DRAFT, not legal advice. This privacy notice is a working draft for adayo's MVP. It has not been reviewed by a lawyer and is not yet in force.

Privacy

What we don't collect

An adayo account needs no email address, phone number, real name or password, and adayo never asks for them. The one exception is a way to reach you that you choose to give on the contact form, if you want a reply (see The contact form). There is no advertising, no analytics and no tracking across sites.

What we store

• Your username. Usernames are public: they are part of your channel addresses. A username that is changed or whose account is deleted stays in our list of issued names, retired, so it is never given to anyone else.
• A key hash, never your 12 words. Your device turns your 12 recovery words into a key; we store only a hash of that key. Your words never leave your device. When you make new recovery words, the new key's hash replaces the old one. We also record when your words were last replaced and when you confirmed you had saved them.
• Passkeys you add: for each one, its credential id, its public key and signature counter, the transports and device type your browser reports (and whether the passkey is backed up), a name you can change, how and when it was added, and when it was last used. adayo asks for no attestation, so it does not learn your device's make or model. Your device lists the passkey under your adayo username, which is already public.
• Your logins: for each browser you are logged in on, a hash of its session token (never the token), whether it logged in with a passkey or with your 12 words, when, and when it was last used. A login lasts up to 400 days from your last visit. "Log out everywhere else" in Settings ends all the others.
• Security notices: a record each time a passkey is added or removed, your recovery words are replaced, someone logs in with your 12 words while your account has a passkey, an API token is made or revoked, an app is connected or disconnected, or a delivery device is removed. Settings shows them under Recent security activity. Each is kept for 90 days, then deleted within about an hour.
• When you last used adayo: one date per account, updated at most once a day when you use adayo while logged in, through an API token or through a connected app. It is used only to find inactive accounts (see below).
• Your refresh time and time zone, and when you last changed them.
• Your channels and the links you publish (a channel keeps its latest 100), and a record of each publish and each channel created, used for the daily limits: kept for 24 hours, then deleted within about an hour.
• Your follows: which channels you follow and when you followed them, plus a log of follow and unfollow actions used for the daily limit: each entry is kept for 24 hours, then deleted within about an hour. Channel owners see only a follower count, never who follows them.
• Your current inbox edition: which links are on its first page, and when it was made and expires.
• Push subscriptions, one per login, for each device where you turn on daily delivery: the delivery address (endpoint) your browser's push service gives that device, the keys that encrypt notifications to it, which login it belongs to, when it was added and last delivered to, how many notifications in a row went unopened (delivery to a device pauses after 7 unopened notifications in a row, and starts again when you next open your inbox), and when your next delivery is due. A push subscription is anonymous, but it is a per-device identifier. We use it only to send your daily notification, and a notice to review a change to your account when someone logs in with your recovery phrase while your account has a passkey. It is deleted when you turn delivery off for that device in Settings; when you turn notifications off for adayo in your browser and then remove that device (adayo offers this the next time you open your inbox on it); when you log out on that device, or its login ends (including "Log out everywhere else" and a login that expires); when the push service tells us the subscription no longer exists, or refuses 7 of our notifications to it outright with none accepted in between (days when we send it nothing, and temporary failures, neither count nor reset this); and when you delete your account.
• A salted hash of your IP address, never the address itself, with the time, for the limits on creating accounts, on logging in with the 12 words, on passkey attempts, on connecting apps and on the contact form. Some limits (passkey attempts, security changes) count per account instead, keyed the same way by a hash. The contact form's hashes are kept for an hour, and the others (made by the account system) for 24 hours, the longest any of those limits counts; each is then deleted within about an hour.
• API tokens you make: a hash of each token (never the token), its name, its permissions, when it was made, when it was last used and when it expires, if it does. An account has at most 10.
• Connected apps you allow, such as Claude or ChatGPT: see Connected apps below.
• Reports and appeals you send, linked to your account, and name changes made to your names. These are our records of reports and their outcomes. A report or appeal is kept while it is open; once it is resolved, it is kept for 12 months after it was resolved, then deleted within about an hour. Name changes are not deleted automatically.

