← diurnalapp.ai

Privacy Policy

Last updated: October 11, 2026 (consent version 2026-10-10). Applies to the Diurnal.ai mobile app (iOS and Android) and the diurnalapp.ai website.

Diurnal.ai is a family wellness planner published by PUREQUAD SRL, a company registered in Romania (European Union), which is the data controller for the processing described here ("we", "us"). This policy explains what data we handle, why, where it goes, how long we keep it and how you stay in control. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, the ePrivacy rules, the California Consumer Privacy Act as amended by the CPRA, the other US state privacy laws, the Washington My Health My Data Act and similar consumer health data laws, the US Children's Online Privacy Protection Act (COPPA) and the FTC Health Breach Notification Rule. Questions and requests: support@diurnalapp.ai.

In short.

Your data is kept on your phone. Only if you give the separate health data consent is a copy stored on our server in the EU (Hetzner, Finland), for backup, sync between your devices and family features. Without it, the app works on your phone only.
Lab results, your genetic panel and your menstrual cycle log are stored on your phone only, never on our server. So are the GPS tracks and routes of your runs, walks, hikes and rides, your caffeine log and the daily resting heart rate, HRV and step values read from Apple Health or Health Connect.
AI features are asked about separately. They send what the feature needs to OpenAI (USA) through our server, always pseudonymised: never your name, e-mail, phone number, exact date of birth or account id, and nothing at all about children under 16. Your lab values, cycle summary and Marc's memory notes are used only if you tick them. OpenAI does not use the data to train models and keeps it for up to 30 days for abuse monitoring.
Location is used only while you record a run, walk, hike or ride, on your phone. Only if you ask for suggested loops (Premium) does your approximate starting point (rounded to about 100 m) go through our server to OpenRouteService in Germany, which calculates them. We do not store it; OpenRouteService keeps the request for 7 days, then only the coordinates rounded to about 1 km.
Data from Apple Health and Health Connect is read only if you connect them and only for the types you choose. It is used only for your own features in the app: never for advertising, never sold and never used for data mining.
The Sport community is optional, for adults only, and needs its own consent: only the sport friends you accept see your display name, your sports and the workouts you choose to post, as numbers only (never heart rate, calories, routes, places or notes). A training you share with a code never shows your name. The community sends no push notifications (section 5).
App usage statistics are collected only if you switch them on (off by default), and never about health screens.
Help improve Diurnal.ai is a separate, optional consent, off until you turn it on: the workouts you record in the app and a few profile ranges are then counted in statistics that our team sees only for groups of at least 5 people. Never data from Apple Health or Health Connect, and nothing is stored (section 9).
Our staff tools show account details, counts and adherence percentages only, never your conversations, meals, body data or other health details (the one exception: a sport profile or post someone reports to us, section 7), and every staff access to an account is logged.
No ads, no sale of personal data, no advertising identifiers, no third-party analytics.
You can export or delete everything from Settings, or by e-mail (see Delete your account).

1. Who we are

PUREQUAD SRL, limited liability company, Romania (data controller)

Registered office: Bd. Iuliu Maniu nr. 7, Corp T, etaj 3, Sector 6, Bucharest, Romania

Trade Register number: J2017015676403

Tax identification number (CUI): 29314850 (VAT number RO29314850)

E-mail: support@diurnalapp.ai

Privacy contact: support@diurnalapp.ai, with "Data protection" in the subject line. We have not appointed a data protection officer; if we do, we will publish the contact here.

2. Data we collect

Profile details you enter: name or nickname, your year of birth (asked first, so we can confirm you are at least 18) and, optionally, biological sex, height, weight, activity level and daily step range (used to compute your calorie target and reference daily intakes; whether you are a man or a woman also tailors the workouts the app suggests), your primary goal, food allergies or intolerances, smoking and alcohol habits, your availability (for example the hours you are away at work) and a profile photo.
Account: a guest account identified by a random device token (an e-mail address is optional if you use the app on your phone only), or an account with e-mail and password, Google sign-in or Sign in with Apple. When you change your e-mail, the new address is used only after you confirm it from that inbox. Passwords are stored only as a salted cryptographic hash (scrypt).
Wellness content you create: supplement and medicine routines (product name, brand, dose, times, frequency, course dates, the ingredient list read from the label, and, if you use them, the stock count, the refill alert setting and your own reorder link), which doses you tick off, meals (text, AI estimates and the photos you choose to analyse), sleep entries, goal and mood check-ins, weekly reports, the day by day journal, your conversations with Marc (the AI assistant) and the short notes Marc keeps to remember your preferences.
Assistant choice: whether you picked Marc (the owl) or Lily (the squirrel) as your AI assistant. It is a display preference stored with your account settings: it changes only the assistant's name, character and the app's accent colours, not what the assistant knows or what data it receives. Everything this policy says about Marc applies in the same way to Lily.
Laboratory results you add from a photo or PDF: the extracted markers (name, value, unit, reference range, status) and the test date. Stored on your phone only, never on our server.
Genetic information you choose to add: a raw DNA export, filtered on your phone to a small nutrition panel (section 5). The panel and its interpretation are stored on your phone only.
Menstrual cycle, fertility and pregnancy data, only if you turn on cycle tracking (section 5). Stored on your phone only.
Family member profiles you manage for people who do not use the app (a child, a parent, a partner): name, relation, age, routine, allergies, food preferences and notes you add, and your confirmation that you are the child's parent or guardian, or that the adult agreed (recorded with the date, section 16).
Friends and family features: the e-mail address of a person you invite, the requests exchanged, and your friend list: who you are friends with (someone who accepted your request or whose request you accepted, and the partner in your cycle sharing, on both sides), how and since when. Your friends see your account name in their list, never your e-mail address or account id.
Sport (the Sport tab): the sports you practise, the trainings you build (exercises, sets, reps, weights, rest, and optional reminder days and time), exercises you create yourself, and your workouts: sport, start and end time, duration, sets, reps and weights, how hard it felt (effort), your notes, distance, climb, energy, kilometre splits and, for workouts imported from a watch, average and maximum heart rate; your personal bests, Sport settings and, if you asked for one, Marc's summary of a workout.
Sport community, only if you create a sport profile (section 5): the display name you choose, your sports, your friend code, your sport friends, friend requests and the people you block, the workouts you post (numbers only), kudos you give and receive, and reports you make (the reason and any note). Shared trainings, only if you share one with a code or on your sport profile: the training as described in section 5.
Location: precise location from your phone's GPS, only while you record a run, walk, hike or ride, to draw your route and measure distance, pace and splits; and your current position, read once, when you ask for suggested loops. The track of each recording and the routes you save stay on your phone only (section 5).
Apple Health and Health Connect, only if you connect them and only the types you switch on: sleep, steps, resting heart rate, heart rate variability (HRV), workouts (with distance, energy and heart rate) and, if you track your cycle, period days. If you allow it, the app also saves the workouts you record in it to Apple Health or Health Connect (section 5).
Step count: from Apple Health or Health Connect if you connect them, otherwise (iPhone only) from your phone's motion sensor. Kept only on your phone.
Caffeine log (the drinks and amounts you log, last 30 days) and lab recheck reminders (the marker name and the date you chose), kept only on your phone.
Voice and shortcuts: when you use Siri or Shortcuts on iPhone, or app shortcuts or Google Assistant on Android, to log a supplement or a meal or to start a workout or a run, the app receives on your phone what you asked for (for example which supplement, or the words describing the meal). On iPhone, the names of your routine items are shared with iOS on your phone so Siri can offer them (section 5). The voice request itself is handled by Apple or Google (section 11).
Purchase status: whether you have Premium, which plan, until when, and promo codes you redeem. We never receive card or bank details.
Technical data: device model, operating system, app language, time zone, app version, last activity time, counters of AI requests (for your allowance), and a one-time check that the app is genuine (Apple App Attest or Android key attestation).
Support: what you send us by e-mail or from the app's Help and feedback screen (section 8).
App usage statistics, only if you switch them on (section 9).
Security logs: failed logins and blocked or suspicious requests, with the IP address (section 13).

