Said Daily Privacy Policy
Overview
Said Daily is a personal reading and reflection app for iPhone, iPad, Mac, Apple Watch, widgets, and related Apple experiences. This policy explains what information the app handles, why it is used, where it is stored, who can see it, and the choices available to you.
App: Said Daily
Developer and data controller: Jeffrey Hakim, Kentucky, USA
Contact: jeff@jeffreyhakim.com
The Short Version
- Said Daily does not contain third-party advertising SDKs and does not use your information for behavioral advertising or cross-app tracking.
- Saved thoughts, private reflections, original writing, collections, preferences, and search activity are kept on your devices and, when sync is enabled, in your private iCloud database.
- If you use Groups, account, membership, shared content, safety, and notification information is stored on the Said Daily service so the group can work across devices and between members.
- Location, camera, photos, notifications, and profile sharing are optional and are used only for the feature you choose. Choosing a contact for an invitation goes through Apple’s contact picker, which asks for no permission and hands back only the contact you choose.
- Said Daily does not sell or rent personal information.
Information Stored on Your Device
The app stores your saved quote identifiers, collections, private reflections, original writing, reading history or rhythm, appearance and accent choices, notification preferences, enabled themes, onboarding name, cached editorial content, and other app settings on your device. Search queries and search results are processed locally. If you enable reflection search, your reflections are searched only on that device.
Widgets use an Apple App Group to read a limited cached quote and appearance settings. The Apple Watch app may exchange quote, save, reflection, preference, and recent weather information with the paired iPhone using Apple’s WatchConnectivity service. This information is not sent to Jeffrey Hakim’s server merely because you use a widget or Apple Watch.
The optional reflection lock uses Apple’s device authentication, such as Face ID, Touch ID, or your device passcode. Said Daily receives an authentication result, not your biometric template or passcode. This lock controls access on the device; it does not change where synced reflections are stored.
Sign in with Apple and Your Said Daily Account
Sign in with Apple is optional for private reading features and required for Groups. When you sign in, Apple provides the app with an app-specific, opaque account identifier. Apple may also provide your name and email address, or an Apple private relay address, depending on your choices and whether Apple has previously provided those fields.
The Said Daily service stores the Apple app-specific identifier, optional display name, optional email address, account creation and update dates, and a server session used to keep you signed in. Server sessions expire after 180 days unless they are ended earlier by signing out or deleting the account. Where Apple supplies the necessary authorization, the service also stores an Apple refresh token to support revoking the app’s authorization when you delete your account. Your Apple password is never provided to Said Daily.
Private iCloud and CloudKit Sync
When account sync is enabled, your profile, profile photo, saved thoughts, collections, private reflections, original writing, photos attached to your own thoughts, reading history, and supported preferences may be stored in your private CloudKit database so they can follow you between your Apple devices and be restored after reinstalling the app. This data is associated with your Apple account and is handled by Apple under Apple’s privacy terms.
Private CloudKit information is not placed in the Said Daily group database and is not made visible to other Said Daily users. Jeffrey Hakim does not have access to your private CloudKit library through the Said Daily service. Content you deliberately post to a Group is separate from your private CloudKit library.
Groups and Shared Content
Groups are private and invitation-only. To operate Groups, the Said Daily service stores the group name, summary, icon, creator, membership list, member roles, join dates, group preferences, invitation codes and expiration dates, posts, shared quotes, optional notes, replies, likes, and timestamps.
A Group may also have a photo of its own, chosen by whoever set it, which is separate from the symbol a Group falls back to and separate from any member’s avatar. It is stored on the Said Daily service and shown to the Group’s members. An invitation preview does not show it: someone deciding whether to join sees the Group’s name, its symbol, its summary, how many members it has, and who invited them. It is removed when the Group is deleted or when the photo is removed. A group member can see the group identity, its members, and content shared inside that group. People outside the group cannot browse its contents through the app.
Your display name is visible to members of Groups you join. Your private profile photo is not shared automatically. If you turn on “Use my photo in Groups,” a separate compressed avatar copy is uploaded to the Said Daily service and shown to other members of your Groups. Turning that setting off removes the shared avatar copy.
Invitation codes generally expire after 24 hours and have a limited number of uses. An invitation preview may show the group name, icon, summary, member count, and inviter’s display name before you join, but it does not show group posts.