Connected apps

You can connect an AI app, such as Claude or ChatGPT, to your account (see how to connect an app). Nothing is shared until you choose Allow on adayo. You can untick permissions you don't want to give, and you can disconnect an app at any time.

What a connected app can reach. Only what the permissions you allowed cover, and never your recovery words, passkeys, logins or settings:

• read: Read your inbox; see any channel, and the links of the channels you follow; see which channels you follow; see your channels, their links and follower counts; and receive notices from adayo, such as security alerts and service news (your inbox is your current edition);
• follow: See which channels you follow; follow or unfollow channels; and receive notices from adayo, such as security alerts and service news;
• publish: See your channels, their links and follower counts; create channels; post links (as your Posting setting allows); delete links; check on the posts it asked you to approve; and receive notices from adayo, such as security alerts and service news. Each app has a Posting setting: with Ask me each time (the setting a new app starts with) nothing is posted until you approve it on adayo; with Always allow the app posts without asking.

Your chats are the app's, not ours. When you ask an AI app something about your adayo, it fetches what it needs from adayo, and that data (for example your edition's links, or the channels you follow) goes to the app and its provider, such as Anthropic or OpenAI, at your direction. They handle it under their own privacy terms. Beyond that, adayo sends them only its notices about your account and its service notices (see Notices to your connected apps, below), and never sees your conversation: only the requests the app makes. To learn about the app, adayo fetches the app's public details (its name and the addresses it returns you to) from its provider's website; that request carries nothing about you.

What we store for each connection:

• The connection itself: which app, the address it returns you to as you approved it, the adayo address it can use, the permissions you allowed, when it was connected, when it was last used (updated at most once a day), and which of your logins connected it (as a hash, never the session token).
• Its tokens, as hashes only: the app's one-minute authorization code, its access tokens (each lasts an hour) and its current refresh token, with when that expires.
• The app's public details: its name, as the app gives it (adayo shows it marked "unverified"), and the addresses it may return you to.
• Its Posting setting: whether you chose Always allow, and when.
• Posts waiting for your approval: when an app asks to post a link and its setting is Ask me each time, the link, its channel, the kind of link, the app's name at that moment, whether you posted it or not, and when it was asked, decided and expires.
• Security notices when an app is connected or disconnected (see What we store, above).
• Notices to your connected apps (below), and for each connection how far it has been shown them and how far it has said it told you.

Notices to your connected apps. When something important happens to your account (your 12 words are used to log in or are replaced, a passkey is added or removed, another app is connected, or your other devices are logged out), adayo also tells each of your connected apps, so an AI assistant can pass it on to you. Each notice is a fixed sentence written by adayo, with the time it happened and a link to your Settings on adayo.com: it never contains anything you or anyone else wrote, and never a code, address or device. The app receives it beside the answer to its next request, and asks it to tell you. These notices are in addition to your security notices in Settings; telling an app replaces and hides nothing there. A notice is kept for 7 days and then deleted within about an hour; disconnecting an app deletes its record of what it was shown and told, and deleting your account deletes every notice. An app connected after a notice was sent never receives it.

Service notices. adayo may also send every connected app, on every account, a service notice: that adayo has planned maintenance coming up (the news page says when), or that there is news from adayo. Each is a fixed sentence written by adayo, the same for everyone, with a link to adayo's news page (adayo.com/news). It says nothing about you or your account, and adayo keeps no record of it for any account, beyond how far each connection has been shown notices and how far it has said it told you. The app receives it beside the answer to its next request and is asked to tell you. A service notice is kept for 1 to 7 days (adayo chooses which when sending it), then deleted within about an hour; an app connected after it was sent never receives it.

How long. An authorization code is deleted a day after it expires, and an access token within about an hour after it expires. A post waiting for approval can be decided for an hour; its record is deleted a day after the app asked, within about an hour. An app's public details are deleted once no account has it connected and nobody has started connecting it for 7 days. A connection lasts until you disconnect it, or until:

• the app disconnects itself, or adayo ends it because one of its refresh tokens was used twice (a sign it may have been copied; you get a security notice);
• you choose "Log out everywhere else" with "Also disconnect connected apps";
• the app doesn't use it for 90 days (its refresh token expires; it is then deleted within about an hour);
• you start connecting an app but the app never finishes (deleted a day later);
• you delete your account.