We do not collect contacts, calendar or microphone input (voice requests are processed by Apple or Google, not by us). Precise location is used on your phone only: we never receive your tracks or routes. The maps in the Sport tab are loaded from Apple Maps (iPhone) or Google Maps (Android) for the area on screen (section 11), and the starting point of suggested loops is sent only as described in section 5. We use no advertising identifiers (IDFA or GAID), no third-party analytics or crash-reporting SDKs, and we show no ads. Reminders are scheduled on your phone by the app itself. Our server sends push notifications only for dose alerts for family, to the family member who checks on your doses (section 5). The Sport community sends no notifications: new kudos and friend requests show only inside the app.

What our server stores for you (the synced copy)

Only with your health data consent, and only these parts, so you can restore them on a new phone and use family features: your profiles (including your profile photo, if you add one) and family members, family name, supplement routine, the last 15 conversations with Marc (up to 40 messages each; conversations you have in Anonymous mode stay on your phone), Marc's memory notes, the last 180 days of meals, the last 14 days of ticked doses, the daily completion history, achievements, the last 60 nights of sleep (without the "period" note and including nights imported from Apple Health or Health Connect), your sleep plan and time zone, and your Sport data: trainings, your own exercises, Sport settings and the workouts of the last 365 days (at most 400), including workouts imported from Apple Health or Health Connect, with their totals, splits and heart rate. The supplement routine includes stock counts and reorder links if you use them. Never lab reports, the genetic panel, the cycle log, GPS tracks or saved routes, the caffeine log, lab recheck reminders, or the daily resting heart rate, HRV and step values from Apple Health or Health Connect. Meal photos stay on your phone. Your full history stays on your phone. Your conversations and Marc's notes can contain health details you mention in them, such as a lab value or your cycle: they are part of this copy. The Sport community and shared trainings are stored separately from this copy, only if you use them (section 5).

3. Your consents

During setup the app asks you separately for each of the following. None of the optional boxes is pre-ticked, and entering data in the app is never treated as consent.

Consent	What it allows	If you say no or withdraw it
Terms of Service and this Privacy Policy (required)	Using the app	You cannot use the app; you can delete your data at any time.
Health data (optional, explicit consent under GDPR art. 9(2)(a))	Storing the synced copy of your health data (including your workouts) on our EU server for backup, sync between your devices and family features	The app works on your phone only: no server sync, no AI, no family sync. Withdrawing it erases the server copy of your data, your goal and mood check-in answers and your partner sharing snapshot, and also withdraws the AI, genetic and partner sharing consents, the dose alerts for family, Help improve Diurnal.ai and the Sport community consent (which erases your sport profile, posts and shared trainings). You can give it again later in Settings.
AI features (optional, explicit)	Sending the categories listed in section 6 to OpenAI through our server, so Marc and the photo, label and lab readers can work. The consent screen lists every category; your lab values, cycle summary and Marc's memory notes are three further, unticked choices.	AI features are off; the rest of the app keeps working.
Genetic data (optional, explicit, a separate unticked box on the AI consent screen and the DNA import screen)	Interpreting your genetic panel with the AI. Whether Marc may also use the interpretation in chat is a separate switch, off unless you turn it on.	No genetic interpretation; the genetic summary is never given to Marc.
Partner sharing (optional, explicit, Premium, 18 or over)	Storing the cycle snapshot you chose, with the same estimates for the next 45 days, for the one partner who enters your code. Recorded when you confirm exactly what your partner will see. You and your partner also become friends in the app (each sees the other's account name in the friend list).	Stopping sharing deletes the snapshot and withdraws this consent. The friend link stays until either of you removes it.
Dose alerts for family (optional, explicit, Premium, 18 or over)	Showing the family member who enters your code, for the current day, the names and times of your supplements and medicines and whether you marked them, and sending them a notification when a dose is still not marked after the delay they choose. Recorded when you confirm before a code is created.	No one can check on your doses; stopping or withdrawing ends every such link at once.
Sport community (optional, explicit, 18 or over, free; an unticked box on the screen where you create your sport profile; it also needs the health data consent)	Showing your sport profile (display name and sports), the workouts you post (numbers only) and the trainings you choose to show to the sport friends you accept, and storing them on our EU server for that purpose (section 5)	No sport profile. Deleting your sport profile withdraws this consent and erases your profile, posts, kudos, sport friends and shared trainings from our server; your workouts stay in the app.
Family members (a confirmation for each person you add)	Keeping a child's details as their parent or legal guardian, or an adult's details because they agreed	The person cannot be added; delete a profile at any time.
Health details in a support report and the AI summary of that report (two optional boxes on each report)	Processing health details you choose to include, to answer you; including the report, masked, in the summary our team makes with OpenAI	Please leave health details out; the report is never included in the AI summary.
App usage statistics (optional, off by default)	Collecting the usage events in section 9	No usage events are stored.
Help improve Diurnal.ai (optional, explicit, off by default; a switch in Settings, Health data consent; it also needs the health data consent)	Including the workouts you record in the app and a few profile ranges in statistics that our team sees only for groups of at least 5 people, to improve workouts, exercises and suggestions (section 9)	Your data is not included. Turning it off, or withdrawing the health data consent, leaves you out of the next calculation; nothing else needs deleting, because the statistics are not stored.
Apple Health or Health Connect (optional; you choose each type in the app, then allow it on the system screen)	Reading the types you switch on and, if you allow it, saving the workouts you record in the app (section 5). This is your explicit consent to that processing (art. 9(2)(a)). Each time you connect or disconnect, the app records it on our server with the date, the platform and the version of the text, like the other consents (the health data itself is not part of that record).	Nothing is read or written. You can switch types off or disconnect at any time in the app and in Apple Health or Health Connect; disconnecting removes the heart rate, HRV and step values from your phone.
Location (a system permission, "while using the app" only)	Recording your runs, walks, hikes and rides, and finding where you are for suggested loops	You cannot record GPS activities or get loops; everything else works.

Each consent is recorded with the date and time you gave it and the version of the text you saw (currently 2026-10-10; your acceptance of the Terms included), on your phone and on our server, together with a history of every grant and withdrawal, so we can show what you agreed to and when. When we change a consent text in a way that matters, the app asks you again; your data is kept meanwhile. You can withdraw any consent at any time in Settings, as easily as you gave it. Withdrawal does not affect processing that happened before it.