Group Safety, Reports, and Moderation
If you block someone, report content, or if automated safety checks flag group content, the service stores the information needed to apply that choice and review the issue. This can include the reporting and reported account identifiers, group and post identifiers, selected report reason, optional report note, content involved, moderation status, review timestamps, strikes, and temporary write restrictions.
Blocks are private and are not announced to the blocked person. Reports and flagged content may be reviewed by the relevant Group owner or administrators and by Jeffrey Hakim as the app administrator. Copies of reported or flagged content can remain for moderation after the original post or reply is deleted. Group owners or administrators may manage membership and group settings according to their role. Group content should not be treated as confidential from the other members of that group.
Group Screenshot Notices
When the app detects a screenshot while you are viewing a Group, it can send a notice to the other members identifying you by your display name. The first screenshot is an exception: the app explains the rule to you without notifying the Group. Subsequent notices reveal that you were viewing that Group at that time. The service processes the account and Group identifiers and event information needed to send the notice. It does not receive the screenshot image or a recording of your screen. These notices cannot prevent another member from saving or sharing Group content.
Notifications and Device Information
Daily Thought and similar scheduled reminders are normally local notifications created and delivered by iOS on your device. If you enable remote announcements or supported Group and safety notifications, Apple provides an APNs device token. The app sends that token, its sandbox or production environment, the app bundle identifier, app version, enabled status, and a one-way account association when you are signed in to the Said Daily service.
The account association is derived from your Apple app-specific identifier using a one-way hash. It lets the service send an account-specific notification without storing that Apple identifier in the device-token table. Notification delivery records may include the device token, delivery status, Apple response identifier, failure reason, and attempt time for delivery troubleshooting. Turning notifications off in iOS Settings stops Apple delivering them, and the app stops asking the service to send them; it does not by itself delete the stored registration. The registration is removed when Apple reports the token is no longer valid, which is what follows from leaving notifications off, and it is removed when you delete your account.
Quote Suggestions and Feature Suggestions
If you submit a quote or feature suggestion, the service receives the text you enter and any optional author, source, theme, name, or email information you choose to include. It may also receive the app version. Suggestions are stored in a private review queue and may be marked new, reviewed, converted, completed, or archived.
To prevent spam, the service hashes the request’s IP address and user-agent information into a security identifier. It stores that identifier in separate, short-lived request counters to limit submissions and device registrations. These counters are not attached to the suggestion record. Hashing does not make the identifier anonymous. The counters use limited time windows, generally an hour for public submissions, and expired entries are removed during later service activity rather than necessarily at the exact moment they expire. Cloudflare also processes connection information to deliver and protect requests.
A quote suggestion may remain after account deletion if it has been accepted or may already be part of the editorial library. When the service can associate a suggestion with the deleted account’s email address or display name, the stored sender name and email are removed. Identifying details that you included inside the suggestion text, or sent under different contact details, may require a separate removal request. You may also email the address below to request removal of an identifiable suggestion.
Messages Sent From This Website
If you use the contact or feature-suggestion form on saiddaily.com, the service receives the message you write and, if you choose to give them, a name and an email address for a reply. Neither is required; only the message is. No account is needed to write, and the form does not ask you to sign in. Messages are stored in a private queue and may be marked new, read, answered, or archived. A notification is sent to Jeffrey Hakim when one arrives.
A copy of each message is also delivered to Jeffrey Hakim’s own email inbox, with any name and reply address you gave, so that he can read and answer it.
When you delete your Said Daily account and the service can associate a message with that account’s email address or display name, the stored sender name and email are removed from the queued copy and the message text is kept. That removal does not reach the copy already delivered to his inbox. You may email the address below to ask for a message, or an emailed copy of it, to be removed entirely.
Location and Apple Weather
If you enable local weather, Said Daily requests location access while you use the app. Your location is sent to Apple Weather to obtain conditions for your area. Said Daily does not send that location to Jeffrey Hakim’s server and does not store a location history. A recent weather result may be cached on your devices and shared with your paired Apple Watch to display the feature. You can disable location access in iOS Settings.
Camera, Contacts, Photos, and Sharing
Camera: The camera is used locally for two things: to take a photo to keep with a thought you write, and to scan a Group invitation QR code. These are the two uses named in the permission prompt iOS shows you. A photo you take is handled as described under Photos below. Said Daily does not record video, and nothing from the camera is uploaded for the QR scan.
