Daywork privacy notice

Version 2026-11-10 · Daywork by Raw Craft Design LLC

Who we are

Daywork is a creative-practice studio operated by Raw Craft Design LLC, the controller of the personal data described in this notice. Daywork is for people 18 or older.

Privacy requests: privacy@rawcraftdesign.com.
General support: contact@rawcraftdesign.com.

You can also send a request to the business mailing address above.

What stays on your device

Your studio, with its seeds, journal pages, projects, sessions and settings, is saved in your browser's storage on your device first, so Daywork works offline. Pictures and recordings keep their bytes on the device. If you turn on the fingerprint lock, your phone's authenticator creates a credential; Daywork keeps only its identifier and public key, and never sees your fingerprint. Copies on a device stay there after you sign out, until you clear the browser's storage for Daywork.

What leaves your device, and why

AI features

AI features use the context you authorise through their review and consent controls. Typed page words are not included with pictures unless you choose them. The routes are:

• Daywork's default route. Gemini 2.5 Flash on Google Vertex AI, reached through Vercel's AI Gateway with zero-data-retention routing requested.
• The OpenAI route, if you choose it in the model menu. GPT-5.1 through the same Gateway under OpenAI's standard retention, which the menu states beside the choice.
• Text reviews and book reviews. Gemini 3.8 Flash for text reviews and Claude Opus 5.5 for book reviews, through the Gateway, requesting zero data retention. Writing AI remains paused until its quality gates pass. Where a project's chosen help level allows revision proposals, they are labelled and require your review before application.
• Recall. If you turn recall on, passages you chose are embedded with Google's multilingual embedding model through the Gateway and stored in your studio's private index. Turning recall off purges the index.
• Your own Anthropic key. If you add one, Live replies go straight to api.anthropic.com with your key under your own Anthropic account's terms, and the replies stay in your studio.

AI replies are advice. By default, Muse coaches rather than writing your work. You choose whether a project permits labelled proposals. Your saved work is not changed merely by receiving a reply. Raw Craft Design LLC does not use your work to train models. Provider handling also depends on the selected route and its applicable terms.

What we do not do

• No advertising, no analytics or tracking software, no cookies beyond the sign-in session, and no sale or sharing of your data for advertising.
• No diagnosis or hidden personality assessment. Lenses and preferences are choices you make. Optional Cognitive Mirror reflections use authorised check-ins as tentative observations you can correct or withdraw, with separate consent.
• No routine reading of your studio by people. Authorised operators can access production systems to run and recover the service. The device lock and app-user authenticator do not establish that every infrastructure administrator has MFA enabled.

Shared studios

Members of a shared studio read its content according to their role. Private notes, text reviews, crits, interviews and session checks stay private and do not enter shared recall. Book editorial reviews and their decisions are studio-shared records, visible to authorised members. Work you made inside someone else's studio stays with that studio if you leave or delete your account.

How long we keep things

• Your account and studios stay until you delete them. Deleting your account closes it at once and erases it seven days later, with your personal studios, their revisions, files, recordings and private records; signing in during those days restores it. A shared studio you own passes to its longest-standing admin or editor. Full steps are at delete-account.html.
• Saved revisions of a studio are kept until the studio goes, so you can restore earlier work.
• Erasure records keep a one-way hash of the account identifier and the dates, so we can show a deletion happened without keeping who it was.
• Spend records for AI and email allowances keep the amount and the time with the person and studio removed.
• Recovery copies. Provider database backups follow the configured provider retention period and do not include stored file bytes. A verified off-site backup-and-restore process covering both the database and files is not yet established. Deletion instructions must be reapplied if a backup is restored; exports you hold yourself are separate.
• Downloads and exports you make are yours and are not affected by deletion.
• Vendor logs follow each vendor's own retention, stated above.

Where your data is processed

Raw Craft Design LLC operates Daywork from the United States. Supabase holds your account and studio in its Virginia region. Vercel hosts the app and API, and the providers above process requests where they operate. This can involve processing outside your country.

International-transfer arrangements are still being verified. This notice does not claim that an adequacy decision or contractual safeguard has been verified for every transfer. For information about the providers, agreements and safeguards that apply to your data, contact privacy@rawcraftdesign.com or write to our business address.

Your rights and choices

• See and take your data. Export your studio as a file at any time from Settings. Account details are visible in Settings.
• Correct it. Everything in your studio is yours to edit.
• Delete it. Delete your account in Settings, or by the steps at delete-account.html.
• Change your mind. AI features, transcription, spoken replies, recall, reminders and Readwise are each switched on by you and can be switched off at any time.
• Ask us. Write to the contact above to exercise any right, including, if you live in the European Economic Area, the United Kingdom or Switzerland, the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and the UK GDPR, and the right to complain to your supervisory authority. If you live in California, you have the rights to know, delete and correct, and the right not to be discriminated against for exercising them; we do not sell or share personal information.

Our legal basis under the GDPR is the contract with you for the service itself, your consent for each AI, transcription, voice, recall, reminder and Readwise feature, and our legitimate interest in keeping the service secure.

Security

All traffic uses HTTPS. Every read and write is checked against studio membership in the database. You can add an authenticator or a passkey, and a studio can require an authenticator. The fingerprint lock is a privacy screen on your device; it does not encrypt the device copy of your studio, so use a device you trust.

Children

Daywork is for people 18 or older and is not directed to children. We do not knowingly keep data from anyone younger; if you believe we have, write to the contact above and we will remove it.

Changes

When this notice changes materially, its version date changes and the app shows the revised notice before you continue. Recording that you have seen the notice does not replace separate consent controls for optional features. Earlier versions are available on request.

Who processes data for us

This page is served with the app and carries no scripts, cookies or trackers.