Privacy

Daybook is a shared book of a small business's daily takings, expenses and profit. Several people in one organisation write in the same book.

• Two kinds of information are held: a few details about you as a person, and everything your organisation types into its book.
• It is stored in a PostgreSQL database run by Supabase in Frankfurt, Germany. Business data never leaves that database.
• There is no analytics, no tracking, no advertising and no third-party script of any kind.
• Only the members of your organisation can read its book, and only as far as their role allows. The database enforces that, not the buttons on screen.
• An owner can export the whole book as a JSON file, and can delete all of it, from Settings → Data.

Daybook is operated by 6x7, Gronjordsvej 1, 2300 Copenhagen, Denmark. For anything in this policy, write to daybook@6x7.gr.

There are two roles here and they are worth keeping apart. The organisation that keeps a book decides what goes into it and who may see it — in the language of the GDPR the organisation is the controller of its own book, and 6x7 only processes it on the organisation's behalf. For the account itself — your name, your email address, the way you sign in — 6x7 is the controller.

About you as a person:

• Your display name.
• Your email address.
• Your profile photo: a URL from Google if you signed in with Google, or an image you uploaded, which is stored in Supabase Storage.
• Your preferred language.
• Which organisations you belong to, with what role and which permissions.
• Your conversations with the assistant, if you keep them in your account — see “The assistant's saved conversations” below.

About the business, which is whatever the people in the organisation type in:

• Register closings — cash and card, per shift, with an optional count of the drawer.
• Expenses, withdrawals, and purchases from suppliers.
• Obligations: cheques and supplier invoices, with their dates.
• Claims — money billed to a third party and collected later — if the organisation has that module switched on. It is off by default.
• A record of who filed what and when, which is what the Activity screen shows.

If you set a password, Supabase hashes it before storing it. The application never stores or sees a plaintext password. Nothing else is collected: no location, no device fingerprint, no contact list, no advertising identifier.

Vercel

The app itself — the pages, and the code that runs in your browser — is served by Vercel.

Supabase — Frankfurt, Germany

The database and the sign-in system: PostgreSQL, in the eu-central-1 region. Every figure typed into a book lives here, and business data never leaves this database.

Resend — Ireland

Email delivery, in Resend's EU region: sign-in links, password resets and invitations. Resend handles delivery only — it carries the message and the address it is going to.

Google — only if you use it

If you press Sign in with Google, Google receives the sign-in request, and the app receives your email address, your name and a URL for your profile photo. If you never press that button, Google is not involved at all.

There is none of it. No analytics product, no tag manager, no advertising pixel, no session recorder, no third-party script of any kind. Open the network panel of your browser while you use Daybook and you will see it talking to Supabase and to nothing else.

Nothing is sold, rented or handed to anybody for marketing. There is no profiling, no advertising audience, and no automated decision-making about anyone.

There are two, and this is both of them:

• The Supabase session cookies, which are what keep you signed in. They are httpOnly, so no script on the page can read them.
• One preference cookie, daybook_org, remembering which organisation is on screen.

There are no tracking cookies and no advertising cookies. Because the two above are strictly necessary for signing in and using the app, there is no consent banner to click past.

Your choice of light or dark is remembered by the browser on your own device rather than in a cookie. So is your language, which is also saved to your profile so that it follows you to another device.

Daybook can be installed on a phone or a computer like an app. When it is, a service worker caches static assets and icons — the stylesheet, the fonts, the icons. It never caches a page, an API response, or anything belonging to a signed-in person.

Offline it can show you an offline page and nothing more. It does not keep a copy of the book on the device and it does not queue entries written while disconnected. What is typed with the connection down is not saved.

Inside a book there is an assistant you can ask about the figures or tell to record something. You choose where your conversations with it are kept, in the assistant's settings, on the Data tab:

Save to my account — the default

Your conversations are stored in the same Supabase database in Frankfurt, linked to your account, so they are there on any device you sign in on. They are yours alone: no other member of your organisation, its owner included, can read them. The database enforces that with row-level security.

Save on this device

Your conversations stay in this browser's local storage, kept separately for each person who signs in on it, and are not sent to your account.

Don't save

Nothing is kept once you reload or close the page.

Conversations saved to your account are deleted automatically after 12 months without activity. You can delete one conversation from the assistant's list of chats, or all of yours at once with “Delete all my chats” on the same Data tab. Closing your account deletes them too.

Only the people in it. Each member has a role — Owner, Admin, Cashier or Viewer — with permission checkboxes on top of it.

A cashier, for instance, can file today's register and see today, and nothing else: no history, no months, no profit, no expenses. That is not a matter of hiding buttons. It is enforced by PostgreSQL row-level security, which means the database itself refuses to hand over rows a person is not entitled to, whatever the app asks it for.

One organisation can never see another's book, and nobody outside your organisation is given access to yours. The people who run the service can reach the database in order to keep it running and to fix it when it breaks; that access exists to keep the service working, not to read anybody's takings.

Until the people who entered it delete it. Nothing in a book expires on its own and nothing in it is deleted on a schedule. The one exception is the assistant's saved conversations, described above, which are deleted after 12 months without activity.

An owner can export the whole book as a JSON file from Settings → Data, and can delete all of it from the same screen. Deleting it removes it from the database. If you need a deletion confirmed in writing, ask at daybook@6x7.gr.

If you leave an organisation, what you filed stays in its book. It is the business's record of its own trading, not yours to take away.

If you are in the EU or the EEA, the GDPR gives you the following. Most of them you can exercise yourself, in the app, without asking anybody.

See what is held (access)

Sign in and the book is on screen. An owner can export the whole thing as JSON from Settings → Data. For your account details, ask at daybook@6x7.gr.

Correct it (rectification)

Change your name, photo and language in your own settings, and correct an entry in the book wherever your permissions allow it. For anything you cannot reach yourself, write to daybook@6x7.gr.

Delete it (erasure)

An owner can delete an organisation's book from Settings → Data. To close your own account and remove your personal details, write to daybook@6x7.gr.

Take it elsewhere (portability)

The JSON export is a machine-readable copy of the whole book.

Restrict or object

Write to daybook@6x7.gr saying what you want stopped, and why.

Withdraw consent

If you signed in with Google you can stop doing so and sign in with a password or an emailed link instead.

Complain

You can complain to the data-protection authority where you live or work. For the operator of this service that is Hellenic Data Protection Authority (https://www.dpa.gr/).

Requests are answered within one month. One caveat, said plainly: a line in a book is a record of a business's own trading, and the business may be required to keep it for its own bookkeeping. A request to erase such a line can be refused by the organisation that keeps the book — that decision is the organisation's to make, not ours.

Daybook is for people running a business. It is not meant for children and holds nothing for them. Do not create an account if you are under 16, and do not invite anybody under 16 into an organisation. If we learn that an account belongs to a child, it will be removed.

When this policy changes, the date at the top of the page changes with it. A change that materially affects what is collected, where it is kept or who it goes to will be announced in the app before it takes effect and, where it matters, by email to the owner of each organisation. The text on this page is always the one in force.

6x7, Gronjordsvej 1, 2300 Copenhagen, Denmark. Data-protection questions and requests: daybook@6x7.gr. Anything else: daybook@6x7.gr.