Disconnecting. In Settings, under Connected apps, choose Disconnect. The app loses access at once. Disconnecting deletes the connection, its tokens, its Posting setting and any posts still waiting for your approval; the security notice saying it was disconnected stays for 90 days. Links the app already posted stay on your channel, like links you posted yourself, until you delete them. Removing adayo inside the app may not disconnect it here, so check Settings.

Cookies and storage on your device

adayo sets two cookies when you log in. __Host-adayo_session holds a random session token (we store only its hash), is sent only to adayo over HTTPS, and lasts up to 400 days from your last visit. __Host-adayo_li holds only the value 1: it lets adayo's home, sign-up and log-in pages show that this browser is logged in, and gives no access to anything. Logging out turns off daily delivery on that device, deletes both cookies and clears adayo's cached pages from your browser. Your browser may also remember, on your device only, that you dismissed the "Add to Home Screen" invitation, how you like your inbox grouped, whether you turned daily delivery on or off on that device, when you last chose "Not now" for delivery, for adding a passkey or for saving your words, and which delivery subscription this browser registered (so adayo's service worker can keep it working).

Daily delivery (notifications)

If you turn it on, adayo sends your daily adayo: at most one notification a day, at the time you choose, and only when your next adayo has something new. It is sent through your browser's push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, iPhone and iPad, Microsoft for Edge on Windows). Each notification is encrypted for your device, so the push service cannot read it. The push service sees that a notification was sent to the device, and when.

What notifications say. The daily notification says how many new links your adayo has and names the channels they come from. Your device shows it like any other notification, so anyone who can see your screen can read it; if you share a computer, use a browser profile of your own. Only two other notifications exist. One is a single "We've paused your daily adayo" notice when delivery to a device pauses. The other is a security notification when someone logs in with your 12 words while your account has a passkey: it names nothing ("Open adayo to review a recent change to your account."), and goes to every device with delivery set up, paused ones included.

Name checks

Names are not screened when they are made. When someone reports a username or channel name, that reported name is sent to our moderation model's provider (Cloudflare Workers AI, or OpenRouter if we switch) to check that it is acceptable. Only the name and whether it is a username or a channel name are sent; nothing that identifies you or the person who reported it.

The bot check

Creating an account and sending the contact form use Cloudflare Turnstile, a privacy-preserving bot check that runs in your browser. Cloudflare processes technical signals from your browser to do it.

The contact form

The contact form stores your message, the link or name it concerns, and a hashed IP for the rate limit (kept for an hour). The "how to reach you" field is optional and voluntary: fill it in only if you want a reply, and it is used only to reply to you. Whatever you write there (an email address, for example) is stored with your message in our records of reports and complaints: kept while the complaint is open, and deleted 12 months after it is resolved (within about an hour).

Where it lives

adayo runs on Cloudflare (Workers, D1 database, Queues, static assets). Links you open take you to the platform that hosts the post, under that platform's own privacy policy; adayo does not load third-party content on its pages.

Deleting your account

Settings has a Delete account button. It needs one of your passkeys, or your 12 words. (After a login with your 12 words on an account that has a passkey, the words can confirm this only once that login is 24 hours old.) It deletes your account, channels, links, follows, passkeys, logins, security notices, push subscriptions, tokens and inbox edition. It also disconnects every connected app, deleting each connection with its tokens, its Posting setting and any posts waiting for your approval, and deletes the notices to your connected apps. Your username is kept only as a retired name so it is never reissued. Reports you sent are kept for our records without the link to your account, until 12 months after each is resolved.

When records are deleted

Where this notice says a record is kept for a period and then deleted "within about an hour", a clean-up runs every hour and deletes up to 500 such records of each kind each time, oldest first. Only if more than that fell due in one hour would some wait for the following hours.

Inactive accounts

An account with no channels and no follows that has not been used for 12 months is deleted automatically, with everything in it, just as if you had deleted it, and its username is retired. Because we record use at most once a day, an account deleted this way had not been used for at least 364 days. Staying logged in on a browser you never open does not count as use. Accounts with a channel or a follow are never deleted for inactivity.

Contact

Use the contact form, or email info@adayo.com.