Privacy Policy

Daylane · Last updated October 26, 2026

Daylane shows a household's shared week on a screen in their home. To do that, it reads calendars that the people in that household connect themselves. This page explains exactly what it reads, what it keeps, how long it keeps it, and who else is involved.

Who is responsible

Daylane is operated by Tomare LLC.

Questions about anything on this page: privacy@lane.systems.

What Daylane holds about you

Your account: Your email address, which is also how you sign in. Optionally a first name, if you gave one or accepted a suggested one. If you signed in with Google or Apple, the identifier that provider uses for you. If you use a password, only a salted hash of it — never the password itself.
Your picture, if you set one: You can give yourself a face in the app, and there are two kinds. A preset is a short word — Daylane stores only that word, and the drawing is generated on your phone and on the display, so no picture of you exists anywhere. A photograph is different: the image you choose is re-encoded on the server to a 512 by 512 picture and stored in Daylane's database, which means it is also in the encrypted nightly backups described below. Every other household member, and every display paired to a household you are in, can see it — that is what it is for. All metadata is removed. A photograph from a phone normally carries the time it was taken and often the exact place; none of that is kept, and the stored image contains nothing but the picture. Setting no picture at all is the default, and then nothing is stored.
Your calendar connections: For each calendar account you connect: which provider it is, the email address of that account, the access and refresh tokens the provider issued, the scopes granted, when it was last synchronized, and — for Google — the given name on the account. Tokens are encrypted before they reach the database (see How it is protected).
Your events: Only the fields a screen draws, listed in full below.
Your household: Its name, who owns it, who its members are, and any invitations that are still pending.
Where your household is, if the owner sets it: So the display and the app can show the weather, the household owner may give a place. The phone looks the place up itself; Daylane receives only a label for it, such as a neighborhood's name, a country code, and coordinates, which are rounded to about a kilometer before they are stored — enough to say what the weather is, never enough to find a house. No street address reaches Daylane. Every member of the household can see it. Clearing it removes it at once, and it is deleted with the household.
Your display: The name you gave the screen, an identifier the screen reports about itself, when it was paired, and when it last checked in. The token that authenticates the screen is stored only as a SHA-256 hash; the token itself is shown once, at pairing, and cannot be recovered afterwards.
Photos on your display: Daylane never receives your photos. When the household owner chooses albums for the display, the phone sends the photos straight to the screen over your home network, together with each album's name and which photos belong to which album, so the screen can show one album, or a different album on different days. All of it is encrypted on the way and stored encrypted on the screen; none of it passes through or is kept by Daylane's server, which never learns what your albums are called or what is in them. The server only introduces the two: it keeps the screen's public key, a key the screen uses to encrypt what it stores (so a revoked screen's photos cannot be read), and — for fifteen minutes while a phone is sending — the screen's address on your home network and the phone's temporary public key. If an album the display shows is deleted from the owner's phone, the phone tells the server only that this happened, and for which display, so the household can be notified; it never says which album. Revoking the screen deletes all of it.
Your lists: The lists your household keeps, such as shopping lists: each list's name, its sections, and for every item its text, an optional note, whether it has been checked off, when, and by whom. Every member of the household, and every display paired to it, can see and change them. Items are deleted as soon as anyone deletes them or clears the checked ones; a list that is archived is kept until the household is deleted.
Notifications on your iPhone: If you allow notifications: the token Apple issues so your phone can be reached, which notifications you have turned on and when you want them, and a record of each notification sent to you — what kind it was, its text, and when it was sent. Notifications are about your household's chores and lists, and about calendar events that have an alert. An event's alert goes to the people in your household it is marked as being for, or, when it is marked for nobody, to whoever has it on their calendar; it is never sent from or to a display. Notifications are delivered through Apple's push service, which carries their text — for an event alert, that includes the event's title. The record of a notification, its text included, is deleted thirty days after it was sent.
Who changed what in your household: For ninety days, Daylane keeps a record of each change made in a household — that a list was renamed, an item added or checked off, a chore edited or done, a habit marked, an event added — with who made it, whether from a phone, a display or a connected assistant, and when. It records which list, item, chore, habit or event, never what it said: no names, no text, and nothing from before or after the change, so a deleted item's words are still gone at once. A private habit is never in it. The household's owner can see it; nobody else can. After ninety days each record is deleted, and a member who leaves the household is no longer named in it.
Connected assistants: Only if you connect one. You can let an AI assistant, such as Claude, act for you in Daylane. You start it from the assistant, sign in to Daylane, and approve it on a page that says what it may do; nothing is shared before that. Daylane keeps which assistant you connected, when, and what you allowed, and the tokens it holds are stored only as hashes. Once connected, it can read the households you belong to and the first names of the people in them, your household's chores, its lists, and your habits. If you allowed changes, it can also add, change and tick off chores, start and rename lists and add to, edit and check off what is on them, start, change and mark habits, and add events to Daylane's own calendar in your account — each only as far as your own phone could. It cannot read your calendars or anything on them, it cannot delete or archive anything, and it cannot change who is in a household, your displays, or your account. It acts in every household you belong to, not just one. Daylane records which assistant made each change, by the name the assistant gives itself: what it changes is marked as made through it, the household's notifications say so — "Kacy (via Claude) checked off Milk" — and you are notified of what it did for you. What it reads is sent to the company that runs the assistant — Anthropic, for Claude — and is handled under that company's terms, not this page. You can disconnect it at any time in the Daylane app, under Settings → Connected assistants, and it stops working at once.

