Last updated: October 24, 2026
Daylark is a service operated by Aliaksei Smaliuk, a sole trader (jednoosobowa działalność gospodarcza) registered in the Polish CEIDG register. "Daylark" is a trading name; the data controller for the personal information described in this Privacy Policy is that natural person.
We have not designated a data protection officer. Send every question or request about your personal information to privacy@daylark.net.
The controller is established in the European Union, so no representative under Article 27 of the EU GDPR is appointed. Our lead supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.
We collect the following categories of information:
Where the GDPR or the UK GDPR applies, each purpose below relies on the legal basis named beside it. Where the basis is our legitimate interests (Article 6(1)(f)), the table names the interest, and you can object to that processing (Section 7).
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account, your family and the syncing of its log between caregivers | Account & authentication data, your profile (display name, photo address, language, colour, family role), your family's name, family membership | Article 6(1)(b) — necessary to perform our contract with you. After you end the contract under section 9 or 15 of the Terms of Use, until your account is deleted: Article 6(1)(f) — our legitimate interest, and that of the other members of your family, in the account and the family working while each of you can still take a copy of your data |
| Keeping your account, your family and its log after you end the contract under section 9 or 15 of the Terms of Use, until they are deleted | The data in the row above and in the next row | Article 6(1)(f) — our legitimate interest in letting you, and the other members of a family you own, take a copy of your data before it is deleted. You can object (Section 7) or delete your account yourself at any time. Your child's log stays under your explicit consent from the next row until it is deleted or you withdraw that consent |
| Keeping the log of your child's day | Child activity content: the child's name, date of birth and sex, activity entries, growth and health entries, notes; a pumping entry is about the caregiver who pumped | Article 6(1)(a) and Article 9(2)(a) — your explicit consent, given on the consent screen (see below) |
| Sending an invitation to a co-caregiver you name | The invitee's email address, your display name, the family name | For you, Article 6(1)(b), and after you end the contract under section 9 or 15 of the Terms of Use, until your account is deleted, Article 6(1)(f) — our legitimate interest in the family working. For the person invited, Article 6(1)(f) — our legitimate interest in delivering the invitation a family member asked us to send |
| Selling and managing a subscription | Billing identifiers, including a founding-member code your family redeems; if we close Daylark, the list of the subscriptions the closing affects that section 6 describes | Article 6(1)(b). After you end the contract under section 9 or 15 of the Terms of Use, until your account is deleted: Article 6(1)(f) — our legitimate interest in your family keeping the partner sync its subscription pays for, which ending the contract does not cancel in the App Store or Google Play. For that list: Article 6(1)(b) for paying the refund section 9 of the Terms of Use promises, Article 6(1)(c) for the record of the payment, which tax law requires us to keep, and Article 6(1)(f) — our legitimate interest in being able to answer a claim about the refund — for keeping it until the date section 6 gives |
| Notifying co-caregivers when something is logged, and sending account notices such as a scheduled family deletion | Push notification tokens, your display name, the family name, email address | Article 6(1)(b). After you end the contract under section 9 or 15 of the Terms of Use, until your account is deleted: Article 6(1)(f) — our legitimate interest, and that of the members of your family, in being told what is logged and what happens to the account and the family |
| Measuring how the app is used, including sign-up, the paywall and subscription steps, and subscription cancellations sent from our servers | Device & usage data, your Daylark account identifier, the app installation's Google Analytics identifier, approximate location (city, region, country) that Google derives from the connection | Article 6(1)(a) — your consent, given by turning on usage analytics (see below). For the events derived from a child's log (a child being added, an entry being recorded and whether it has a note, the number of children and the youngest child's age band), also Article 9(2)(a) — your explicit consent, given by the same switch, whose statement names them; they are sent only from a device on which your consent for your child's log is in force too |
| Finding and fixing crashes | Crash & diagnostic data | Article 6(1)(f) — our legitimate interest in an app that works. Collected only from a device on which your consent for your child's log is in force, except at the first start after an update described in §9 |
| Protecting the service from abuse and keeping it running | The IP address and browser or app details of each request to our servers, kept in server logs and in counters that limit how often a request can be repeated, with your Daylark account identifier or your family's internal identifier, and in the logs a masked form of the email address of a waitlist signup; app integrity data (Firebase App Check) | Article 6(1)(f) — our legitimate interest in the security and availability of Daylark for all its users |
| Emailing the person who bought a subscription when it or its free trial starts, after each Monthly renewal, and before each Annual renewal | Your email address, the plan, its price and currency, its renewal date and the store it was bought in | Article 6(1)(b). After you end the contract under section 9 or 15 of the Terms of Use, until your account is deleted: Article 6(1)(f) — our legitimate interest in telling you what the store charges you for a subscription that ending the contract does not cancel |