4. Purposes and legal bases

Purpose	Data	Legal basis (GDPR / UK GDPR)
Running the app: routines and reminders (scheduled on your phone), supplement stock and refill reminders, timing hints, meal and sleep tracking, the caffeine guide, lab recheck reminders, journal, the Sport tab (trainings, live workouts, history, personal bests, stretching, training-day reminders and tips, all computed on your phone without AI), voice shortcuts, friend requests, your account and purchases	Profile, account, wellness content, Sport data	Performance of our contract with you (art. 6(1)(b))
Recording GPS activities and showing them on a map; suggested loops (Premium)	Precise location on your phone during a recording; the approximate starting point (about 100 m), the distance and the type of activity for loops	Contract (art. 6(1)(b)). You start each recording and each loop request yourself and the feature cannot work without your position, so we rely on the contract rather than on a separate consent; reading the position from your phone is strictly necessary for the service you asked for. The operating system still asks your permission, and you can turn it off at any time.
Reading from and writing to Apple Health or Health Connect	The types you switch on (section 5)	Your explicit consent (art. 9(2)(a)), given when you connect and choose the types; withdraw it by switching types off or disconnecting
Storing the synced copy of your health data, restoring it on a new phone, family features	Health data in the synced copy	Your explicit consent (art. 9(2)(a)) and our contract (art. 6(1)(b))
AI features: answers from Marc, reading meal photos, labels and lab reports, weekly reports, workout summaries and the weekly coach note	The categories in section 6	Your explicit consent to AI processing (art. 9(2)(a)) and our contract (art. 6(1)(b))
Help improve Diurnal.ai: statistics on how workouts, exercises and suggestions are used, to improve them	Workouts recorded in the app and profile ranges (section 9)	Your explicit consent (art. 9(2)(a) and art. 6(1)(a)), a separate switch, off by default
Genetic interpretation	Genetic panel or report	Your separate explicit consent for genetic data (art. 9(2)(a))
Sport community: your sport profile, sport friends, posting workouts, kudos, friends' sport profiles and the trainings shown on them	Display name, sports, friend code, friendships, requests, blocks, posted workouts (numbers only), kudos	Your explicit consent to the Sport community (art. 9(2)(a) and art. 6(1)(a)), given with an unticked box before your sport profile is created; the health data consent is also required
Sharing a training with a code	The training you share (section 5)	Contract (art. 6(1)(b)): you ask us to keep a copy that people with the code can save. The app also requires your health data consent, because it treats Sport data as health data
Reports and moderation in the Sport community	The report (reason, note), the reported display name and post	Legitimate interests (art. 6(1)(f)) in keeping the community safe and enforcing the Terms; legal obligation where the EU Digital Services Act requires us to act on a notice (art. 6(1)(c))
App usage statistics	Usage events (section 9)	Your consent (art. 6(1)(a) and the ePrivacy rules on device access)
Newsletter	E-mail address	Your consent (art. 6(1)(a)), confirmed by e-mail
Account e-mails (confirmation, password reset, security notices)	E-mail address	Contract (art. 6(1)(b))
Premium and promo codes; accounting records	Purchase status, random account identifier, revenue records	Contract (art. 6(1)(b)); legal obligation for accounting (art. 6(1)(c))
Support requests and reported AI answers	What you send us (section 8)	Contract (art. 6(1)(b)); for health details you include, your explicit consent given on that report (art. 9(2)(a)); for the AI summary of reports, your consent given on that report (art. 6(1)(a))
Security, abuse and fraud prevention, rate limits, the app integrity check, staff access log	Account, device, security logs, request counts	Legitimate interests (art. 6(1)(f)) in keeping the service and your data safe; legal obligations (art. 6(1)(c) and art. 32)
Answering requests, complaints and legal claims	What you send us	Legal obligation (art. 6(1)(c)); legitimate interests (art. 6(1)(f)); for health data, art. 9(2)(f) where a legal claim requires it

We never use your data for purposes incompatible with the ones above, for advertising, or to make decisions about you.

5. Health, genetic and cycle data

Allergies and intolerances, weight and body measurements, sleep, mood, supplements and medicines, meals, workouts with heart rate, resting heart rate and HRV, pregnancy and cycle information, lab results, genetic information and anything about your health you tell Marc are special categories of personal data (GDPR art. 9), "sensitive personal information" (California) and "consumer health data" (Washington, Nevada, Connecticut). We process them only with your explicit consent (section 3), only for the features you use, and never for advertising, marketing profiles or sale. A separate Consumer Health Data Privacy Policy describes this processing in the format required by US state health data laws.

Menstrual cycle, fertility and pregnancy data

If you turn on cycle tracking, everything you log (periods, symptoms, mood, discharge, intimacy, ovulation and pregnancy tests, basal temperature, contraception, pregnancy dates, notes) is stored on your phone only. It is not part of the synced copy on our server.
If you allowed AI features and ticked "Marc may use my cycle summary" (off unless you tick it, also in Settings), a short summary goes with your chat messages so answers fit your cycle: mode, phase and cycle day, how many days until the next expected period, the estimated fertile window, pregnancy week, contraception method and the flow and symptoms of the last three days. Your intimacy log, discharge, temperature, test results and notes are never sent. It is never sent to an AI provider you connect with your own key.
Anonymous mode (Settings) stops even that: nothing about your cycle leaves the phone, partner sharing is off, and the conversations you have in Anonymous mode stay on your phone (never synced, never added to Marc's memory).
Partner sharing (Premium, only for people aged 18 or over, optional): if you create an invite code, our server stores only the latest small snapshot you chose to share and shows it to the one signed-in account that entered your code. The snapshot contains your display name, phase, cycle day and PMS window, and, only for what you switch on, the predicted period, the fertile days and today's symptoms (never intimacy symptoms), your pregnancy week if you are in pregnancy mode, and an optional short message (links and contact details are removed from it, and your partner can report it to us). Never your log, notes or tests. So your partner's view stays current on days you do not open the app, your phone also sends the same estimates for the next 45 days (phase, cycle day and PMS days, the fertile days only if you share them, or the pregnancy week only if you share it); they are stored with the snapshot. Our server shows your partner only the current day, plus heads-ups that your partner's phone turns into notifications: the day your PMS days may start (at most 2 days ahead, or 7 days when you share your expected period) and, only if you share it, the day your period is expected. On your partner's lock screen these notifications show a neutral line unless your partner turns on details. Invite codes work once and expire after 24 hours. Stopping sharing deletes the snapshot; if sharing pauses (for example when Premium ends), the snapshot is deleted after 30 days.
Predictions are calendar estimates from the period starts you logged and your settings. Days you mark, ovulation tests and temperatures you log are kept as a record only and never change an estimate. They are not a method of contraception and are not meant for planning or avoiding a pregnancy.

Genetic data

If you import a raw DNA export (for example from 23andMe, AncestryDNA or MyHeritage), the file is read on your phone only, filtered down to a small, fixed panel of 42 nutrition-related variants (vitamins, minerals, lactose, caffeine, omega-3 and similar topics; none linked to disease risk, medicines or mental health), and then deleted, also when it cannot be read. The full file is never stored and never uploaded. Genetics is offered only in Romania, the United Kingdom and the United States.
The panel (variant identifier, gene, topic and your genotype) is kept on your phone only and is never synced to our server.
With your separate genetic data consent, the panel lines, without your name or any other identifier, are sent through our server to OpenAI for the wellness interpretation. Photos or PDFs of genetic reports are not read by the app. The interpretation is stored on your phone.
Marc uses your interpreted findings in chat only if you switch on "Marc can use my genetic summary" in Settings (off by default), and never the variant identifiers or genotypes.
We never share genetic information with employers, insurers, advertisers or data brokers, and we never use it to make decisions about you. US users are also protected by the Genetic Information Nondiscrimination Act (GINA) and applicable state genetic privacy laws.

Sport, location, Apple Health and Health Connect

GPS activities. The app asks for location only "while using the app", never "always", and uses it only while you record a run, walk, hike or ride. So that the recording continues while the screen is locked, the phone keeps receiving positions until you finish: on iPhone the status bar shows that location is in use, and on Android a notification stays visible during the recording. The GPS track of each recording and the routes you save stay on your phone only, in the app's own storage: they are never sent to our server, never part of the synced copy and never sent to the AI. They are included when you export your data, and they are deleted when you delete the activity or the route, sign out or delete your account. The totals of a recorded activity (time, distance, climb and kilometre splits) are part of the workout, which is backed up as described in section 2.
Maps. On iPhone the route is shown on Apple Maps; on Android on Google Maps when the app version includes it, otherwise as a drawing without a map. The map is loaded by Apple or Google directly on your phone for the area on screen, so they receive your phone's IP address and that area under their own privacy terms (section 11). The app draws your route on the phone; it does not send the route to them.
Suggested loops (Premium). Only when you ask for them, and after a notice, the app reads your position once, rounds it to 3 decimal places (about 100 m) and sends it, with the distance and the type of activity, to our server, which rounds it again and asks OpenRouteService (HeiGIT gGmbH, Heidelberg, Germany) to calculate three round trips. OpenRouteService receives the rounded point from our server, without your account id or your IP address. We do not store the point or the routes, and our logs hold only the request type and its result, never coordinates. Under its own terms, OpenRouteService keeps each request (with the rounded point) for 7 days to detect abuse and improve its service, and after that only the coordinates rounded to two decimal places (about 1 km). To limit costs we count requests per account for one day, under a code made from your account id. Routes are calculated from OpenStreetMap data. A loop you save is kept on your phone only.
Sharing a workout. When you share a finished workout, the image card is created on your phone and handed to your phone's own share sheet, which sends it to the app or person you pick. Diurnal.ai does not upload the image and keeps no copy of it on our server; once shared, it follows the terms of the app you shared it with.
Apple Health and Health Connect. If you connect them, the app reads only the types you switch on: sleep (the last 30 nights), steps (the last 7 days), resting heart rate and HRV (the last 30 days), workouts with distance, energy and heart rate (the last 30 days) and, only if you track your cycle and switch it on, period days (the last 6 months). Raw samples are never stored. The daily resting heart rate, HRV and step values stay on your phone only, are shown only next to your own 30-day average in the Sport tab (and steps with your meals), are never sent to our server and are never given to Marc. Imported sleep nights join your sleep log and imported workouts join your Sport log (they never replace what you logged yourself), so with your health data consent they are part of the synced copy (section 2) and, with your AI consent, part of what Marc may receive (section 6). Period days only fill empty days of the cycle log on your phone. If you allow it, each workout you record in the app is saved once to Apple Health or Health Connect, where it stays under your control even if you delete your Diurnal.ai account. Disconnecting stops syncing and removes the heart rate, HRV and step values from your phone.
How we treat this data. Information from Apple Health (HealthKit) and Health Connect is used only to provide the features of the app that you use. It is never used for advertising, marketing or data mining, never sold, never used to decide on credit, insurance or employment, and never shared with third parties other than the processors that run these features for you (section 11), OpenAI, pseudonymised, under your AI consent (section 6), and the partner you choose for cycle sharing, whose view can reflect period days read from Apple Health or Health Connect. It is never included in the Help improve Diurnal.ai statistics (section 9). Our staff do not read it. It is not stored in iCloud: the app keeps it in its own storage, which is excluded from iCloud backup (section 15).
Health Connect. The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.
Readiness and tips. Resting heart rate and HRV are shown as plain numbers next to your own average; training tips, stretching suggestions and the caffeine guide are general information computed on your phone, without AI, and are not medical advice.