The event fields Daylane keeps

Title, start time, end time, whether it is an all-day event, location, description, whether the time is marked busy, free, tentative, or out-of-office, what kind of entry it is, its recurrence rule and, for one occurrence of a repeating event, when it was first scheduled, a label and reference for any conference attached to it, the display names of attendees, how many attendees there are, and the reminder time. For an event in the Daylane calendar only — one you added through Daylane — it also keeps the video-call join link and any web link attached to the event, with that link's title, and shows them in the Daylane app on your household's phones, never on its display.

Daylane also keeps two things about an event that no calendar holds: who in your household it is for, and how long it takes to get there. Any member of the household can set them, on any event the household can see, from the Daylane app or the household's display, and an assistant you connected can set them on an event it adds. They are visible to the household's members and shown on its display, and they are never written into your Google or Microsoft calendar. Daylane records which member or display set them first.

That is the complete list. Everything else the provider sends is discarded — see Other people's information.

Google data, and why each permission is asked for

Signing in with Google and connecting a Google Calendar are two separate things in Daylane, with two separate consent screens. Signing in with Google grants no access to your calendar at all, and the tokens from sign-in are not stored. Only the calendar connection produces stored tokens.

When you connect a Google Calendar, Daylane asks for exactly four scopes, and a fifth only if you turn on adding events:

https://www.googleapis.com/auth/calendar.readonly: To read the events Daylane draws on the household's display. It is the read-only scope: it does not permit Daylane to create, modify, or delete anything in your calendar. Daylane reads the account's primary calendar, plus any other calendars in it that you choose to show.
https://www.googleapis.com/auth/calendar.app.created: Only if you turn on Let Daylane add events, which asks Google for it on a separate consent screen; nobody else's choice can grant it for you. It lets Daylane create one calendar of its own in your account, called Daylane, and add events to that calendar when you ask — from the app, or by asking your household's display. It reaches only calendars Daylane created: it cannot see, change or delete anything already in your calendars. An event it adds carries only what you said: a title, a time or a day, a place if you gave one, and how it repeats if you said so — and, only when you add them from the Daylane app on your phone or through an assistant you connected, notes, a web link, and a Google Meet link, which Google makes for the event in your account. Your household's display can never add or show notes or links. Where editing is switched on, you can also change or delete an event you added this way — from the app, or from your household's display if you allow that separately — but only inside the Daylane calendar, only when nobody else is invited to it, and never over a change made in Google Calendar since Daylane last read it. For a repeating event you choose, from the app, whether a change or deletion is for that one event, it and the ones after it, or all of them; from the display, a repeating event is deleted whole. Daylane never changes or deletes an event you added unless you ask it to. If you also turn on Add my chores, the chore you currently hold appears there too, is marked ✓ when it is done, and is removed if it moves to someone else; those chore events are the only ones Daylane changes or removes on its own. You can turn any of this off at any time in the app, and delete the Daylane calendar from Google Calendar like any other.
openid and email: To learn which Google account you just connected. Daylane identifies a connection by that address, so that connecting a personal and a work account gives you two distinct connections rather than one overwriting the other, and so the app and the display can show you which account a set of events comes from. It is not used to contact you.
profile: For one thing only: the given name on the Google account, offered as a suggestion for what the app should call you if you have never said. You can accept it, edit it, or decline it, and you are only ever asked once. The suggestion is stored on the connection; it is not copied onto your account unless you accept it. Nothing else from the profile is requested, read, or kept.

