Privacy policy
In short
Built by Days helps you keep your habits: every day you build adds a piece to a building in your city. We don’t sell data, we don’t show ads and we don’t use what you write in the app to train public AI models.
1. Data controller
HYPER DEVELOPMENT ASC S.R.L. (CUI 48446947, J33/1192/2023), Str. Principală nr. 711, room 1, Pătrăuți village, Suceava County, 727420, Romania (“we”), is the controller of the personal data processed through the Built by Days apps for iOS and Android, the web app and the builtbydays.ro website (the “Service”).
For any question or request about your data, write to privacy@builtbydays.ro. Phone: +40 723 882 313.
2. Scope
This policy applies when you use the app (with or without a saved account), open a public link to a city, turn on the AI Coach, buy a subscription or contact us.
Built by Days is not a medical, psychological or emergency service. Some habits can still say something about your health or life, so we treat them as sensitive personal information (see section 5).
3. The data we process
Your account: your email address or the identifier Apple or Google gives us, language, time zone and the confirmation that you are at least 16. You can also start without an email; the account is then anonymous and tied to that device until you save it with an address. We don’t ask for your legal name, date of birth, address or an ID document.
What you build: your goal and its reason, your habits (name, type, target, schedule, the moment you do them after, reminder time), check-ins, daily notes, pauses, pieces, buildings and the planned series of buildings, level and XP.
The AI Coach, only if you turn it on: your messages and the Coach’s replies, a short summary of the conversation (the habit you work on and the step you chose) and the 👍/👎 you give. Daily notes reach the Coach only with a separate consent.
The public link, only if you create it: a random link identifier and the image of your city, without your name and without your habits. The images and clips you share are made on request and leave your phone only to the app you choose.
Widgets: to show today on your home or lock screen, the app stores a small copy of today’s habits on your phone. The copy stays on the device.
Subscriptions: the transaction identifier, the product and the subscription status (active, cancelled, expired). Payment is handled by the App Store or Google Play; we never receive your card details.
Technical data: your IP address (for security and abuse limits), an identifier the app creates for each phone or browser, the platform, the app version, whether reminders are on, and error and crash reports, without the content of your habits or notes.
Usage statistics, only with your consent: the steps you take in the app (for example that you checked in a habit or finished a section), the platform and version. No habit names, notes, Coach conversations or location.
Communications: the sign-in code email and the messages you send us. Reminders are notifications scheduled locally by your phone.
We don’t collect location, contacts, photos, on-device health data or advertising identifiers.
4. Why we process data, and on what basis
Performing our contract with you: the account, saving and syncing your progress across devices, the city, widgets, exports, the public link and the subscription.
Your explicit consent: the AI Coach and, separately, the Coach’s access to your notes. You can withdraw it anytime in You → Privacy and consents; withdrawal doesn’t affect processing done before.
Your consent: usage statistics and notifications. Without it we send nothing.
Our legitimate interest: security, preventing abuse, fixing bugs and answering your messages.
Legal obligation: when the law requires us to keep or disclose information.
5. Habit names can be personal
A habit like “No alcohol” can say something about you. That’s why habit names and notes never appear in technical logs, statistics, error reports or on the public link. The Coach sees them only if you turned it on.
6. Providers
We work with providers that process data only on our behalf, under contract: Supabase (database and sign-in), Google Cloud (servers), Cloudflare (the domain and the public site), Sentry (error reports), Postmark (the sign-in code email and the beta list confirmation), Expo (app updates) and PostHog (usage statistics, only with your consent).
The AI Coach uses the Claude model (Anthropic) through Google Cloud Vertex AI, processed in the European Union (Belgium). The provider receives only the context needed for the reply (a few habits, the last days, the last messages and a short summary), without your email address, and doesn’t use the data to train models.
Apple, Google and RevenueCat: app distribution, Sign in with Apple or Google, payments and subscription status.
Professional advisers or authorities, only when necessary and allowed by law.
We don’t sell or rent data. We don’t give it to advertisers, data brokers, employers or insurers.
7. Where data lives
The database and servers are in the European Union (Frankfurt). If a provider processes data outside the European Economic Area, we rely on adequacy decisions or the European Commission’s standard contractual clauses, with additional security measures. Details at privacy@builtbydays.ro.
8. How long we keep data
What you build: for as long as you have an account.
Coach conversations and their summary: 90 days; you can delete them earlier at any time.
The public link: until you turn it off or delete your account.
Messages sent with Send feedback, and the address you asked us to answer at: 12 months, then we delete them.
Technical logs: 30 days. Backups: 30 days.
Usage statistics: 12 months at most.
The log of sensitive actions (export, deletion, administrative changes) and the record of your requests: 2 years.
We keep data longer only when the law requires it or for security or defending a right, and only for that purpose.
9. Your rights
You have the right to know what data we hold about you and access it, correct it, delete it, receive it in a portable format, restrict processing, object to it and withdraw your consents.
You can do much of this directly in the app: You → Export data (JSON or CSV), You → Privacy and consents, You → Account → Delete account.
For anything else, write to privacy@builtbydays.ro. We may verify your identity through the account’s email address and never ask for more than needed. We answer within one month; any extension the law allows is communicated with its reason.
You can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority of the EEA country where you live or work. We encourage you to write to us first.
10. Deleting your account
In the app: You → Account → Delete account. If you can no longer sign in, write to privacy@builtbydays.ro from the account’s address. The full steps are on the “How to delete your account” page.
Uninstalling the app doesn’t delete the account. Deleting the account doesn’t cancel an App Store or Google Play subscription; cancel it separately in the store.
11. Automated decisions
The Coach makes suggestions based on your data; they can be wrong and are not medical advice. We don’t make solely automated decisions with legal or similarly significant effects on you.
12. Minimum age
The app is for people aged 16 or older. If we learn an account belongs to someone younger, we delete it after checking.
14. The builtbydays.ro site and the beta list
The site uses no cookies, analytics or third-party scripts. The host (Cloudflare) processes the IP address and the technical request data only to deliver the pages and protect them from abuse.
If you leave your email on the list, we keep only the address, its language and the section you sent it from, to write when you can join the beta and at launch. The basis is your consent, confirmed through a link by email (Postmark sends it). Without confirmation the address is deleted automatically after 7 days; a confirmed address is kept for at most 12 months. Unsubscribe anytime from the link in the email or by writing to us, and the address is deleted at once.
15. Security
We use encryption in transit, per-account data separation at the database level, access controls, data minimisation and incident monitoring. No method is completely risk-free; if a breach requires it, we notify users and the authority as the law requires.
16. Changes
When the Service or the law changes, we update this page. For an important change we tell you in the app at least 30 days before it applies and ask for new consent where the law requires it. Current version: 2026-10-08-draft.
17. Contact
HYPER DEVELOPMENT ASC S.R.L. (CUI 48446947, J33/1192/2023) — operator of Built by Days
Str. Principală nr. 711, room 1, Pătrăuți village, Suceava County, 727420, Romania
privacy@builtbydays.ro · +40 723 882 313