Sport community (sport friends) and shared trainings

Optional, adults only, free. The Sport community lets you post finished workouts for the sport friends you choose, give them kudos and see how they train. Nothing is shown to anyone until you create a sport profile, and you can only do that after ticking an unticked box with your explicit consent to share this information with the sport friends you accept (section 3). It also needs your health data consent and an account, and it is only for people aged 18 or over: our server creates a sport profile only when it knows you are 18 or over, from your synced profile (year of birth or age) or, if it has neither, from the year of birth the app sends with the request, which is checked and not stored. There are no messages, comments, free-text posts or photos.
Your sport profile. A display name you choose (2 to 30 characters), the sports you pick and the date you joined. Names are checked automatically before they are saved: letters, digits and simple punctuation only, no links, e-mail addresses, phone numbers or long numbers, and no offensive words or names that pass for Diurnal.ai or its staff. Other people see a random profile id, never your account id or e-mail address. You can edit your name and sports at any time.
Sport friends. You get an 8-character friend code. A person who enters it sends you a request, and you decide whether to accept. While a request is waiting, that person sees your display name in their list of sent requests, and you see theirs; nothing else is shown until you accept. If you make a new code, the old one stops working. Friendship is mutual, up to 200 friends.
Posting a workout. You choose each workout to post, and the screen shows exactly what your friends will see before you post it. A post shows the sport, the day, the duration, the distance and climb, and when you posted it. Only if you turn them on (both are off until you do, and the app remembers your choice on your phone only): the exercises (exercises you created yourself appear only as "Own exercise") with the number of sets and your best reps, time or distance, and, with weights on, the top weight of each exercise, the total weight lifted and the number of personal bests. A post never shows heart rate, calories, the route or places, kilometre splits, notes, how hard it felt, the training's name or the names of exercises you created. Our server rebuilds every post from these numbers only and drops anything else.
What your sport friends see. Your display name, sports, the date you joined and since when you are friends; totals counted only from the workouts you posted (workouts in the last 7 and 30 days, minutes in the last 30 days, weeks in a row, kudos received, workouts posted); your last 20 posts; and the trainings you choose to show on your profile, which they can save. Friends can give kudos on a post: everyone who can see the post sees the number of kudos, and only you see who gave them.
Remove, block, report. You can delete a post, or remove a friend (you then stop seeing each other's posts and the kudos between you are removed). Blocking someone also removes the requests and kudos between you both ways; they can no longer find you with your code, send you a request or open your training codes, and they are not told. You can report a person or a post (offensive name, spam or a fake profile, harassment or abuse, or something else), with an optional note of up to 300 characters. The person you report is never told who reported them. A report goes to our team, who review it, usually within 24 hours: it appears in our admin panel, and our team gets an e-mail alert that contains only the report number and the reason. In the app, under Your reports, you see whether each of your last 30 reports is being reviewed, led to action or needed no action. When someone reports you, our team sees your display name, the reported post (the same numbers your friends see), the reason, any note and how many reports concern you, never who reported you and nothing else about you. We may hide a profile, which then disappears for everyone, cannot post and cannot be found by its code, or delete a post. When we hide your profile or remove one of your posts, the app tells you what we did, the reason given in the report (for a removed post, also its sport and day) and how to contest it; it never says who reported you. When we show a hidden profile again, the app tells you that too. If you think we got it wrong, write to support@diurnalapp.ai (Terms, section 5).
No notifications. The community sends no push notifications. New kudos and friend requests appear only inside the app.
Where it is kept. On our server in the EU (Hetzner, Finland), separately from the synced copy of your data. No other company receives it. It is never sent to the AI. How long each part is kept is in section 13.
Stopping. Deleting your sport profile (Sport friends, your profile, Delete sport profile), withdrawing your health data consent or deleting your account withdraws this consent and erases your sport profile, posts, the kudos you gave and received, your sport friends, requests, the blocks you made and every training you shared, with its code. Your workouts stay in the app. Reports you made are kept for review without your name. Reports about you, and blocks other people made against you, are kept for the safety of others as described in section 13 and are deleted when you delete your account. If our team hid your profile, we keep only the date it was hidden, so that a new profile is hidden too, until we lift it or you delete your account.
Sharing a training. You can share a training in three ways. Send as text makes a list of the exercises on your phone and hands it to your phone's share sheet; nothing goes to our server. Share with a code keeps a copy of the training on our server with an 8-character code that works for 30 days: anyone signed in to Diurnal.ai who enters the code sees the training and can save a copy (its name, sport, exercises with sets, reps, weights and rest, set types and, for exercises you created, their name, type, muscles and equipment). The code never shows who shared it, and people you blocked cannot open it. You can stop the code at any time; when it ends, our copy is deleted unless the training is also on your profile. Show on my sport profile lets your sport friends see it and save a copy (this needs a sport profile). Training names and the names of your own exercises go through the same automatic check as display names. Do not put personal or health details in them: whoever has the code sees them. A copy someone saved is theirs, in their app. You can share up to 50 trainings.
Links on our website. A friend invite or a training code can be sent as a link to diurnalapp.ai/f/... or diurnalapp.ai/t/.... These pages only explain the code and open the app: they never contact our app server (they do not load the training or a profile), the code is not counted in our website statistics or written to our web server logs, and search engines are asked not to index them.

Supplement stock, caffeine and lab recheck reminders

Stock counts, refill alerts and your own reorder link are part of your supplement routine, so they are backed up with it under your health data consent. A reorder link is a web address you choose; opening it takes you to that website under its own terms. We place no affiliate links and earn nothing from your purchases.
Timing hints (for example to take iron away from coffee) are worked out on your phone from the times in your routine, as general information.
The caffeine log stays on your phone (the last 30 days). With your AI consent, Marc receives only today's total and the time of your last drink.
Lab recheck reminders stay on your phone. They only remind you to ask your doctor whether to recheck a marker; the app does not judge the value.

Dose alerts for family (caregiver alerts)

For people with their own phone, for example a parent: you can let up to 3 family members check on your doses (Premium, both of you 18 or over). You create a code after giving your explicit consent; the person who enters it sees, for the current day only, the names and times of your supplements and medicines and whether you marked them, and the time of your last update. They never see your meals, sleep, labs, cycle, genetic data or chats.
When a dose is still not marked after the delay they choose (30 minutes to 3 hours, within 3 hours of that, and not between 22:00 and 07:00 your time), our server sends them one notification, for example "Mom has not marked the 08:00 dose yet". The notification names no medicine. Doses paused on period days are left out, because your cycle data never reaches our server.
The check uses the routine and the record of doses you marked that are already in your synced copy (your health data consent). The family member's phone gives our server a push token (a random address for notifications) while they check on someone; it is deleted when they sign out, when the app is removed, after 180 days without use, or with their account. Notifications go through Expo and then Apple or Google, which deliver them.
You can pause or stop at any time in Family, Dose alerts for family; the family member can also stop. Withdrawing your health data consent ends it too. Alerts depend on your phone being online: a dose marked offline reaches our server when it reconnects.