Limited Use

Daylane's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, and in the terms that policy uses:

Google user data is used only to provide the user-facing feature you connected the calendar for — showing your week on your household's display, and in the Daylane app, and, if you turned it on, adding the events you ask for.
It is not transferred to anyone else, except the infrastructure providers named below that are needed to run the service.
It is never used or transferred for advertising of any kind, and never sold to anyone, including advertising platforms, data brokers, or information resellers.
It is not used to train any generalized artificial-intelligence or machine-learning model.
No human reads it. The only exceptions are the ones the policy allows: if you specifically ask for help and agree to it, if it is necessary for security or to comply with the law, or where the data has been aggregated and anonymized for internal operations.

Microsoft data

Connecting a Microsoft account asks for https://graph.microsoft.com/Calendars.Read — read-only calendar access — together with openid and email to learn which account was connected, and offline_access, which is what allows Daylane to keep the display up to date without asking you to sign in again every hour. Daylane reads the account's default calendar, plus any others you choose, and writes nothing: adding events is offered for Google accounts only, because Microsoft's only permission to add events would also reach every calendar already in the account.

Other people's information

An ordinary calendar is full of information about people who have never heard of Daylane: the email addresses of everyone invited to a meeting, who organized it, meeting join links, free-text descriptions, attachments. In one ordinary calendar measured while building this, twenty-three events carried thirty-one distinct email addresses.

Daylane discards all of it. The provider's response is used to fill in the event fields listed above and is then thrown away, not stored. No attendee email address is written to the database at all, and no meeting join link is either, except on an event in the Daylane calendar that you added yourself — both asserted by automated tests, not merely intended. Attendees appear on a display as names, never as addresses.

This is deliberate and load-bearing: those people are not Daylane users and have consented to nothing, so the safest thing to do with their data is not to keep it.

How it is protected

OAuth tokens are encrypted by the application before they reach the database, using Fernet authenticated encryption with a key held in the server's environment and never in the database. Anyone reading the database, a backup, or a replica sees ciphertext, not credentials. Multiple keys can be configured at once — the newest encrypts, all of them decrypt — so a key can be rotated without downtime.
The same encryption protects the short-lived secret used during the calendar authorization handshake.
Display tokens are stored only as a SHA-256 hash.
All traffic between the apps, the displays and the server is over HTTPS.
Tokens never appear in any API response, in any log line, or in the administrative interface. The fields are not registered there at all, because a field that does not exist in a form cannot be leaked by one.
One person's calendar connection is visible only to that person. A household owner cannot see, inspect, synchronize, or revoke another member's connection; what the owner can see is which accounts feed the household and how many events each contributes.

Who else is involved

Google and Microsoft: The calendar providers themselves. Daylane reads from them under the permission you granted, which you can withdraw at any time from your Google account or Microsoft account.
Apple, for the weather: If the owner has set the household's place, Daylane's server asks Apple's weather service (WeatherKit) for the forecast there, sending the rounded coordinates, the country code and the household's timezone. The request comes from Daylane's server, so Apple never receives your phone's or your display's IP address, and nothing in it says who you are. Households that round to the same place are answered from one request.
DigitalOcean: Hosts the server and the database, in DigitalOcean's New York region, in the United States.
Cloudflare: Stores the nightly backups of the database, in Cloudflare's Eastern North America region, in the United States — the same country as the server itself. The backup is encrypted on Daylane's own server before it is uploaded, so what Cloudflare holds is ciphertext, and Cloudflare has no key for it. Storing backups is the only thing Cloudflare does here: it is not the DNS provider for this domain, and it does not serve this website.
Resend, which delivers through Amazon SES: Sends the only email Daylane sends: email-verification codes, password resets, and household invitations. These carry your email address, and an invitation carries the household's name and the first name of the person inviting you — deliberately no link and no email address of the inviter, because an invitation mistyped by one character reaches a stranger.
The assistant you connect, if you connect one: Receives what it reads on your behalf, as described under Connected assistants, and handles it under its own terms. Daylane sends nothing to an assistant you have not connected yourself.
GitHub: Serves this website. Like any web host, GitHub receives the IP address of anyone who visits this page. Daylane adds no cookies, analytics, or third-party scripts of its own to it.

