retain separate copies.

An account-deletion request in Settings immediately locks the account and signs it out. Permanent deletion of the account and its linked reward state is scheduled after 30 days. Stored Apple authorisation credentials are also revoked. Account deletion does not automatically erase local entries.

Purchase-delivery and refund-processing records are retained separately for five years from each recorded action for transaction verification and dispute handling, then removed by daily maintenance. They contain an opaque account identifier, store and transaction reference, product and ticket quantity, processing date and refund status. Calendar or diary content, email, card details, raw receipts and raw Google purchase tokens are not copied. This retention continues after account deletion, and ordinary app or client APIs cannot read these records. Contact the operator to request transaction records. Providers may keep separate records, backups and logs under their own policies, and requests about their retention or deletion can be subject to those provider policies.

11. Your choices and rights

You can read, edit and remove local entries, change device permissions, revisit available ad privacy options, or request account deletion in Settings. Contact the operator to request access, correction, deletion or restriction of account information. Identity checks may be needed to protect your account. Availability of particular rights depends on applicable law.

12. Changes

Significant changes will be announced before they take effect. Before entry sync is introduced, this policy will be updated to explain the content transmitted, its destination and retention.

13. Contact