Siri, Shortcuts and Android app shortcuts

On iPhone (iOS 17 or later), Siri, the Shortcuts app, Spotlight and the Action button can mark a supplement of today's routine as taken, mark everything due now, save the words of a meal, or open a workout or a run. Marking supplements and saving a meal work without opening the app: the action waits in the app's own storage on your phone (shared only with the app's widget and shortcuts) and the app applies it the next time it runs. Logging requires an unlocked phone.
Nothing from this path goes to our server or to the AI. A meal said to Siri becomes a draft without calories; the AI estimates it only if you later tap to do so (Premium or your free allowance, and only with your AI consent).
So that you can say "Log magnesium in Diurnal", the names of your routine items for today and tomorrow are shared with iOS on your phone as App Shortcut suggestions. Apple states that it may collect anonymised App Shortcuts data, such as these displayed names, to improve its services. In Anonymous mode no names are shared (Siri offers the time, for example "Everything at 08:00"), and with Anonymous mode or discreet reminders Siri does not say names out loud.
On Android, long-pressing the app icon or asking Google Assistant only opens the matching screen in the app; no data from your routine is shared with Google for this.
Apple (Siri) and Google (Google Assistant) process your voice requests as independent controllers under their own privacy policies (section 11).

Not covered by HIPAA

We are not a health care provider, health plan or clearinghouse, so the US Health Insurance Portability and Accountability Act (HIPAA) does not apply to the data you give us directly. We protect it under this policy and the laws named above, and as a vendor of personal health records we follow the FTC Health Breach Notification Rule (section 15).

6. AI processing: what goes to OpenAI

Marc is an artificial intelligence, not a person. The app tells you so before the first message and marks his replies, in line with article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Diurnal.ai is a general wellness assistant, not a high-risk AI system, and performs no emotion recognition or biometric categorisation.

AI features (chat with Marc, meal photos and text meal estimates, supplement label scans, lab report reading, what lab markers measure, genetic interpretation, weekly reports, workout summaries and the weekly coach note) run on OpenAI (model GPT-4o mini, through the API), always through our server. They work only after you gave the AI consent, which our server checks on every request. What is sent is always pseudonymised, in every mode:

Never sent to any AI provider: your or any family member's name, e-mail, phone number, address, exact date of birth or account id; calendar dates in the chat context (the app uses relative days such as "yesterday" or "3 days ago"); raw DNA files, variant identifiers and genotypes in the chat context; the location or other metadata of photos (removed on your phone); GPS tracks, routes and places; the daily resting heart rate, HRV and step values from Apple Health or Health Connect; lab recheck reminders.
Always pseudonymised: your age as a 5-year range (for example 35-39), weight rounded to the nearest 5 kg and height to the nearest 5 cm; family members aged 16 or over only as relation and age range (for example "parent, 60-69"), and nothing at all about children under 16; free text in the chat (notes, meal hints, your messages) is cleaned on your phone of e-mail addresses, phone numbers, national ID numbers, bank and card numbers and links with personal parameters.
Sent after your AI consent: sex, age range, rounded weight and height, calorie target, goal, allergies, smoking and alcohol (yes or no), supplements and routine, your availability, meals, sleep and mood check-ins (with relative days), your recent training (the sports you practise and the workouts of the last 7 days as relative days: sport, minutes, effort, distance, average heart rate rounded to 5, exercises with sets and weights, including workouts imported from Apple Health or Health Connect), today's caffeine total with the time of your last drink, the last messages of the conversation and photos you attach; and, only if you tick them (on the AI consent screen or in Settings under "What Marc can use", all off by default): a short cycle summary, your latest lab values without the lab, the date or identifiers, Marc's memory notes (written without names, contact details, dates of birth or addresses), and your genetic summary (also only with the separate genetic consent).
Lab report photos or PDFs you ask the app to read are sent whole, because the AI has to read the document. The app reminds you before upload: cover or crop your name, ID number and address first (you can crop photos in the app). The AI is instructed never to return names, ID numbers, dates of birth, addresses or doctor or lab names, and these requests carry their own pseudonymous id, separate from your other requests.
Lab results are not interpreted. "What do these markers measure?" sends only the names of the markers, never your values, and returns a general description of each. Comparing two reports happens on your phone from the numbers and the lab's printed ranges, without any AI.
Our server masks, as a second safeguard, e-mail addresses, phone numbers, national ID numbers (such as the Romanian CNP), IBANs, card numbers and links with query strings in all text before it reaches OpenAI, and applies safety rules to every request (emergencies, prescription medicines, pregnancy, breastfeeding, people under 18, upper intake limits, disordered eating).
Requests are sent with storage disabled (store: false), so they are not kept in OpenAI's own tools, and with a pseudonymous per-user id (a salted hash, not your account id) that lets OpenAI detect abuse without knowing who you are. Our server does not log the content of AI requests or answers.
Under OpenAI's API terms and our Data Processing Addendum with OpenAI, this data is not used to train AI models and is kept by OpenAI for up to 30 days for abuse monitoring, then deleted.
Anonymous mode (Settings) additionally keeps your lab values, genetic summary, Marc's memory, your cycle and the notes about family members away from the AI, keeps the conversations you have in that mode on your phone (never synced or remembered), makes reminders discreet and turns usage statistics off.
Workout summary (Premium, when you ask for it on a finished workout): that workout in detail (sport, duration, effort, distance, kilometre splits, climb, average heart rate, each exercise with its sets and your earlier best, and the note you wrote on it), with this week's number of workouts, minutes and load. No dates, places or routes. Before it leaves your phone, the app removes the names of the people in your family, e-mail addresses and phone numbers from the note and from the names of exercises you created; our server also masks contact details and ID numbers. The summary is saved with the workout.
Weekly coach note (Premium, when you ask for it in the Sport tab): your sports and goal, the totals of the last 7 days and of the 7 days before (workouts, minutes, load, volume, distance), hard sets per muscle group and your average sleep of the last 7 nights. The note is kept on your phone.
Workouts proposed in chat: Marc can suggest a workout; it is saved as a training only if you tap to save it.
Weekly report (Premium): built on your phone from the week's supplements, meals, sleep and mood, labelled "Day 1" to "Day 7" instead of dates; lab results and genetic findings are included only if you switch them on in the report screen (both off by default), and the report only says which values are outside the lab's range, never what they mean. The report says it was written by an AI, in the app and in the PDF, which is made on your phone.
AI output can be wrong. It is general information, not medical advice (see the Medical and AI Disclaimer). To report an answer, press and hold it in the chat, or tap "Report this AI answer" under any AI result (section 8).

Using your own AI account (optional)

In Settings you can connect the chat to your own account with OpenAI, Anthropic or Google, using an API key you supply. The chat then goes directly from your phone to that company, under your key and its privacy terms, pseudonymised in the same way: the last 8 messages (cleaned of names and contact details, including Marc's earlier answers in that conversation) and any photo you attach, plus sex, age range, rounded weight and height, goal, calorie target, allergies, smoking and alcohol (yes or no), routine, availability, meals, sleep, your recent training and today's caffeine. Lab results, genetic findings, Marc's memory notes and cycle data are never sent to it, and those chats are not added to Marc's memory. The key is stored only in your phone's secure keychain and never sent to our server.

External assistants

Connecting external assistants (such as ChatGPT or Claude) to your Diurnal.ai data is not currently offered. If we offer it again, we will update this policy first.