Daylane does not sell your data, and does not share it with anyone else — other than an assistant you connect yourself, with what it reads for you. There is no advertising in Daylane and no third-party tracking in it.

How long it is kept

Past events are deleted about six months after they end — 183 days, measured from the event's end time rather than its start, so that something long-running that has not finished is never removed from a display while it is still current. Future events are never pruned, however far ahead they are.
Who an event is for, its travel time and its alerts are deleted a week after the event is no longer in any of the household's calendars, and a setting for one occurrence of a repeating event goes when past events of that age do. A person stops being named on any event the moment they leave the household.
The record of who changed what in a household is deleted after ninety days, and notifications thirty days after they were sent.
Your account, household, connections, and display records are kept while the account exists.
Abandoned calendar-authorization attempts and unredeemed display pairing codes are cleared out automatically shortly after they expire.
Backups hold a copy for a while after something is deleted. The database is backed up nightly, and those backups are kept on a rolling schedule — fourteen daily, eight weekly, and six monthly snapshots. Anything deleted from the live database remains in the snapshots that were already taken until the last of them ages out, which can be up to about six months. Those snapshots are encrypted, and they are read for one purpose: restoring the service if it is lost.

Removing your data

Disconnect a calendar: Daylane first tells the provider to stop sending change notifications, then deletes the connection along with the stored tokens and every event that connection contributed, in every household. You can also revoke Daylane's access directly in your Google or Microsoft account settings, which stops it reading anything further.
Disconnect an assistant: In the Daylane app, under Settings → Connected assistants. Its access ends immediately and the tokens Daylane held for it are deleted. What it already read is held by the assistant's provider under its own terms.
Remove your picture: Choosing a preset, or choosing no picture at all, deletes the stored photograph from the live database immediately — it is not kept in case you change your mind. A copy remains in the encrypted backups already taken until they age out, as it does for everything else.
Leave a household, or be removed from one: Your events stop being shown on that household's display, and the copies held for that household are deleted on the next synchronization — within about fifteen minutes.
Delete your account: Deleting your account removes your account record, your calendar connections and the tokens stored with them, any photograph you set, every event those connections contributed, the household you own together with its displays, its lists and its pending invitations, your membership of any other household, and every assistant you connected. Before anything is deleted, Daylane shows you what will go — including how many people lose access to a household you own, and how many displays go dark — because deleting an owner's account deletes the household with it.
The grants behind a deleted account: Deleting your account also hands your calendar grants back. A Google grant is revoked with Google, so Daylane stops appearing in your Google third-party access list. Microsoft publishes no way for an application to hand a delegated personal grant back, so Daylane tells you to remove it yourself in your Microsoft account rather than claiming it did. Apple sign-in stores no token here that could be revoked, so you remove Daylane under Settings → Apple Account → Sign in with Apple. You are told which of these actually happened.

Each of those describes the live database — the one Daylane reads, and the only one a display is ever drawn from. What is deleted there is gone from the service. The encrypted backups are the exception noted above: a copy stays in the snapshots already taken until they age out.

The display in your home

A paired screen shows the household's week to whoever is in the room. That is the purpose of the product, and it is worth being explicit about: anything on a connected calendar may be visible to anyone who can see that screen, including guests in the home. Only the household owner can pair a display or unpair one, and unpairing takes effect within about twenty milliseconds on a screen that is online.

Changes to this policy

If what Daylane does with your data changes, this page changes with it, and the date at the top is updated.