Contacts: Apple’s contact picker lets you choose a person for an invitation. The selected contact detail is used to address a message you choose to send. Said Daily does not upload your address book or continuously access your contacts.
Photos: You may choose a profile image or attach a photo to a personal thought through Apple’s photo picker, save a generated quote image to Photos, or select whether a compressed avatar is visible in Groups. Private profile and personal-thought photos may sync through your private CloudKit database. Personal-thought images are resized and re-encoded before storage, removing embedded metadata such as GPS coordinates, capture time, and camera details; information visible in the picture itself remains. The optional Group avatar is a separate copy stored on the Said Daily service and visible to fellow Group members. Selecting a photo does not give Said Daily access to your entire photo library.
Share sheet and Messages: When you choose Share or Messages, Apple’s system interface handles the destination. Information you send to another person or service is then governed by that recipient or service.
Website and Service Security Information
When you visit the website or contact the service, the hosting and network providers process technical information such as your IP address, browser or user-agent details, requested address, and request time to deliver the page, prevent abuse, and diagnose failures. Security records for attempts to access the restricted administrator dashboard may also include an approximate location inferred from an IP address. This is separate from the optional Apple Weather feature and does not mean your device’s precise location is sent to Said Daily. Restricted administrator access uses authentication and security records to protect user information.
Service Providers and Disclosure
Said Daily uses Apple services, including Sign in with Apple, iCloud and CloudKit, Apple Push Notification service, Apple Weather, Photos, Contacts, Messages, WatchConnectivity, and related operating-system services. Apple processes information under its own privacy policy. Said Daily uses Cloudflare Workers and Cloudflare D1 to deliver the Said Daily API and store server-side account, Group, moderation, suggestion, and notification information. Cloudflare processes request and stored information on Jeffrey Hakim’s behalf under Cloudflare’s terms and privacy commitments.
Information may also be disclosed when reasonably necessary to comply with law, respond to valid legal process, investigate abuse or security incidents, enforce app rules, or protect users, the public, or the service. Said Daily does not sell personal information and does not share it with advertising networks or data brokers.
Apple Privacy Policy · Cloudflare Privacy Policy
Retention and Deletion
On-device information: kept until you remove it, clear the app’s data, or uninstall the app, subject to device backups and Apple’s own retention behavior.
Private CloudKit information: kept in your private iCloud database until you delete the synced data or account, or manage it through Apple’s available iCloud controls.
Account and sessions: kept while your Said Daily account exists. Sessions expire after 180 days and can end earlier when you sign out. Expired-session records may be removed during later service activity or maintenance.
Group information: kept while the Group, membership, or content remains. Deleting your account removes your posts, replies, likes, memberships, blocks, and applicable moderation records. A Group you own may transfer to another member rather than being deleted; an empty Group is deleted.
Suggestions: kept while needed for review, publishing, support, abuse prevention, and maintaining the editorial library. Identifiable suggestion information can be removed upon request where reasonably possible.
Messages sent from this website: kept for handling the message and relevant support follow-up. On account deletion, matching sender name and email fields are removed and the message text is kept. Text may still identify you, and messages submitted using different details may not be matched automatically. Contact Jeffrey Hakim to request removal of the message itself.
Notification information: active registrations remain while enabled or until invalidated or deleted. Limited historical delivery records may be retained for operational and security auditing.
Security records and backups: request counters expire as described above. Failed administrator-access records are subject to a 30-day cleanup window, with removal occurring during subsequent security activity or maintenance. Hosting logs and database recovery copies follow the applicable provider settings and recovery periods. Deleted information may remain temporarily in recovery copies or separately preserved security or legal records. It is not necessarily erased from every backup immediately when an active record is deleted. Information retained for a legal obligation or dispute is limited to that purpose and kept only as long as necessary.
Deleting Your Account and Withdrawing Permission
You can initiate account deletion inside Said Daily from Settings → Manage Account. The deletion process removes the server account and associated server-side data as described above and attempts to clear the app’s private CloudKit records and synced image files. Server deletion can succeed even if an iCloud cleanup step fails. If cleanup reports an error, follow the app’s instructions to try again or contact Jeffrey Hakim; Apple’s iCloud controls may also be needed. Deleting a post or account cannot recall copies another member has already made. Some local content may remain on your current device so you do not unexpectedly lose private writing; you can remove it separately or uninstall the app.