7. Staff access and the admin panel

Our admin panel shows, for each account, only what support and billing need: name, e-mail, plan, sign-up and last-active dates, device model, app language, which consents are given, counts (routines, family members, meals, conversations) and adherence percentages, family members only by relation, your support reports and, if you opted in, your app usage events. It does not show your conversations, Marc's memory notes, body measurements, allergies, meals, family members' names or your check-in answers. Every time a staff member opens or changes an account, it is written to an access log kept for 24 months. The admin panel requires a password and a one-time code from an authenticator app (each code works once), can be limited to approved networks, and signs staff out after 8 hours or at once when they log out.

Sport community. To moderate the community, the admin panel shows counts (sport profiles, posts and kudos in the last 30 days, friendships, shared trainings, open reports) and, for each report, the reason and note, the reported person's display name and how many reports concern them, and the reported post (the same numbers their friends see). It never shows who made a report. Opening this view and every moderation action (dismissing a report, hiding or showing a profile again, deleting a post) are written to the access log.

Training insights. For the people who turned on Help improve Diurnal.ai, the admin panel shows statistics only for groups of at least 5 people (section 9): never a name, account, single workout, exact age, height or weight. Each time a staff member opens this view, it is written to the access log.

No one at PUREQUAD reads your conversations or health data as part of running the service. The database itself is not publicly reachable; only authorised technical staff, bound by confidentiality, can access it, and only when needed to keep the service running, investigate a security incident, act on your request, or comply with the law.

8. Support requests and reported answers

When you send a report from the app's Help and feedback screen, we store your message, the screenshots you choose to add, the app version, phone model, platform and language, and your name, e-mail and account, so we can reply. Please leave health details out, unless you tick the box on the report that you explicitly consent to their processing to answer you. Screenshots can show health information; add only what you want us to see. Reports are kept for 24 months. There is a daily limit on reports and screenshots per account.
When you use "Report this AI answer", the report also contains that AI text (with contact details and ID numbers masked), so we can review it and improve the safety rules. You can also report a message a partner shared with you.
To spot common problems, our team can ask the AI to group open reports. Only reports whose author ticked the optional "AI summary" box on that report are included, only their text, with e-mail addresses, phone numbers and ID numbers masked; never names, e-mail addresses, screenshots or reported AI answers. The summaries contain no names and are kept 12 months.

9. App usage statistics

Only if you switch on "Share anonymous app usage statistics" (off by default; change it any time in Settings), the app sends us which screens you open and for how long, generic actions (for example "meal added", never what the meal was) and the names of app errors, linked to your account, so we can fix problems and improve the app. Screens in health areas are reported only as "health" and health events are never stored. In the Sport tab, the app also records which Sport features you use (for example starting a workout, adding a superset or sharing a workout, and in the Sport community joining, posting, giving kudos, adding a friend, reporting with the reason chosen or sharing a training), with the sport type, counts such as the number of exercises or sets, and the duration only in rough bands (for example "30 to 60 minutes"). It never records weights, heart rate, routes or locations, your notes or anything you type, and never names or codes. Our server discards these events if your consent is not on record. Nothing is sent in Anonymous mode. Events are kept for 13 months.

Help improve Diurnal.ai (training insights)

Optional and off by default. A separate switch in Settings, Health data consent, "Help improve Diurnal.ai", with its own explicit consent text. It needs the health data consent. Saying no, or turning it off later, changes nothing else in the app.
What is counted. From the workouts you record in the app: the sports, the exercises (only the app's own exercises, never the names of exercises you created), how often and how long you train, your weekly goal, and whether a training came from a suggestion or from Marc. From your own profile: an age range (for example 30 to 39), your sex, goal and activity level, and a range worked out from your height and weight (for example 18.5 to 24.9). It uses the copy already on our server under your health data consent; nothing new is collected from your phone.
Never counted. Workouts or any other data imported from Apple Health or Health Connect; your name, notes, training names, heart rate, sleep, meals, labs, cycle, genetic data, conversations or family members.
Groups of at least 5 people. Our team sees only statistics in which every number comes from at least 5 different people; smaller groups are hidden. It never sees you, a single workout or your exact age, height or weight.
Not stored. The statistics are calculated when our team opens them and are not saved. When you turn the switch off, or withdraw the health data consent, you are left out of the next calculation.
Who sees it. Only the Diurnal.ai team, in the admin panel; every opening is written to the access log (section 7). No other company receives it, no AI is used, and it is never sold or used for advertising or to make decisions about anyone.
Legal basis. Your explicit consent (GDPR art. 9(2)(a) and art. 6(1)(a)), which you can withdraw at any time with the same switch.

10. Website, newsletter and cookies

The diurnalapp.ai website sets no cookies for analytics or advertising. It keeps one strictly necessary item of browser storage to remember your cookie choice. Fonts and images are served from our own server; the site loads nothing from third-party hosts.
We count visits without cookies: page path, referring site and device type, with a code made from your IP address and browser type using a random key that exists only in our server's memory and is replaced every day, so after that day nobody, including us, can link a visit to you; the IP address itself is not stored. Nothing is counted when your browser sends Global Privacy Control. Counts are kept 25 months.
Our web servers keep technical request logs (time, page, status) without your IP address.
Newsletter (double opt-in): when you enter your e-mail address, it is stored as pending and we send a confirmation e-mail. You are subscribed only after you click the link in it; unconfirmed addresses are deleted after 30 days. Addresses collected before we introduced confirmation receive one confirmation request and get no newsletter unless they confirm. Every newsletter contains an unsubscribe link and our postal address; confirming and unsubscribing both need one tap on a button, so a link opened by a mail scanner changes nothing. Unsubscribing deletes your address. Brevo sends the e-mails for us.
Details, and how to change your choice, are in the Cookie Policy.

11. Who receives data

Processors acting on our instructions under data processing agreements:

OpenAI (our contract is with OpenAI Ireland Ltd; processing in the USA by OpenAI, L.L.C.): AI processing as described in section 6, only after your AI consent.
Hetzner Online GmbH (data centre in Helsinki, Finland, EU): hosting of our server and database.
Brevo (Sendinblue SAS, France, EU): account e-mails, the newsletter, and the security alerts sent to our own team (these can contain an IP address or account id).
RevenueCat, Inc. (USA): subscription management. It receives your random account id (not your name, e-mail or health data) and the purchase receipt from Apple or Google; our server asks it whether your subscription is active.
GoDaddy (USA): hosting of our support mailbox, support@diurnalapp.ai. It receives what you write to us by e-mail.
Expo (650 Industries, Inc., USA): delivers the caregiver dose alerts (the push token of the family member's phone and the notification text, which names no medicine) to Apple Push Notification service or Firebase Cloud Messaging.

Other recipients:

People you choose: the partner account you share your cycle snapshot with, the family members who check on your doses (section 5), family members and friends you connect with in the app, the sport friends you accept (your sport profile, the workouts you post and the trainings you show), and anyone who enters a training code you share (the training, without your name).
Apple and Google, as independent controllers under their own privacy policies, when you use the App Store, Google Play, in-app purchases, Sign in with Apple or Google sign-in, and for the app integrity check. Also: Apple Maps (iPhone) and Google Maps (Android, when the app version includes it) load the maps in the Sport tab directly on your phone, so they receive your IP address and the area shown; Siri and Google Assistant process your voice requests when you use voice shortcuts (the app receives only the result, for example which supplement to log), and on iPhone iOS receives the names of your routine items as shortcut suggestions, except in Anonymous mode (section 5); and Apple Health and Health Connect keep the health data on your phone that you allow the app to read, and the workouts you allow it to save there.
HeiGIT gGmbH (OpenRouteService, Heidelberg, Germany, EU), only when you ask for suggested loops (Premium): it receives from our server the approximate starting point (rounded to about 100 m), the distance and the type of activity, without your account id or IP address, calculates the loops and, under its own terms, keeps the request for 7 days and then only coordinates rounded to about 1 km (section 5).
An AI provider you connect with your own key (section 6), under its own terms.
Professional advisers under confidentiality, and public authorities where the law requires it.

We do not sell personal data and we do not share it for cross-context behavioural advertising. If PUREQUAD SRL is ever merged or acquired, your data would be transferred under the same protections and you would be told in advance.