| Answering a privacy request, such as a data export or account deletion | The data the request concerns, your email address | Article 6(1)(c) — our legal obligation under Articles 12 to 22 of the GDPR |
| Answering email you send us, including a report of content you consider illegal and a refund we pay you by bank transfer | Emails you send us: your name and email address, what your message says, and for such a refund the bank account you name | Article 6(1)(f) — our legitimate interest in answering the people who write to us. For a report of illegal content, Article 6(1)(c) — our legal obligation under Article 16 of Regulation (EU) 2022/2065 (the Digital Services Act) to take such reports and decide on them. For a refund, Article 6(1)(b), Article 6(1)(c) for the record of the payment, which tax law requires us to keep, and Article 6(1)(f) — our legitimate interest in being able to answer a claim about the refund — for keeping the request until the date section 6 gives |
| Telling you when Daylark launches, and about the founding-member offer, if you joined the waitlist on daylark.net | Your email address, whether you answered that you co-parent, and the record of your consent | Article 6(1)(a) — your consent, given by ticking the box on the waitlist form |
Some of your child's log is health data in its own right: a health entry records a medication name and dose, a vaccination name, or a body temperature reading, and a growth entry records a weight, a height, or a head circumference. The remaining categories — feeding, sleep, diaper changes, pumping and leisure — can likewise reveal information about a child's routine and wellbeing, and a pumping entry is information about the caregiver who pumped. We therefore process all seven only with your explicit consent under Article 9(2)(a) of the GDPR, which we ask for on a dedicated consent screen before you can create a child profile. You give it as the parent or caregiver acting for the child and, for your own pumping entries, for yourself.
You can withdraw that consent at any time in the app, under Settings → Account & data → Withdraw data consent. Withdrawing does not affect the lawfulness of what we processed before you withdrew. Once you withdraw on a device, Daylark stops usage analytics and crash reporting on that device straight away. Crash reports stored on the device are not sent: they are deleted the next time the app starts there, even if consent has been given on that device by then, with the one exception described in §9. You cannot record anything new on that device until you consent again. If you use Daylark on more than one device, withdraw on each of them. After you withdraw, the app shows only the consent screen, where you can consent again, sign out or delete your account. To export your data or delete entries after that, consent again or email privacy@daylark.net. Entries already recorded are kept until they are deleted, your account is deleted, or you ask us to erase them.
Usage analytics is a separate consent, asked for by a switch beside the consent for your child's log and in the app under Settings → Account & data → Usage analytics. On the screens before the home screen, where Settings cannot be reached, a Usage analytics switch under the screen turns it off. It is off until you turn it on, and Daylark works the same without it. Until you turn it on, the app sends nothing to Google Analytics, and neither do our servers.
You can withdraw this consent at any time by turning the switch off; withdrawing the consent for your child's log turns it off too. Withdrawing does not affect the lawfulness of what was collected before. Turning it off stops collection on that device at once, and deletes the app installation's Google Analytics identifier we store with your account as soon as the app reaches our servers, after which our servers send nothing about you to Google Analytics either. Our servers keep your latest answer, from whichever of your devices gave it, with the time it reached them: once you have turned usage analytics off, another device on which you turned it on earlier does not start them sending again, and they send again only after you turn usage analytics on again. Signing out stops collection too, until you sign in again. If you use Daylark on more than one device, turn it off on each of them. Analytics data already collected is kept as Section 6 says.
No law obliges you to give us any personal information. To create an account, you have to sign in with Apple or Google, which gives us an email address and an account identifier: without them we cannot provide the service. You do not have to give consent to the processing of your child's log, but without it you cannot use the app: it shows only the consent screen, where you can consent, sign out or delete your account. You do not have to consent to usage analytics, and nothing in the app depends on it. You do not have to join the waitlist.
Daylark accounts are created and operated by adult parents and caregivers. A child whose activities are logged in Daylark is a data subject, not an app user or account holder — they do not interact with Daylark directly. The parent or caregiver who creates a child's profile is responsible for having the authority to log that child's information and for managing consent on the child's behalf.
We share personal information with the following processors, solely to operate the Daylark service on our behalf. All of them are based in the United States; Section 11 explains how those transfers are protected.
Other recipients, who are not our processors:
Email you send to a daylark.net address is delivered to a mailbox at Google's Gmail service.
We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.
We do not process your personal information for targeted advertising. We do not collect, use or sell personal information to train large language models.
