Privacy Policy

Last updated: 2026-08-22

jeden.day is a personal habit tracker. This policy explains what personal data the service processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Michael von Bothmer, Süsterfeldstr. 83A, 52072 Aachen, Germany — email: mail@jeden.day.

2. What data is processed

Account data. Your email address (used to identify your account and to send sign-in and confirmation links), the date your account was created, the record of your consent (when you gave it and which version of these texts you agreed to), and — if you register passkeys — passkey metadata such as a label and usage timestamps. Passkeys never give the service access to your device or biometrics; only a public key is stored.

Habit data. The habits you create (names, schedules, targets) and the daily entries you record. This content is yours: it is stored to show you your own tracker and is not analysed, profiled, or shared.

Technical data. Server logs and short-lived, in-memory rate-limit counters contain IP addresses to keep the service running and to prevent abuse. Logs are kept for 14 days.

Guest mode. Without an account, your data is stored only in your own browser and never reaches the server. It is transmitted once — and only — if you sign in and explicitly import it.

3. Purposes and legal bases

Account and habit data are processed to provide the service you signed up for (Art. 6(1)(b) GDPR). Technical logs and rate limiting rest on the legitimate interest of operating the service securely (Art. 6(1)(f) GDPR). Where your habit content amounts to special-category data, processing rests on your explicit consent (Art. 9(2)(a) GDPR), given by ticking the box on the sign-in form. That consent is stored with a timestamp and the version of these texts it applied to, and it is part of your data export. You can withdraw it at any time by deleting the data or your account.

4. Sensitive content

Habit names and entries are free text and may reveal sensitive information — for example about your health ("take medication") or beliefs. Whether to record such content is entirely your choice. It is processed exclusively to render your own tracker, is never evaluated for any other purpose, and is never shared.

5. Recipients

Sign-in and confirmation emails are delivered via Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France (Transactional Email, EU infrastructure). The service is hosted on a server rented from netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, and database backups are stored with Scaleway (Object Storage, Paris). Mail sent to the contact address is forwarded by INWX GmbH & Co. KG, Prinzessinnenstraße 30, 10969 Berlin, to the operator's mailbox. These providers act as processors under Art. 28 GDPR data processing agreements. No data is sold or shared with anyone else; there are no analytics and no advertising.

6. Cookies and local storage

The service sets one strictly necessary session cookie (to keep you signed in) and uses the browser's local storage for equally necessary preferences such as the dark-mode setting and guest-mode data. Nothing is used for tracking, so no consent banner is required (§ 25(2) TDDDG).

7. Retention

Your data is kept until you delete it or your account; deleting the account removes everything it owns immediately. Deleted data leaves server backups within 14 days. Sign-in links expire after 15 minutes; sessions expire after 90 days; server logs are deleted after 14 days.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). The app itself covers the common cases: "Export data" in the account menu downloads everything in a machine-readable format, and "Delete account" erases it. For anything else, email mail@jeden.day. You also have the right to lodge a complaint with a data-protection supervisory authority, for example the one of North Rhine-Westphalia (LDI NRW).

9. Changes

If this policy changes materially, registered users will be notified by email before the change takes effect.