12. International transfers

Our server and database are in the European Union (Hetzner, Finland), and our e-mail provider Brevo is in the EU. OpenRouteService (HeiGIT), which calculates suggested loops, is in Germany. OpenAI, RevenueCat, Expo (notification delivery) and GoDaddy (our support mailbox) process data in the United States: transfers to them are made under their data processing agreements with the European Commission's Standard Contractual Clauses (and the UK addendum), and, where the provider is certified, the EU-US Data Privacy Framework, together with supplementary measures such as encryption in transit and the pseudonymisation described in section 6. You can ask us for a copy of the relevant safeguards.

13. Retention

Data	Kept for
Data on your phone (everything you enter, including lab results, genetic panel, cycle log, Sport data, GPS tracks and saved routes)	Until you delete it, sign out, use Delete all data or remove the app.
Daily resting heart rate and HRV, and daily steps, read from Apple Health or Health Connect (on your phone only)	The last 30 days (steps: 7 days); removed when you disconnect, sign out or delete your account.
Caffeine log (on your phone only)	The last 30 days.
Lab recheck reminders (on your phone only)	Until the reminder date passes or you delete them.
Workouts in the synced copy	The last 365 days, at most 400 workouts (older ones stay only on your phone); erased with the synced copy.
Starting point of a suggested loop	Not stored by us. A count of your loop requests, kept under a code made from your account id, is deleted within two days. OpenRouteService keeps the request for 7 days, then only the coordinates rounded to about 1 km.
Account and the synced copy on our server (section 2)	Until you withdraw the health data consent (the synced copy is erased) or delete your account.
Goal and mood check-in answers	Until you withdraw the health data consent or delete your account.
Guest accounts (no password, Google or Apple sign-in) not opened for 24 months	Deleted with everything linked to them.
Friend requests (they hold the invited person's e-mail)	Deleted 30 days after they are answered; unanswered ones after 90 days.
Friends (your friend list)	Until either of you removes the other, or one of you deletes the account. Stopping cycle sharing does not remove the friend.
Consent records and their history	Until you delete your account.
Sport profile (display name, sports, friend code)	Until you delete it, withdraw the Sport community or health data consent, or delete your account.
Workouts posted to sport friends (with their kudos)	Deleted automatically 365 days after you posted them; earlier if you delete the post or your sport profile.
Sport friend requests	Until answered; deleted after 30 days at the latest.
Sport friends and blocks	Until either of you removes or blocks the other, you unblock, or your sport profile is deleted. A block someone made against you stays until they unblock you or you delete your account.
Reports in the Sport community	Open reports until we resolve them, then 180 days. Your name is removed from reports you made when you delete your sport profile or account; reports about you are deleted with your account.
Moderation record (only the date your sport profile was hidden)	Until we lift it or you delete your account.
Notices to you about a moderation decision (what we did, the reason category and, for a removed post, its sport and day)	180 days after we made the decision, even if you delete your sport profile; deleted with your account.
Training shared with a code	The code works for 30 days or until you stop it; our copy is then deleted, unless the training is also on your sport profile.
Trainings shown on your sport profile	Until you stop showing them or delete your sport profile.
Help improve Diurnal.ai statistics	Not stored: calculated each time our team opens them, from the copy already on our server.
Partner sharing snapshot (with the estimates for the next 45 days, replaced at each update)	Until you stop sharing; a paused snapshot is deleted after 30 days.
Dose alerts for family: the link between you	Until either of you stops it, the consent is withdrawn or an account is deleted; an unused code expires after 24 hours.
Record of the dose alerts sent (so each missed dose is announced once)	30 days.
Push token of a phone that checks on someone	Until sign-out, removal of the app, 180 days without use, or account deletion.
App usage events (only with your opt-in)	13 months.
Website visit counts (cookieless, no IP stored)	25 months.
Security events (with IP address)	30 days.
Internal security alerts to our team (they can contain an IP address or account id)	30 days.
Server request logs (method, page, status and time, no IP address)	Rotated automatically after about 50 MB of logs.
Record of account e-mails sent (hashed address, type, time), for rate limiting	30 days.
Support reports and screenshots	24 months.
Staff access log (which staff member opened or changed which account, and when)	24 months. When you delete your account, its entries no longer name your account.
AI summaries of support reports (no names)	12 months.
Database backups on our EU server	Made daily, readable only by the server administrator, each deleted after 30 days.
Actions an assistant proposed and you applied	90 days after they were applied.
AI usage counters	Weekly, daily and monthly counters about 2 months; lifetime allowance counters until you delete your account.
Revenue records from the stores	As long as tax and accounting law requires (in Romania, generally 10 years). When you delete your account they are kept only without your account id or other personal details.
Newsletter address	Until you unsubscribe (it is then deleted at once); unconfirmed sign-ups are deleted after 30 days.
E-mails you send us	Up to 24 months after the matter is closed.
Photos and documents you ask the AI to read	Not stored on our server; OpenAI keeps them up to 30 days for abuse monitoring.
Website cookie choice	6 months, in your browser.

14. Export and deletion

Export: Settings → Export data gives you a machine-readable file with everything on your phone (including your Sport data, GPS tracks and saved routes, the values read from Apple Health or Health Connect, the caffeine log and lab recheck reminders) and everything our server holds about your account: account details, consents and their history, the synced copy, support reports, app usage events, check-ins, AI usage counters, friend requests sent and received, your friends, your partner sharing, promo codes you redeemed, security events about your account and the list of times our staff opened your account, and your Sport community data (your sport profile, posts, kudos given and received, sport friends, requests, the people you blocked, shared trainings, the reports you made and the notices about moderation decisions on your profile or posts). Your Help improve Diurnal.ai choice and the record of each Apple Health or Health Connect connection are part of the consent history; the statistics themselves are not stored, so there is nothing else about you to export.
Delete: Settings → Delete account and all data permanently erases your data from your phone (including meal photos, lab pages and PDFs the app kept, GPS tracks and saved routes) and, immediately, your account and every record about you on our server: the synced copy, consents, check-ins, usage events, support reports and screenshots, security events, AI counters, promo code redemptions, friend requests, your friend links, your newsletter entry, your partner sharing, your Sport community data and shared trainings (including reports about you, blocks against you and moderation notices; reports you made stay, without your name), your customer record at RevenueCat, and your Sign in with Apple link with Apple. The staff access log keeps what was done, no longer to which account. Revenue records are kept only without your account id or other personal details, as accounting law requires. Deleting does not cancel a store subscription: cancel it in your App Store or Google Play subscriptions.
Without the app: e-mail us from the address on your account; see Delete your account for the steps and timing.
Signing out removes your data from that phone only and keeps your account.
Workouts the app saved to Apple Health or Health Connect, with your permission, stay there until you delete them in Apple Health or Health Connect.
Copies in our daily database backups are deleted within 30 days.

15. Security, device backups and breaches

Data in transit is encrypted (HTTPS/TLS). Account tokens and your own AI keys are kept in your phone's secure keychain, only on that phone; passwords are stored only as salted hashes; ten wrong passwords from the same network lock sign-in to that account from that network for 15 minutes; sessions of password, Google and Apple accounts end after 180 days without use, and a password reset or e-mail change ends every session. The database is not publicly reachable, and staff access is limited and logged (section 7). No system is perfectly secure, so please keep your phone and password safe.

Device backups. On Android, the app's data is excluded from Android cloud backup. On iPhone, the app marks its data (including lab results, the genetic panel and the cycle log) and its meal photos as excluded from iCloud backup, starting with the version released after 30 September 2026. This includes your Sport data, what the app reads from Apple Health and the GPS tracks of your recordings. Backups made to a computer, or made by an older version, are controlled by you and Apple, and we have no access to them. The app also hides its screen in the app switcher, and can show reminders without any medicine or family names (Settings, "Discreet reminders").

If a personal data breach is likely to put your rights at risk we will tell you without undue delay and notify the competent supervisory authority within 72 hours, as the GDPR requires. For US users, we follow the FTC Health Breach Notification Rule (notice to affected individuals and to the FTC within 60 days of discovery, and to prominent media where more than 500 residents of a state are affected) and applicable state breach laws.