The service attempts to revoke Said Daily’s Sign in with Apple authorization during account deletion when a usable Apple token is available. Revocation may not succeed, including for older accounts without a stored token. You can check and revoke any remaining authorization separately in your Apple account settings. Revoking Apple authorization or uninstalling the app is not a substitute for deleting your Said Daily server account. You can also disable notifications, location, camera, and photo access through iOS Settings, stop sharing a Group avatar in Said Daily, leave a Group, delete eligible content, or sign out at any time.
Security
Said Daily uses Apple authentication, private CloudKit storage, encrypted network connections, role-based Group permissions, administrator authentication, scoped service credentials, and other technical and organizational safeguards. No storage or transmission method is guaranteed to be completely secure. If you believe your account or Group has been compromised, contact Jeffrey Hakim promptly.
Legal Bases for Processing (UK and EEA)
If you are in the United Kingdom or the European Economic Area, the lawful bases relied on are:
- Contract. Creating and operating your account, delivering Groups, and answering a message you send are necessary to provide the service you asked for.
- Consent. Notifications, location for weather, camera, photo access, and showing your avatar in Groups are each optional and are relied on only where you switch them on. You can withdraw any of them at any time in the app or in iOS Settings, which does not affect processing already carried out. Choosing a contact for an invitation is your choice each time you use Apple’s contact picker; Said Daily holds no contacts permission, so there is none to switch off.
- Legitimate interests. Keeping the service secure and available, preventing abuse, recording failed sign-ins to a limited retention period, and reviewing reports in Groups rest on the legitimate interest of protecting members and the service. These are balanced against your rights, and you may object using the contact address below.
- Legal obligation. Retaining or disclosing information where law requires it.
International Processing
Apple and Cloudflare operate services internationally. Depending on your location and how those providers route or store information, app information may be processed in the United States or other countries where they operate.
Where information is transferred out of the United Kingdom or the European Economic Area, that transfer is covered by the Standard Contractual Clauses adopted by the European Commission, together with the UK Addendum where the UK GDPR applies, as incorporated into the data processing terms of the providers named in this policy. A copy of the mechanism relied on can be requested at the contact address below.
Representative and Supervisory Authorities
Said Daily is operated by one person in the United States and is not established in the United Kingdom or the European Economic Area. No Article 27 representative has been appointed. If you are in the UK or the EEA, write to jeff@jeffreyhakim.com for any request or complaint under this policy, and you keep the right to complain to your own supervisory authority — the Information Commissioner’s Office in the United Kingdom, or the data protection authority of the EEA country where you live or work.
Children
Said Daily is not directed to children under 13 and does not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact Jeffrey Hakim so it can be reviewed and deleted where appropriate.
Your Choices and Requests
Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information, or to object to or restrict certain processing. You may also withdraw optional permissions through the app or iOS Settings. To make a request, email jeff@jeffreyhakim.com. Reasonable identity verification may be required before responding. Requests are generally answered within 30 days, subject to applicable law and necessary extensions.
Kentucky Privacy Rights and Appeals
Where the Kentucky Consumer Data Protection Act applies, Kentucky consumers may confirm processing, access, correct, delete, and obtain a portable copy of covered personal data. They may opt out of its sale, targeted advertising, and profiling used for legally or similarly significant decisions. Said Daily does not use personal information for those purposes. Covered sensitive-data processing requires consent.
Email jeff@jeffreyhakim.com to exercise these rights. Requests are free up to twice annually, subject to lawful exceptions. A response, including reasons for a denial and appeal instructions, is due within 45 days. A necessary extension of up to 45 additional days requires notice and reasons within the initial period.
To appeal a denial, email the same address with “Privacy appeal” and identify the request. A written decision with reasons will be provided within 60 days. If denied, you will receive instructions for submitting a complaint to the Kentucky Attorney General’s Office of Data Privacy. Said Daily will not unlawfully discriminate against you for exercising these rights.
Changes to This Policy
This policy may be updated when the app, its services, or legal requirements change. The current version will be posted at this URL with a revised effective date. If a change materially affects how information is used, notice will be provided through the app or another appropriate channel, and consent will be obtained where required by law. A policy update does not by itself authorize a materially different use of previously collected information where new consent is required.
Contact
Jeffrey Hakim