We keep no backup copies of the Daylark database. The database keeps an earlier version of changed data for one hour, after which a deletion from it is final.
Under the GDPR you have the right to:
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal information that relies on our legitimate interests (Article 6(1)(f)): crash reports, abuse prevention, delivering an invitation to you, answering email you send us, and keeping and using your account, including its subscription records and the emails to the person who bought a subscription, after you end the contract under section 9 or 15 of the Terms of Use, until it is deleted, and, if we close Daylark, keeping the list of the subscriptions the closing affects until the date section 6 gives. Email privacy@daylark.net. We will then stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims (Article 21(1)).
Our servers make some decisions about you alone, without a person. Four of them grant, end or refuse something you have under our Terms of Use, so we treat each as a decision that produces legal effects concerning you (Article 22(1)). We make them because they are necessary to perform our contract with you (Article 22(2)(a)). The fifth decides whether you can buy Annual on the founding-member offer, so we treat it as a decision that similarly significantly affects you (Article 22(1)). We make it because it is necessary to enter into that contract with you (Article 22(2)(a)). After you end the contract under section 9 or 15 of the Terms of Use, and until your account is deleted, you have nothing under the Terms for the first four to grant, end or refuse, so they no longer have that effect for you: they decide how the account works while it is kept, and they do not affect your copy of your data. The fifth still decides whether you can make a new purchase on the offer. If the fourth makes you your family's owner before your account is deleted, the whole family is deleted with it, as section 15 of the Terms of Use describes. You can still have a person review one, as described below. The five decisions are:
None of these decisions uses your child's log. If you disagree with one, email privacy@daylark.net: a person at Daylark who can change the decision will review it, you can give your point of view, and you can contest the decision (Article 22(3)).
While your consent is in force, you can export your data, withdraw your consent, or delete your account in the app, under Settings → Account & data. To delete your account without the app, follow daylark.net/delete-account. For any other request, or if you'd rather email us, contact privacy@daylark.net. We answer a request within one month of receiving it. Where a request is complex, or we receive many, we can extend that by up to two further months; if we do, we tell you why within the first month (Article 12(3)).
Some US state laws, among them the Connecticut Data Privacy Act, give you rights over your personal information. Make a request under them in the same way, in the app or by email to privacy@daylark.net. We answer within 45 days of receiving it. Where that is reasonably necessary, because the request is complex or you sent several, we can extend that once by 45 more days; if we do, we tell you why within the first 45 days.
If we decline to act on your request, we tell you why and how to appeal. To appeal, reply to our answer or email privacy@daylark.net with "Appeal" in the subject line. We answer an appeal in writing within 45 days of receiving it, with the reasons for our decision. If we deny it, we also tell you how to contact your state's Attorney General to submit a complaint.
If you live in Washington, our Consumer Health Data Privacy Policy describes how we handle consumer health data under that state's law. If you live in Nevada, our Nevada Consumer Health Data Privacy Policy does.
The Privacy Act 1988 and its Australian Privacy Principles apply to how we handle your personal information, and this Privacy Policy is our privacy policy under them. You do not have to use your real name in Daylark: your display name, your family's name and a child's name can be any name you choose. If you would like a copy of this policy in another form, email privacy@daylark.net.
Access and correction. You can ask for access to the personal information we hold about you, and ask us to correct it, in the app or by email to privacy@daylark.net. Asking and getting access cost you nothing. We answer within 30 days. If we refuse, we tell you why in writing and how to complain about it.
Complaints. If you think we have breached the Australian Privacy Principles, email privacy@daylark.net with "Complaint" in the subject line. We confirm that we received it, look into it, and answer you in writing within 30 days with what we found and what we will do. If you are not satisfied with our answer, or we have not answered within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.
Disclosure overseas. We run Daylark from Poland, and we are likely to disclose your personal information to recipients outside Australia: our processors, listed in Section 5, which are in the United States; Apple, which delivers push notifications to iPhones and stores personal data mainly in the United States; Apple and Google, which receive the identifiers of your purchase when our processor RevenueCat checks it with the store that sold it; Apple and Google, which receive the app integrity data (Section 2) when they check that the app on your device is genuine; Google, which holds the mailbox that email you send us is delivered to; the other members of your family; a person you invite to your family, who receives your display name and the family's name; and the owner of a family you ask to join, who sees your display name and email address. The people in the last three groups can be in any country.