16. Age, children and family profiles

You must be 18 or older to use Diurnal.ai. The app asks for your year of birth first, before any other question or consent, and cannot be set up for anyone younger (the answer does not say why, and the question stays closed on that phone for a day). We do not knowingly collect personal data directly from anyone under 18 (including children under 13 in the United States, in line with COPPA); if we learn that we have, we delete it. Partner sharing, dose alerts for family and the Sport community are for adults only; besides the age question, our server refuses them to an account whose profile shows an age under 18, and it creates a sport profile only when it knows you are 18 or over.

Profiles you create for other people are entered and managed by you, the adult account holder. When you add a child, you confirm that you are their parent or legal guardian; when you add an adult, you confirm that they know and agreed. Each confirmation is recorded with its date and the (random) id of that profile. We process that information only to run their routine and reminders for you. Nothing about a child under 16 is ever sent to the AI. For family members aged 16 or over, the AI receives only relation and age range (for example "parent, 60-69"), with their routine, allergies, food preferences and your notes, never their name; notes are cleaned of contact details and ID numbers and are left out in Anonymous mode. Marc never suggests a new supplement for anyone under 18. Marc's help for such a person never uses your own health data. You can delete a family profile at any time.

Family plan. The person who pays for a Family plan (the owner) can invite up to 5 other people with single-use codes that are valid for 7 days (we store only a keyed hash of each code). Each member uses their own Diurnal.ai account, with their own data, which the owner never sees. The owner sees each member's name, a shortened e-mail address (for example "a***@example.com") and the date they joined; members see the owner's name. The owner can remove a member and a member can leave at any time; deleting either account ends the link. A member's Premium lasts while the owner's Family subscription is active.

17. Your rights (GDPR and UK GDPR)

Access your data and receive a copy (Settings → Export data, or ask us).
Rectify anything inaccurate (edit it in the app, or ask us).
Erase your data (Settings → Delete all data, or ask us).
Restrict or object to processing based on legitimate interests.
Data portability: the export is a machine-readable file.
Withdraw consent at any time in Settings (section 3), or by unsubscribing from the newsletter.
Not be subject to automated decisions with legal or similarly significant effects (we make none, section 19).
Complain to a supervisory authority (section 22).

We answer within one month (extendable by two months for complex requests, and we will tell you). Requests are free unless manifestly unfounded or excessive. To protect your data we may ask you to confirm the request from the e-mail address on the account or from within the app.

18. US residents: CCPA/CPRA and state law notices

This section is our notice at collection and privacy notice for residents of California and of the other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota and Rhode Island), to the extent those laws apply to us.

Categories collected in the last 12 months, sources, purposes and disclosures

Category	Examples	Source	Disclosed to (business purpose only)
Identifiers	Name, e-mail, account id, device model, IP address (security logs only)	You; your device	Hosting and e-mail processors; subscription processor (random account id only)
Personal characteristics	Year of birth, sex	You	AI processor, as an age range, after your consent
Commercial information	Plan and status, promo codes	You; Apple and Google via RevenueCat	Subscription processor
Internet or app activity	Last activity time, AI request counts, usage events (only with your opt-in)	Your device	Hosting processor
Sensitive personal information	Health data (including workouts with heart rate), genetic data (on your phone only), cycle data (on your phone only), account credentials	You; Apple Health or Health Connect if you connect them	AI processor (pseudonymised, only after your consent, section 6); hosting processor (the synced copy, only with your health data consent); a partner you choose (cycle snapshot); the sport friends you accept (workouts you post, numbers only, with your Sport community consent)
Precise geolocation (sensitive personal information)	Your position during a recording (kept on your phone only); the starting point of suggested loops, rounded to about 100 m (not stored)	Your device	OpenRouteService (HeiGIT), the rounded starting point only, without any identifier
Inferences	Calorie target, reference intakes, weekly report ratings, training load and personal bests	Computed from your data	Hosting processor

We use sensitive personal information only to provide the features you request, to keep the service secure and to comply with law, which are the purposes permitted without an opt-out under the CPRA; you may still ask us to limit its use. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. We do not use personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects.

Your rights

To know and access the personal information we hold, including the categories, sources, purposes and recipients, and to receive it in a portable format.
To correct inaccurate personal information.
To delete personal information, subject to legal exceptions.
To opt out of sale, sharing, targeted advertising and profiling. We do none of these; the "Do Not Sell or Share My Personal Information" and "Cookie settings" links in the website footer record your opt-out for the future. We honour the Global Privacy Control browser signal as a valid opt-out.
To limit the use of sensitive personal information.
To non-discrimination: exercising your rights never changes the price or quality of the service.
To appeal a decision we make on your request (Virginia, Colorado, Connecticut and other states): reply to our answer within 30 days and say you appeal; a different person will review it and answer within 45 days; if we still refuse, we will tell you how to contact your state attorney general.

Submit requests to support@diurnalapp.ai or use the in-app tools. We verify requests by matching the e-mail on the account or by asking you to confirm from within the app; an authorised agent may act for you with your written permission, and we may still ask you to confirm. We respond within 45 days (extendable once by 45 days with notice). California residents may request our "Shine the Light" disclosure (Civil Code section 1798.83): we do not disclose personal information to third parties for their direct marketing.

Consumer health data (Washington, Nevada, Connecticut)

Residents of Washington, Nevada and Connecticut have additional rights for consumer health data, including to withdraw consent and to obtain a list of the third parties with whom such data was shared. See the Consumer Health Data Privacy Policy. We never use geofencing around health facilities. California's Confidentiality of Medical Information Act (CMIA) also applies to medical information you enter into the app: we treat it as confidential and disclose it only as described here.

19. Automated decision-making

We make no decisions about you by automated means that have legal or similarly significant effects. The app computes a calorie target and reference daily intakes from the body data you enter (Mifflin-St Jeor formula and published EFSA and NIH reference values) and, on your phone, training load, personal bests, timing hints and caffeine reference amounts; Marc's answers, weekly reports, workout summaries and coach notes are generated by AI from your data; these are suggestions you can ignore, edit or delete, and nothing is applied to your routine until you accept it. In the Sport community, an automatic check refuses display names and training or exercise names with links, contact details or offensive words, and asks you to choose other words; reports are decided by a person, not by an algorithm. The Help improve Diurnal.ai statistics describe groups of at least 5 people and are never used to make decisions about anyone. No profiling is used for advertising.

20. Other disclosures

Do Not Track. Because there is no standard, we do not respond to browser "Do Not Track" signals, but we do honour Global Privacy Control, and in any case we do not track you across sites.
Legal requests. We disclose data to authorities only when legally compelled by valid legal process, disclose no more than required and, unless the law forbids it, tell you first. We challenge requests we believe are unlawful, including requests from outside a person's own state or country that seek reproductive health information to investigate lawful care.
Third-party links and stores. The App Store, Google Play, Google sign-in, Sign in with Apple, Apple Health, Health Connect, Apple Maps, Google Maps, Siri, Google Assistant, reorder links you add and links to other sites are governed by their own policies.
Languages. The app is offered in several languages; this policy is written in English and governs in case of doubt.

21. Changes

If this policy changes materially, we will notify you in the app (and by e-mail if you have an account) before the change takes effect, and ask for your consent again where the law requires it. The latest version always lives at this address; the date at the top tells you when it last changed.

22. Contact and complaints

PUREQUAD SRL (company details in section 1). E-mail: support@diurnalapp.ai. Privacy contact: support@diurnalapp.ai, subject "Data protection". Complaints about how we handle your data can be sent to the same address: we acknowledge them within 30 days and answer without undue delay (this is also how UK users can complain to us under the UK Data (Use and Access) Act 2025).

You may lodge a complaint with a supervisory authority. Our lead authority is the Romanian ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, dataprotection.ro). You can also complain in the EU or EEA country where you live or work (list of authorities at edpb.europa.eu), in the United Kingdom to the ICO (ico.org.uk), in Switzerland to the FDPIC, and in the United States to the Federal Trade Commission (reportfraud.ftc.gov) or your state attorney general. We would appreciate the chance to resolve any concern with you first.