Decisions made by a computer program. These decisions about you are made by a computer program alone:
The Privacy Act 2020 applies to how we handle your personal information, and the Health Information Privacy Code 2020 applies to the health information in your child's log. We are the agency that collects and holds it; our name and address are in Section 1. Our privacy officer is Aliaksei Smaliuk, who also deals with complaints. You can reach our privacy officer at privacy@daylark.net.
Access and correction. You can ask us to confirm whether we hold personal information about you, to give you access to it, and to correct it, in the app or by email to privacy@daylark.net. A parent or guardian can ask for a child's information in the same way. Asking, getting access and having information corrected cost you nothing. We answer as soon as we reasonably can, and within 20 working days. If we do not correct information as you asked, we tell you why, and you can give us a statement of the correction you asked for, which we attach to the information so that it is always read with it.
Complaints. If you think we have interfered with your privacy or breached the Health Information Privacy Code, email privacy@daylark.net with "Complaint" in the subject line. We acknowledge your complaint in writing within 5 working days, and tell you then how we deal with it and that you can also complain to the Privacy Commissioner. Within 10 working days of that acknowledgement, we tell you whether we accept that your complaint is justified or, if we need more time to look into it, how much more time we need, and why if that is more than 20 working days. As soon as we have decided, we tell you our reasons, what we will do, and that you can complain to the Privacy Commissioner. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz or by phone on 0800 803 909.
Disclosure outside New Zealand. We run Daylark from Poland. Our processors, listed in Section 5, are in the United States and hold your personal information on our behalf. Your personal information, including the health information in your child's log, can also reach these recipients outside New Zealand: Google, for the usage analytics it receives in Google Analytics in the United States if you turn usage analytics on, which include events derived from your child's log (Section 3), because we have not confirmed that Google uses them only on our behalf; Apple, which delivers push notifications to iPhones and stores personal data mainly in the United States; Apple and Google, which receive the identifiers of your purchase when our processor RevenueCat checks it with the store that sold it; Apple and Google, which receive the app integrity data (Section 2) when they check that the app on your device is genuine; Google, which holds the mailbox that email you send us is delivered to; and, when they are outside New Zealand, the other members of your family, who see your child's log, a person you invite to your family, who receives your display name and the family's name, and the owner of a family you ask to join, who sees your display name and email address. These recipients may not be required to protect your information or your child's information, including your child's name, date of birth and sex and every entry in the log, in a way that, overall, provides comparable safeguards to those in the Privacy Act 2020 or, for the health information in your child's log, to those in the Privacy Act 2020 as modified by the Health Information Privacy Code 2020.
The Daylark mobile app does not use cookies and does not collect an advertising identifier (Apple's IDFA or Google's Advertising ID). We do not invoke Apple's App Tracking Transparency prompt because we do not track you across other companies' apps or websites. This website (daylark.net) does not set tracking cookies. When the app starts, Firebase App Check reads your device for Apple's App Attest and DeviceCheck or for Google Play's Play Integrity and keeps on it the integrity token, and on an iPhone or iPad the key, that the check produces (see App integrity data in §2); it does this without asking for your consent. EU law allows storing information on a device, or reading it, without consent where that is strictly necessary to provide a service you asked for, and this check serves only to protect Daylark, and your family's data on it, from requests that do not come from a genuine copy of the app on a genuine device. We rely on that exception once Apple's App Attest and DeviceCheck and Google Play's Play Integrity are registered as App Check's attestation providers for Daylark, and not for the storage and reading done before they are registered.
When the app crashes or records an error on a device on which your consent for your child's log is not in force, Firebase Crashlytics keeps a report of it on that device (see Crash & diagnostic data in §2); it does this without asking for your consent. That report is not sent: it is deleted the next time the app starts there (see §3), with one exception. The first start after an update from a version of Daylark that had turned crash reporting on for that device sends the reports kept on it, and a report kept while your consent was not in force can be among them.
Daylark is not directed at children, and we do not knowingly collect personal information directly from a child under 13. Child profile data (a child's name, date of birth and sex, and activity log entries) is entered exclusively by the adult parent or caregiver using the app, acting as the child's representative — not by the child.
Daylark's database, cloud functions and file storage are hosted by Google in the United States, and all of our processors (Section 5) are based there. When we transfer personal information from the EU/EEA to the United States:
Where the UK GDPR applies, the same recipients rely on the UK Extension to the EU-US Data Privacy Framework (Google, Resend, Cloudflare) or the UK International Data Transfer Addendum to the standard contractual clauses (RevenueCat, Resend).
We may update this Privacy Policy from time to time. If we make a material change, we will notify you in-app or by email before the change takes effect. The "Last updated" date at the top of this page always reflects the most recent version.
This Privacy Policy is effective as of October 24, 2026.